Resubmissions

11-07-2024 05:43

240711-gej4lstgrf 10

06-09-2021 14:13

210906-rjpvrsedbm 10

08-07-2021 11:08

210708-4gztl3mwl6 10

08-07-2021 08:02

210708-klfb4qeda6 10

07-07-2021 09:39

210707-nem57xyvf2 10

06-07-2021 17:51

210706-7pcrmjy3fa 10

06-07-2021 13:45

210706-eybelwcq86 10

General

  • Target

    60d529d298fda60d_setupInstall.rar

  • Size

    75.6MB

  • Sample

    210702-5z6vzcjhza

  • MD5

    a550717538ccd830a11b2b1f4f6eaa34

  • SHA1

    702ddf3dfa759b0a0021cf6f0280af53a7093765

  • SHA256

    b244fb7a7b39c836a9629262eaa80865cfbaf37aaea1b1d4b880d8a864f865a4

  • SHA512

    a8cddb3f2121c664e76963d053b41ff70f1866adc0fbb3e2e240ddfeb68a67f2ca3929e514a804b856aa9526a22915ce71e20795b996712016925b43e6df7804

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

redline

Botnet

01_07_r

C2

rdanoriran.xyz:80

Extracted

Family

fickerstealer

C2

game2030.site:80

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.4

Botnet

932

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    932

Extracted

Family

cryptbot

C2

xeieib52.top

moraid05.top

Attributes
  • payload_url

    http://lopoga07.top/download.php?file=lv.exe

Extracted

Path

C:\_readme.txt

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ggGVjyTdgD Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0310ewgfDdSlaP9yu3EpvxGAT2LB7m5QMZSCOJTzQPqNIEfJ2f
URLs

https://we.tl/t-ggGVjyTdgD

Extracted

Family

vidar

Version

39.4

Botnet

903

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    903

Extracted

Family

vidar

Version

39.4

Botnet

865

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    865

Extracted

Family

redline

Botnet

Shakal_Team

C2

enatuykebe.xyz:80

Extracted

Family

redline

Botnet

EE

C2

tstamore.info:80

Extracted

Family

redline

Botnet

73942

C2

195.242.110.135:24221

Extracted

Family

vidar

Version

39.4

Botnet

517

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    517

Targets

    • Target

      setup_x86_x64_install - копия (10).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    • Target

      setup_x86_x64_install - копия (11).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (12).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • DiscordStealer

      Discord_Stealer.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (13).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (14).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (15).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    • Target

      setup_x86_x64_install - копия (16).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (17).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (18).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • DiscordStealer

      Discord_Stealer.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (19).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    • Target

      setup_x86_x64_install - копия (2).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • DiscordStealer

      Discord_Stealer.

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    • Target

      setup_x86_x64_install - копия (20).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Nirsoft

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (21).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    • Target

      setup_x86_x64_install - копия (22).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    • Target

      setup_x86_x64_install - копия (23).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    • Target

      setup_x86_x64_install - копия (3).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

Score
N/A

behavioral1

fickerstealerredlinevidar01_07_rservaniaspackv2discoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral2

redlinesmokeloadervidar706932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral3

fickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
Score
10/10

behavioral4

Score
1/10

behavioral5

cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojan
Score
10/10

behavioral6

redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealerthemidatrojanupx
Score
10/10

behavioral7

cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
Score
10/10

behavioral8

redlinesmokeloadervidar706932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealertrojanupx
Score
10/10

behavioral9

cryptbotfickerstealerredlinesmokeloadervidar01_07_rservaniaspackv2backdoorevasioninfostealerspywarestealertrojan
Score
10/10

behavioral10

redlinesmokeloadervidar706932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral11

cryptbotfickerstealerredlinesmokeloadervidar73942eeshakal_teamaspackv2backdoorevasioninfostealerspywarestealerthemidatrojanvmprotect
Score
10/10

behavioral12

redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx
Score
10/10

behavioral13

vidaraspackv2stealer
Score
10/10

behavioral14

redlinesmokeloadervidar706865servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx
Score
10/10

behavioral15

fickerstealerplugxredlinevidarservaniaspackv2discoveryevasioninfostealerstealertrojan
Score
10/10

behavioral16

redlinesmokeloadervidar706865932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral17

cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
Score
10/10

behavioral18

redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral19

cryptbotfickerstealerredlinesmokeloadervidar01_07_r706865903932servaniaspackv2backdoordiscoveryevasioninfostealerspywarestealertrojan
Score
10/10

behavioral20

redlinesmokeloadervidar706903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral21

cryptbotfickerstealerredlinesmokeloadervidar01_07_r517706865903932servaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral22

redlinesmokeloadervidar706865932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral23

cryptbotfickerstealerredlinevidar70673942865903932eeservaniaspackv2discoveryevasioninfostealerspywarestealertrojanupx
Score
10/10

behavioral24

redlinesmokeloadervidar706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealerthemidatrojanupx
Score
10/10

behavioral25

cryptbotfickerstealerredlinesmokeloadervidarservaniaspackv2backdoorevasioninfostealerspywarestealertrojanupx
Score
10/10

behavioral26

redlinesmokeloadervidar706903servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral27

fickerstealerplugxredlinesmokeloadervidaraspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx
Score
10/10

behavioral28

redlinesmokeloadervidar706servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral29

cryptbotfickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojan
Score
10/10

behavioral30

redlinesmokeloadervidar706865932servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral31

fickerstealerredlinesmokeloadervidar517706865903932servaniaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealertrojan
Score
10/10

behavioral32

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10