General
-
Target
Crystal.Reports.2011.Sp9.14.0.serial.keygen.zip
-
Size
5.1MB
-
Sample
210324-zf4anpvv8e
-
MD5
cbd4ba7cdf4c9a34d2671180d365110d
-
SHA1
7eb79349346e3dd13ca6eaa0602bdb498d28f45b
-
SHA256
2bf57a8d035aa9b579412cc4af2e26db92fbe20b0de99f93e5849748c51a5e09
-
SHA512
67f01e49d723d3a9bc9ec9ab71bc0e828c38367c6d23c28fb650ce7d782e7a34e13588a91dedac139aea6b8abf96a1eff10c40decd68cb63ebb37cb1dca88e5d
Static task
static1
Behavioral task
behavioral1
Sample
Crystal.Reports.2011.Sp9.14.0.serial.keygen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Crystal.Reports.2011.Sp9.14.0.serial.keygen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Crystal.Reports.2011.Sp9.14.0.serial.keygen.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Crystal.Reports.2011.Sp9.14.0.serial.keygen.exe
Resource
win10v20201028
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
http://labsclub.com/welcome
Extracted
fickerstealer
deniedfight.com:80
lukkeze.space:80
Extracted
raccoon
dfa7b4d385486b737f84d608857eb43733ffd299
-
url4cnc
https://telete.in/j9ca1pel
Extracted
icedid
1235390667
petelbomber.xyz
Extracted
redline
black
blackeyed.top:80
Extracted
redline
19test200
erherst.tk:80
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
cryptbot
bazfr32.top
morwhy03.top
-
payload_url
http://akrvt04.top/download.php?file=lv.exe
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Extracted
icedid
petelbomber.xyz
Extracted
smokeloader
2020
http://xsss99.icu/upload/
http://bingooodsg.icu/upload/
http://junntd.xyz/upload/
http://ginessa11.xyz/upload/
http://overplayninsx.xyz/upload/
http://bananinze.com/upload/
http://daunimlas.com/upload/
Extracted
amadey
2.14
176.111.174.249/j7csltegf/index.php
Extracted
redline
1
84.38.184.213:15265
Targets
-
-
Target
Crystal.Reports.2011.Sp9.14.0.serial.keygen.exe
-
Size
5.2MB
-
MD5
e046c5ab236790083bb7c543b94def73
-
SHA1
8e94f42b5439d6c1a6156ca9abd1a4ef1cd04677
-
SHA256
cfeb154a623819c81613572e335d4a0529e769f9874035cc771fafb1b3c09b98
-
SHA512
41f925de0ec1e6284f13d8a7604a6384a55ab0bddc53bc353f90c63e8170cde9c945a1d5a3bf08dd6fb19f3097b56384524fd4d613fd59e9f3bb269043513760
Score10/10azorultdiscoveryinfostealertrojancryptbotfickerstealergluptebaicedidmetasploitraccoonredlinesmokeloadervidarxmrig19test200afefd33a49c7cbd55d417545269920f24c85aa37blackdfa7b4d385486b737f84d608857eb43733ffd2991235390667backdoorbankerdropperevasionloaderminerpersistencespywarestealerthemidaamadeydcrattaurus1rat-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
CryptBot Payload
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Glupteba Payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Taurus Stealer Payload
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
IcedID First Stage Loader
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
XMRig Miner Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Looks for VMWare Tools registry key
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Virtualization/Sandbox Evasion
2File Permissions Modification
1Modify Registry
3Install Root Certificate
1