Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    money generator.dat

  • Size

    6KB

  • MD5

    7487dc64d989f425e6f9423ea010a0cb

  • SHA1

    1589c6f4b75968ccd77d4929272d619cdd22b491

  • SHA256

    482a4cf3eb221445e7d2b45dff43b565d6c203170313f0fad30aa920f61747ad

  • SHA512

    0f83aea200ad6b6a4a268abc793000445202388057afdf76db8d3cf4f9b15f95a13af4edb8d96f12574ca773c626224703293afd6447c84dc172558b7bf305ee

  • SSDEEP

    96:NAuz8uzSluz+U2gJahPiDHrtedYfzJ0pkuw5bzNt:yzdlk2xhPiLRedYtokD9

  Score

  10^/10

  amadeygh0stratlokibotredlinesectopratstormkittysystembcxmrig06.05 youtubecheatlux3mixaevasioninfostealerminerpersistenceransomwareratspywarestealertrojanupxvmprotect

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • XMRig Miner payload

    miner

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2