Extracted

Extracted

Extracted

• • Target

    1028ef3a27697fb876502a988827cdbd0078368b553e3c7841433489cc6de109

  • Size

    227KB

  • MD5

    fc521f8f574f7a7e307745fe8301cb3e

  • SHA1

    0a5d4db4431db5c1dffe0d00b1d32827ebf4d778

  • SHA256

    1028ef3a27697fb876502a988827cdbd0078368b553e3c7841433489cc6de109

  • SHA512

    4807730b46d1064ea414d270982c5214a645d0d83946928ec5f85a5d699995a9e1249a504437dae82a50ef08aa89617a37fbc29e5ec94b1bec6a6c0e0285d17a

  • SSDEEP

    3072:Hi9zUcm5uLD1PWoLGPpH20UvrXj7h72EAy2GRl9WvZbBAjfltVy:ym5uLAoLGPjUvrXolNKcC/

  Score

  10^/10

  djvulaplaspandastealerrhadamanthyssmokeloadervidar19agilenetbackdoorclippercollectiondiscoveryevasionpersistenceransomwarespywarestealerthemidatrojanvmprotect

  • Detect rhadamanthys stealer shellcode

  • Detected Djvu ransomware

  • Detects Smokeloader packer

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Panda Stealer payload

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1