Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    C082990403156E860FC5397A9D28D44325BCB24D24A97.exe

  • Size

    16.5MB

  • MD5

    8dbea443ed6b1c5c65b8d2b5b2fee229

  • SHA1

    c28671d261a7307d1e67e41a76e26c665ebb83eb

  • SHA256

    c082990403156e860fc5397a9d28d44325bcb24d24a97ad048f1d311a5109451

  • SHA512

    6f24b1e5bf205c9d4414a2c4b27117a1763583947a837ef7cfbd00378b86c2fd59d7d3b5e243560a53a28375e8a5ad55b38d5bf802a642684e48db63c5c7044a

  Score

  10^/10

  onlyloggerredlinesocelarsv1user1aspackv2infostealerloaderstealersuricataraccoon03.12_build_34da27d123a577c68e42716053343dd3f8da508a2@tuiefc20640b4b1564934471e6297b87d8657db774adiscoveryevasionpersistencespywaretrojan

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • OnlyLogger Payload

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2