Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe
  • Size 6KB
  • SHA256 34eea6a07ea67c590471581473b4a17d5ac8214e1ec94464af43fb2ce7334808
  • MD5 1ea80e6a35c7ebf9661d9c7fa5ae85ab
  • SHA1 5b0771b1886a5e77bc9fe9505a11e94d10a23d07
  • SHA512 bdade952c49b3a0c419cd5dac9e2b19fe830f7220f8625ef2d5accf7b28fb2298341c63e280182df31b3f9242d8a6815f708b7520ccf030a188cf2123480853a
  • MD5 SHA1 SHA512

  Score

  10^/10

  bitratgluptebametasploitraccoonredlinesmokeloader2d4a0d80fe676e3f8e476f0fd0e0817b52e0eaeb74452b5cbc58563477e4a9e149f2093398530bbdjasonnewbackdoordiscoverydropperinfostealerloaderstealertrojanupxvmprotect

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2