Extracted

Extracted

• • Target
    04psi.exe
  • Size 237KB
  • SHA256 3fc06d1926ada759903e4ebc197f9da5baa80fb8f729f34395dd7c67e2d58a8c
  • MD5 4bc2708122b1e43131888d1beee6c560
  • SHA1 8a82caf8b8f908898145e953ef8f1e665e8058db
  • SHA512 fcf714de9ae1d23ebe054f601938653f9643dbbf288319b4c3b2872544dbb2c82c5db8a4abc64a146648da9f5b71760ce485c1b5935473d214736438dffc2749
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoortrojandridexvidar10111botnetcryptoneevasionloaderpackerstealer

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • CryptOne packer

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker

  • Dridex Loader

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • JavaScript code in executable

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2