Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    7.0.0.0.exe

  • Size

    6.4MB

  • MD5

    514ca6348b6d29069d6b436fc1f1c159

  • SHA1

    ebd3d2d7924b78a165eb2d689eae5ff90c709e01

  • SHA256

    35b846afc6bf51292d8a401a68a24a0e36d131d7798ceaa8713f08b6942fe0b5

  • SHA512

    e51f635718f021f5f238b2510c8e7b99b57318cbcbae09773ea123c275f48156f6ca76be6aaea7901a6d7351d54aa8486dbcd01160a18082c59fb09211ab533e

  Score

  7^/10

  agilenet

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  behavioral1behavioral2

• • Target

    ILMerge.exe

  • Size

    668KB

  • MD5

    2bb6322885e6ca0986206de174e842c9

  • SHA1

    c5ea70169106d32bc513d28ea76ae8ea1e49380b

  • SHA256

    8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd

  • SHA512

    9750180c54a5bd8f0e1fa8a8f529364430f2ef444efbf8ac51e8d2a0aaa4e3d21fe553865ba8567c7c19e4ae84d04b20464f391743e88c52c00cac0bf20fc2a7

  Score

  1^/10
  behavioral3behavioral4

• • Target

    pack/AbPmX.exe

  • Size

    45KB

  • MD5

    a23c5f26bb7a11952d408d99242e5c06

  • SHA1

    0712a50bbb25a1803df9e9f7fd195ed86f54d1a7

  • SHA256

    d140f6813ba550ee767cdcac73ea9f38868e6e3653289b7f0f49d04db65860c0

  • SHA512

    4955d486cb75050c702877ac6d4ea26b0328cb8978e2854b1fd06fd62c9f98a89918e78ed66caedf3459b6fb542fba170e98e0d4e0940a6a65384b75d0830b47

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat
  behavioral5behavioral6

• • Target

    pack/AcAoB.exe

  • Size

    95KB

  • MD5

    0ec54c61531a22e6ccc517293d137d67

  • SHA1

    4bc1bb4273cbefc10efbae5e55a03f4aaba624ab

  • SHA256

    98049233378275be99a475de751e30042eee539f0644fbc0cd84b041aaab2396

  • SHA512

    0bf6b2ee458083ed74f4954e308dd5742fd31b269dd757af507be9ab821b2833de46bbc532854719c9cf7acfbf0fac995a86d580f13d7f82cee9b5d0a6790ec8

  Score

  10^/10

  redlinecheatinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  behavioral7behavioral8

• • Target

    pack/AdEXN.exe

  • Size

    45KB

  • MD5

    a23c5f26bb7a11952d408d99242e5c06

  • SHA1

    0712a50bbb25a1803df9e9f7fd195ed86f54d1a7

  • SHA256

    d140f6813ba550ee767cdcac73ea9f38868e6e3653289b7f0f49d04db65860c0

  • SHA512

    4955d486cb75050c702877ac6d4ea26b0328cb8978e2854b1fd06fd62c9f98a89918e78ed66caedf3459b6fb542fba170e98e0d4e0940a6a65384b75d0830b47

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat
  behavioral9behavioral10

• • Target

    pack/AeCKK.exe

  • Size

    15KB

  • MD5

    a29ccdfe75b6d00c5af0d219040ec8fa

  • SHA1

    056a8309ed4c51c11d841c136e8e9d4d40b0c347

  • SHA256

    27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943

  • SHA512

    229bdf1ab0a6761cc72edf5f78d6da02f5219cc5863b15ec1883fc531ba04df6a661b650cd10c5fcc9d6e5d473775b19f00442edcaaf664a18140dc5bc2e830c

  Score

  1^/10
  behavioral11behavioral12

• • Target

    pack/AeSRJ.exe

  • Size

    5.3MB

  • MD5

    95c9c83e4d5f20a4bd8a5354cec20d27

  • SHA1

    4f75dc7c374a15026bc3e557d5849d8f27414971

  • SHA256

    ae8b777d1cb934b3f9badd12d3599c739aa7b8972f99b48a5ba668866e34fff4

  • SHA512

    72c65d5a5162355d251c4452b050355c686b751719ee9ccbd6e19f3e414dbf1aea598e1704aad7183f2c1654622927fd84badd36b42e845ffc5496cf0eb808fd

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral13behavioral14

• • Target

    pack/AfDTM.exe

  • Size

    47KB

  • MD5

    81a1f53a7e0431c385b3537c9e86e9ca

  • SHA1

    fee349b7f96843c91ed47a19f9aa2f58520ddb1c

  • SHA256

    c47cc8f39a3d676895f1bbb92f94d50d5e5d20f7be816b76c09b08cef4d380a7

  • SHA512

    626f5d74a98e3b8cc8f3be3ea7d5611918731a35331dad3603d18426cefd694e6d66b46fb277c46300792c3da930022fc6db28afb68a6e9e4d974a90c9e091c4

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat
  behavioral15behavioral16

• • Target

    pack/AfMaR.exe

  • Size

    45KB

  • MD5

    a23c5f26bb7a11952d408d99242e5c06

  • SHA1

    0712a50bbb25a1803df9e9f7fd195ed86f54d1a7

  • SHA256

    d140f6813ba550ee767cdcac73ea9f38868e6e3653289b7f0f49d04db65860c0

  • SHA512

    4955d486cb75050c702877ac6d4ea26b0328cb8978e2854b1fd06fd62c9f98a89918e78ed66caedf3459b6fb542fba170e98e0d4e0940a6a65384b75d0830b47

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat
  behavioral17behavioral18

• • Target

    pack/AfZcW.exe

  • Size

    45KB

  • MD5

    a23c5f26bb7a11952d408d99242e5c06

  • SHA1

    0712a50bbb25a1803df9e9f7fd195ed86f54d1a7

  • SHA256

    d140f6813ba550ee767cdcac73ea9f38868e6e3653289b7f0f49d04db65860c0

  • SHA512

    4955d486cb75050c702877ac6d4ea26b0328cb8978e2854b1fd06fd62c9f98a89918e78ed66caedf3459b6fb542fba170e98e0d4e0940a6a65384b75d0830b47

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat
  behavioral19behavioral20

• • Target

    pack/AnWLP.exe

  • Size

    15KB

  • MD5

    a29ccdfe75b6d00c5af0d219040ec8fa

  • SHA1

    056a8309ed4c51c11d841c136e8e9d4d40b0c347

  • SHA256

    27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943

  • SHA512

    229bdf1ab0a6761cc72edf5f78d6da02f5219cc5863b15ec1883fc531ba04df6a661b650cd10c5fcc9d6e5d473775b19f00442edcaaf664a18140dc5bc2e830c

  Score

  1^/10
  behavioral21behavioral22

• • Target

    pack/AnZNZ.exe

  • Size

    45KB

  • MD5

    a23c5f26bb7a11952d408d99242e5c06

  • SHA1

    0712a50bbb25a1803df9e9f7fd195ed86f54d1a7

  • SHA256

    d140f6813ba550ee767cdcac73ea9f38868e6e3653289b7f0f49d04db65860c0

  • SHA512

    4955d486cb75050c702877ac6d4ea26b0328cb8978e2854b1fd06fd62c9f98a89918e78ed66caedf3459b6fb542fba170e98e0d4e0940a6a65384b75d0830b47

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat
  behavioral23behavioral24

• • Target

    pack/ApRnS.exe

  • Size

    136KB

  • MD5

    6862264bbd7688ac4bd96f16786cd153

  • SHA1

    8fd23a996f8b78914f9969cb3c31be7ffd02e346

  • SHA256

    701ef63a3a8c4f2eb90d64cd897e0098460e1272a54404b90ab794a685b98ffc

  • SHA512

    23df9d7fe2e8028d2b7f985344ac5ff0d01f9a45f0925f6b37b0df64aab3702612e5bfb56cb29bc2325bd26ffe152fc69f4af5e36d0e94a97a6f04d27460c2e2

  Score

  10^/10

  stormkittycollectionstealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral25behavioral26

• • Target

    pack/AqDpY.exe

  • Size

    15KB

  • MD5

    a29ccdfe75b6d00c5af0d219040ec8fa

  • SHA1

    056a8309ed4c51c11d841c136e8e9d4d40b0c347

  • SHA256

    27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943

  • SHA512

    229bdf1ab0a6761cc72edf5f78d6da02f5219cc5863b15ec1883fc531ba04df6a661b650cd10c5fcc9d6e5d473775b19f00442edcaaf664a18140dc5bc2e830c

  Score

  1^/10
  behavioral27behavioral28

• • Target

    pack/AsNMX.exe

  • Size

    6KB

  • MD5

    2077e8080a5f540e281242a1b475f865

  • SHA1

    b6e2e18a6a3574bab7f17185dc0b00da1a34a95c

  • SHA256

    04153178e5f9f669cd1c89d653d45a0431d46ff5e9dc6128522bc02aacdb9895

  • SHA512

    4e2bc30f93fbc06302fa29efcc0e5d164bf533dcf04235d2465863536d8fdd249d583555453836dd3e76df6d6f79a511185b9ef936312d6f25d8d89eb7b58f91

  Score

  1^/10
  behavioral29behavioral30

• • Target

    pack/AwHQZ.exe

  • Size

    160KB

  • MD5

    3564b2127c519a9e39b63f0e6994a3d1

  • SHA1

    158c22dea6eb92f518af7ea947e08521a904e3ad

  • SHA256

    09103f6536c9315c4d1cfa28a4105a2e9bd06f5c432bb62dc5a2b1d0b5902fdd

  • SHA512

    37bdd044469917c500a4d4cfc8b8280207198be956bb208efdac7a74dc3a49b97df237885ece8bf8d3e0c9642156c24285e9ed8fa27adad32adbde6613fc5029

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral31behavioral32