Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    sus.zip

  • Size

    1KB

  • MD5

    f8554227ffb4b19c58f38c459d8929cf

  • SHA1

    684a2014816c1c20582e97ab69064f3d4348ba7e

  • SHA256

    85c3c3e707c2567bca0e211c6ea81a11e6207ecdc51f49cfd21ebffe8bd503e7

  • SHA512

    1ce8e237f7c6f2356554ca13dfaa16ec99baa0b3e12a7b17061f00409c28ba91494ffd9a37123a8d5dd0c913a54d689a7dd9915cc8f971264ea148d307bf15a5

  Score

  10^/10

  gh0stratredlinesectopratsystembcxworm06.05 youtubecheatmixaevasioninfostealerpersistenceransomwarerattrojanupx

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1