qakbot | faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

General

Target

file1.exe
Size

1.1MB
MD5

0c5d9a27daa00d234af1a30882aacc50
SHA1

ac369d06c81af9d663e135a04dc94e582a0604fb
SHA256

faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466
SHA512

4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Score

10^/10

qakbot spx135 1591627649 banker cryptone evasion packer stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

CryptOne packer 5 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe	cryptone

Executes dropped EXE 4 IoCs

Processes:

licyl.exelicyl.exelicyl.exelicyl.exe

pid process

2308 licyl.exe
636 licyl.exe
1212 licyl.exe
1704 licyl.exe

pid	process
2308	licyl.exe
636	licyl.exe
1212	licyl.exe
1704	licyl.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file1.exelicyl.exelicyl.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	file1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	licyl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	file1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	file1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	licyl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	file1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	file1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	file1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	licyl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	licyl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	licyl.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1012 schtasks.exe

pid	process
1012	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

file1.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	file1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	file1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	file1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	file1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	file1.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2720 PING.EXE

pid	process
2720	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

file1.exefile1.exelicyl.exelicyl.exeexplorer.exefile1.exelicyl.exelicyl.exe

pid	process
672	file1.exe
672	file1.exe
188	file1.exe
188	file1.exe
188	file1.exe
188	file1.exe
2308	licyl.exe
2308	licyl.exe
636	licyl.exe
636	licyl.exe
636	licyl.exe
636	licyl.exe
3924	explorer.exe
3924	explorer.exe
3924	explorer.exe
3924	explorer.exe
416	file1.exe
416	file1.exe
1212	licyl.exe
1212	licyl.exe
1704	licyl.exe
1704	licyl.exe
1704	licyl.exe
1704	licyl.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

licyl.exe

pid process

2308 licyl.exe

pid	process
2308	licyl.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

file1.exelicyl.exefile1.execmd.exelicyl.exe

description	pid	process	target process
PID 672 wrote to memory of 188	672	file1.exe	file1.exe
PID 672 wrote to memory of 188	672	file1.exe	file1.exe
PID 672 wrote to memory of 188	672	file1.exe	file1.exe
PID 672 wrote to memory of 2308	672	file1.exe	licyl.exe
PID 672 wrote to memory of 2308	672	file1.exe	licyl.exe
PID 672 wrote to memory of 2308	672	file1.exe	licyl.exe
PID 672 wrote to memory of 1012	672	file1.exe	schtasks.exe
PID 672 wrote to memory of 1012	672	file1.exe	schtasks.exe
PID 672 wrote to memory of 1012	672	file1.exe	schtasks.exe
PID 2308 wrote to memory of 636	2308	licyl.exe	licyl.exe
PID 2308 wrote to memory of 636	2308	licyl.exe	licyl.exe
PID 2308 wrote to memory of 636	2308	licyl.exe	licyl.exe
PID 2308 wrote to memory of 3924	2308	licyl.exe	explorer.exe
PID 2308 wrote to memory of 3924	2308	licyl.exe	explorer.exe
PID 2308 wrote to memory of 3924	2308	licyl.exe	explorer.exe
PID 2308 wrote to memory of 3924	2308	licyl.exe	explorer.exe
PID 416 wrote to memory of 1180	416	file1.exe	reg.exe
PID 416 wrote to memory of 1180	416	file1.exe	reg.exe
PID 416 wrote to memory of 2444	416	file1.exe	reg.exe
PID 416 wrote to memory of 2444	416	file1.exe	reg.exe
PID 416 wrote to memory of 3836	416	file1.exe	reg.exe
PID 416 wrote to memory of 3836	416	file1.exe	reg.exe
PID 416 wrote to memory of 2176	416	file1.exe	reg.exe
PID 416 wrote to memory of 2176	416	file1.exe	reg.exe
PID 416 wrote to memory of 3580	416	file1.exe	reg.exe
PID 416 wrote to memory of 3580	416	file1.exe	reg.exe
PID 416 wrote to memory of 4068	416	file1.exe	reg.exe
PID 416 wrote to memory of 4068	416	file1.exe	reg.exe
PID 416 wrote to memory of 2072	416	file1.exe	reg.exe
PID 416 wrote to memory of 2072	416	file1.exe	reg.exe
PID 416 wrote to memory of 3968	416	file1.exe	reg.exe
PID 416 wrote to memory of 3968	416	file1.exe	reg.exe
PID 416 wrote to memory of 2164	416	file1.exe	reg.exe
PID 416 wrote to memory of 2164	416	file1.exe	reg.exe
PID 416 wrote to memory of 1212	416	file1.exe	licyl.exe
PID 416 wrote to memory of 1212	416	file1.exe	licyl.exe
PID 416 wrote to memory of 1212	416	file1.exe	licyl.exe
PID 416 wrote to memory of 1036	416	file1.exe	cmd.exe
PID 416 wrote to memory of 1036	416	file1.exe	cmd.exe
PID 416 wrote to memory of 196	416	file1.exe	schtasks.exe
PID 416 wrote to memory of 196	416	file1.exe	schtasks.exe
PID 1036 wrote to memory of 2720	1036	cmd.exe	PING.EXE
PID 1036 wrote to memory of 2720	1036	cmd.exe	PING.EXE
PID 1212 wrote to memory of 1704	1212	licyl.exe	licyl.exe
PID 1212 wrote to memory of 1704	1212	licyl.exe	licyl.exe
PID 1212 wrote to memory of 1704	1212	licyl.exe	licyl.exe

C:\Users\Admin\AppData\Local\Temp\file1.exe
"C:\Users\Admin\AppData\Local\Temp\file1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:672

C:\Users\Admin\AppData\Local\Temp\file1.exe
C:\Users\Admin\AppData\Local\Temp\file1.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:188

C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2308

C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3924

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oivkddggk /tr "\"C:\Users\Admin\AppData\Local\Temp\file1.exe\" /I oivkddggk" /SC ONCE /Z /ST 23:05 /ET 23:17
2⤵
- Creates scheduled task(s)
PID:1012

C:\Users\Admin\AppData\Local\Temp\file1.exe
C:\Users\Admin\AppData\Local\Temp\file1.exe /I oivkddggk
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:1180

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:2444

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:3836

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:2176

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:3580

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:4068

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:2072

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3968

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna" /d "0"
2⤵
PID:2164

C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\file1.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:2720

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN oivkddggk
2⤵
PID:196

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.dat
MD5
7161d783602e7ed921406bb64ee93dbb

SHA1
ca1ed5976002293a83a68d56eb7115d4f7f1a579

SHA256
a8f9910b3dca4bb8d121f388700bc3a7461abe89b85886610fb73e416fcd9f01

SHA512
cc248eeb7e90e92c4a9db0d6c232a18a7f5357fa8607c01bd60646c84e60fd454f0afc2452cfc3039596b668ae490a32d3f7756eafd9c60fa5257e36ea59cd43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
MD5
0c5d9a27daa00d234af1a30882aacc50

SHA1
ac369d06c81af9d663e135a04dc94e582a0604fb

SHA256
faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

SHA512
4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
MD5
0c5d9a27daa00d234af1a30882aacc50

SHA1
ac369d06c81af9d663e135a04dc94e582a0604fb

SHA256
faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

SHA512
4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
MD5
0c5d9a27daa00d234af1a30882aacc50

SHA1
ac369d06c81af9d663e135a04dc94e582a0604fb

SHA256
faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

SHA512
4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
MD5
0c5d9a27daa00d234af1a30882aacc50

SHA1
ac369d06c81af9d663e135a04dc94e582a0604fb

SHA256
faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

SHA512
4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Retyhwdlzpna\licyl.exe
MD5
0c5d9a27daa00d234af1a30882aacc50

SHA1
ac369d06c81af9d663e135a04dc94e582a0604fb

SHA256
faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

SHA512
4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Download Submit
memory/188-0-0x0000000000000000-mapping.dmp

Download
memory/188-1-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/196-24-0x0000000000000000-mapping.dmp

Download
memory/636-8-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/636-6-0x0000000000000000-mapping.dmp

Download
memory/1012-5-0x0000000000000000-mapping.dmp

Download
memory/1036-23-0x0000000000000000-mapping.dmp

Download
memory/1180-12-0x0000000000000000-mapping.dmp

Download
memory/1212-21-0x0000000000000000-mapping.dmp

Download
memory/1704-28-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/1704-26-0x0000000000000000-mapping.dmp

Download
memory/2072-18-0x0000000000000000-mapping.dmp

Download
memory/2164-20-0x0000000000000000-mapping.dmp

Download
memory/2176-15-0x0000000000000000-mapping.dmp

Download
memory/2308-9-0x00000000021D0000-0x000000000220A000-memory.dmp

Filesize
232KB

Download
memory/2308-2-0x0000000000000000-mapping.dmp

Download
memory/2444-13-0x0000000000000000-mapping.dmp

Download
memory/2720-25-0x0000000000000000-mapping.dmp

Download
memory/3580-16-0x0000000000000000-mapping.dmp

Download
memory/3836-14-0x0000000000000000-mapping.dmp

Download
memory/3924-10-0x0000000000000000-mapping.dmp

Download
memory/3968-19-0x0000000000000000-mapping.dmp

Download
memory/4068-17-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads