Extracted

Extracted

Extracted

Extracted

• • Target

    Driver Easy Pro Crack.exe

  • Size

    2.0MB

  • MD5

    324db70fad161852fb9a12b202b6c8ad

  • SHA1

    59dc865fdb633a2febe6a0fa763b3ecaf7b9ff87

  • SHA256

    696c1b503eda75df91c227a8dcf5eb434f0c5463377be527119cb094f1f13d5a

  • SHA512

    03e90eb31c92db811f557b8af4c1f405e8f317407bd0e3b3b48e7482d2f541908dcfa929886f5124362c861ee3a2fffc0615b585c56cfe93a02ebfc007905188

  • SSDEEP

    49152:dJ4gqdPiqPHnCD10qnMFA9vDDovbp6PArwj:dJ4zbPHQ0yMG/srrwj

  Score

  10^/10

  gcleanerpseudomanuscryptraccoonredline81620d6b0f6e4fbb3048818577e1f9beustest3infostealerloaderstealer

  • Detects PseudoManuscrypt payload

    loader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    loaderpseudomanuscrypt

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1