Extracted

Extracted

• • Target

    00C0934AF824603BEF01CE8A5D9FCBD0E97432C877D40.exe

  • Size

    2.5MB

  • MD5

    7456a042d330c293f618181c1c52ee59

  • SHA1

    27d8b878fb07d7a3f23955cfad710c702a4acc3e

  • SHA256

    00c0934af824603bef01ce8a5d9fcbd0e97432c877d40cade42fdffdfb5175e0

  • SHA512

    62ad1abd683b1278a6d665f89c9fa9cffb02641b624c2716f7dea5de320405eb59e0fb1e301e228bb58d9202c8e32f89acd217a18850b6921148cf777bb7a101

  • SSDEEP

    49152:EghS3ALwLVtkYDnz+ZSPIa1QVtpnjCzSeyBOLnY9y8/OMm9vqw:JhS2qVtkYDuHLjCnGOT4yiOMm9f

  Score

  10^/10

  privateloadersmokeloadervidar933aspackv2backdoorloaderstealertrojanredlineytstealernam6.2evasioninfostealerminerpersistenceupx

  • Detects Smokeloader packer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Detectes Phoenix Miner Payload

    miner

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2