Extracted

Extracted

• • Target
    1b50cba6deab60060d6b0dbfbab22099.exe
  • Size 8.2MB
  • SHA256 f63dc116cf6f2bf6c2f33898d73ef0b974ed3fa9de67d840b50b35ee2d9390d9
  • MD5 1b50cba6deab60060d6b0dbfbab22099
  • SHA1 17f2df3d06db612f7e8dcf4e42dc6876608e7baf
  • SHA512 68b520dfc2ea34742a2a2b1f452f27f979fed71a4abf89f34568a5d591c578114cb5a810c41d9a506d25e71740fa8ae4d04f65e4558da5d943242790ede2e436
  • SSDEEP 196608:PTytGdCltt8ri4VK3jIwIFBk5qNUmwE6AgfPpZfvJU+eEgvlym+a/RdqiSZ:77C1gK3j22BmwPPzJ5eEQlyYoZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socelarsevasionspywarestealertrojanvmprotectgluptebadiscoverydropperloaderpersistence

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2