Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    1.exe

  • Size

    89KB

  • MD5

    69a5fc20b7864e6cf84d0383779877a5

  • SHA1

    6c31649e2dc18a9432b19e52ce7bf2014959be88

  • SHA256

    4fe08cc381f8f4ea6e3d8e34fddf094193ccbbcc1cae7217f0233893b9c566a2

  • SHA512

    f19f3221a26bdab7ddcf18196ef6e6012968c675065c4e56f54faaace18321c07771fdbdacabd365159ccc5bf01e40693146709217e13dcd282609242e61a4bc

  Score

  6^/10

  persistence

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2

• • Target

    10.exe

  • Size

    3.4MB

  • MD5

    84c82835a5d21bbcf75a61706d8ab549

  • SHA1

    5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

  • SHA512

    90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

  Score

  10^/10

  wannacrydiscoverypersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3behavioral4

• • Target

    2.doc

  • Size

    803KB

  • MD5

    7f6c623196d7e76c205b4fb898ad9be6

  • SHA1

    408bb5b4e8ac34ce3b70ba54e00e9858ced885c0

  • SHA256

    3a5648f7de99c4f87331c36983fc8adcd667743569a19c8dafdd5e8a33de154d

  • SHA512

    8a57b3c14fe3f6c7ea014f867924176d3b9c07ad6195b0e5fa877e16b55b1c23e4abfdf24b7e7a0dffafe8991d4878d98dad1419be03f27f64f0c95720542dee

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  behavioral5behavioral6

• • Target

    3.xlsx

  • Size

    186KB

  • MD5

    c9cd3acc2e298487bd4a370d254047b3

  • SHA1

    74bf2f7cad70d3b90400e7697ec7806ab4b88157

  • SHA256

    ca4efa47b5d61942aa639e18b498c796a4c0f4bf31ef8019515b4af51406b342

  • SHA512

    dc58d4f54395b6fab38607cd061e655db5922222a7f14353c7506cbded429e4d4fe3c5c7b95677acda97562a3e781109d11125991343838b75353bcfdd39f4b5

  Score

  10^/10

  xloaderdpzzloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    4.exe

  • Size

    120KB

  • MD5

    860aa57fc3578f7037bb27fc79b2a62c

  • SHA1

    a14008fe5e1eb88bf46266de3d5ee5db2e0a722b

  • SHA256

    5430565c4534b482c7216a0ae75d04e201ee0db0386682c0c010243083c28d29

  • SHA512

    6639b3e2594e554c7fa811f22e1c514474d34220155b4c989ad8716db1a0aea65894aa23d78c12a4618c57312da00353a77dd8e6c6bdd927bf865f2e98aff8f1

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral9behavioral10

• • Target

    5.exe

  • Size

    37KB

  • MD5

    e817d74d13c658890ff3a4c01ab44c62

  • SHA1

    bf0b97392e7d56eee0b63dc65efff4db883cb0c7

  • SHA256

    2945881f15e98a18d27108a29963988190853838f34faf3020e6c3c97342672d

  • SHA512

    8d90ef308c1e0b7e01e7732e2cd819f07bfc1ef06e523efa81694ced75550c9f1be460fc9de412faeb96273a6492580402ab9c9538ed441fc26d96b6785e7815

  Score

  10^/10

  njratbotevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral11behavioral12

• • Target

    6.exe

  • Size

    564KB

  • MD5

    748a4bea8c0624a4c7a69f67263e0839

  • SHA1

    6955b7d516df38992ac6bff9d0b0f5df150df859

  • SHA256

    220d8f8ff82d413c81bd02dfa001e1c478e8fbea44bad24f21b3a5284e15632e

  • SHA512

    5fcdfddce3cc2e636001ed08c5f2f7590aadaa37c091f7ba94e519d298e284362721f1859c6ffbf064ae23e05d4e0e9754b515396812fbe9f9028497396799fd

  Score

  10^/10

  evasionpersistencesuricatatrojandcratinfostealerrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • suricata: ET MALWARE DCRAT Activity (GET)

    suricata: ET MALWARE DCRAT Activity (GET)

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral13behavioral14

• • Target

    7.exe

  • Size

    892KB

  • MD5

    ed666bf7f4a0766fcec0e9c8074b089b

  • SHA1

    1b90f1a4cb6059d573fff115b3598604825d76e6

  • SHA256

    d1330d349bfbd3aea545fa08ef63339e82a3f4d04e27216ecc4c45304f079264

  • SHA512

    d0791eaa9859d751f946fd3252d2056c29328fc97e147a5234a52a3728588a3a1aaa003a8e32863d338ebdca92305c48b6fa12ca1e620cf27460bf091c3b6d49

  Score

  10^/10

  hawkeyecollectionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral15behavioral16

• • Target

    8.exe

  • Size

    898KB

  • MD5

    61b32a82577a7ea823ff7303ab6b4283

  • SHA1

    9107c719795fa5768498abb4fed11d907e44d55e

  • SHA256

    4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167

  • SHA512

    86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700

  Score

  10^/10

  mazeransomwarespywarestealersuricatatrojan

  • Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze

  • suricata: ET MALWARE Maze/ID Ransomware Activity

    suricata: ET MALWARE Maze/ID Ransomware Activity

    suricata

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral17behavioral18

• • Target

    9.docm

  • Size

    134KB

  • MD5

    0c7350573157a1f63ac41cc191d8c08c

  • SHA1

    b2b2076177c5355cacbeac5a837d72d6ec8a62ac

  • SHA256

    794da863af633a0ca17c9c607a44a6c1c768c458f564bf5899a6d251822c4ec5

  • SHA512

    6b947b66aedfa6ff9646cec4137e1d7b24c88153b77e28146bead6899081f0e4bf0db1e0e0cb74aa578a29de7499e27b2cd43aa4292689ac37730b6bdf0c5414

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  behavioral19behavioral20

• • Target

    rip.bat

  • Size

    240B

  • MD5

    2a3a737798bd52b365170827479b0e74

  • SHA1

    8e467ecbb934580aa1145c1620ece909e5824d4e

  • SHA256

    6bb4c441789fa52cb51b98b8a82c744115b01958bbf872428d78ef7dfb283f67

  • SHA512

    8f7fd488ba52ee1a1cf20222d765911bd1b2b8c91b56f9e1d3fa122e9d1dcead03f77118c8848a044ee0de0a18b49de7d231c0ce2703810a2ad7bc67c4d74725

  Score

  10^/10

  wannacrydiscoveryransomwaresuricatawormdcratmazeevasioninfostealerpersistencerattrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • suricata: ET MALWARE DCRAT Activity (GET)

    suricata: ET MALWARE DCRAT Activity (GET)

    suricata

  • suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata

  • suricata: ET MALWARE Maze/ID Ransomware Activity

    suricata: ET MALWARE Maze/ID Ransomware Activity

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral21behavioral22