Extracted

Extracted

Extracted

• • Target
    BB67A245F1B9A49C4BF41DADFC8ACE6E.exe
  • Size 3.4MB
  • SHA256 5b73fe2b2388fcd2b0f2c71f8499221e5ccd1bcfc4e31d2140d5eca1c3a45414
  • MD5 bb67a245f1b9a49c4bf41dadfc8ace6e
  • SHA1 d16a2b6cc2dcf990b5c022ff75780e512c5893fb
  • SHA512 abd5380fe2d054885a8d3ab378ab2a65885de41684f0af5d4e9c248a1dfd44ecb0852603e2e82f356900514803de4b8e23868e9c597aa58c54410aac5c2ff6f5
  • MD5 SHA1 SHA512

  Score

  10^/10

  danabotgluptebametasploitplugxredlinesmokeloader3aspackv2backdoorbankerdropperinfostealerloadertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2