Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    67A38378609C0EB8141A74E7BAA052B01FF5734319B4E.exe
  • Size 3.4MB
  • SHA256 67a38378609c0eb8141a74e7baa052b01ff5734319b4e434e556c88fffd596b9
  • MD5 9ded1b5b929a412ccb4e139d76dd315a
  • SHA1 8a8a4a2d76cf03d7f9c9c36af67bc332f047f967
  • SHA512 48eeace4086c3e0f6879b732b12679c2c6e0bd5d8b054c6797f226cea68f1fb04eed9771e20c86b101d2d328e8b967cf224eac7d719b10ede86675e5ba9d5314
  • SSDEEP 98304:JIlDUwddNcYQ3+DWvJx/rzHcYl0bmADANuoixtCTvM4Y:JIlDpQ3HvJ6YubP0N6xt8v4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  fabookienullmixeronlyloggerprivateloaderredlinesmokeloaderanilogsdiller cloud (telegram: @logsdillabot)media13sheaspackv2backdoordropperevasioninfostealerloadermainspywarestealertrojantofseepersistencevmprotect

  • Detect Fabookie payload

  • Detects Smokeloader packer

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • OnlyLogger payload

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2