Extracted

Extracted

• • Target

    6dd21975f4cab86ed7af322c38e9825971e13cc0b826e278f56d2e411ad4f6f8.exe

  • Size

    24.4MB

  • MD5

    20d9ace6b4fff715f204ea2cf008e0ee

  • SHA1

    988354b0667c23f749f9ade68b624d0525e95d10

  • SHA256

    6dd21975f4cab86ed7af322c38e9825971e13cc0b826e278f56d2e411ad4f6f8

  • SHA512

    b4930e4e9ddc0d5b163962c3fd70ff782f965154e3f16f275d1b261bf20ee864116c46c4de86df594ce602fc4b004464ab109389958cc646c3e7fc0533e7eb75

  • SSDEEP

    393216:+7sxAlnJLFg3GT6+K7btWp3EqO97hu/m3pDnL8nbVB3Q7MP2sjwCfgM2p:+7xlVFFW+K7cG3GK03A7i2sjvgM2p

  Score

  10^/10

  nanocoreumbralevasionkeyloggerpersistencepyinstallerspywarestealertrojanupx

  • Detect Umbral payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    logz.pyc

  • Size

    43KB

  • MD5

    e8404b29b4fa30815c7588269eba266e

  • SHA1

    38a2bcd9687e1d8585d1d80220f1dc02502131ce

  • SHA256

    f82ca3bffe904933b523c3a2e42866e66847e1636a22ecc12de839a20dfa982a

  • SHA512

    72456fe0714beaf61f8f2f42c0fe509cef16b03b4cb81719c30f7e766d5312510ca9594e2b3984642f64b62a5b24d59f593e0baec5cf79375ab6c942fdb155e6

  • SSDEEP

    768:moP7h/z2Q4JESUP/8L541CnVWhc6ceJ+wu0wkWtiPucunDLkgMQFkgLdXNzINMU:ms7h/z2oF8VSCV0cL6Ru07WQfunnRug0

  Score

  3^/10
  behavioral3behavioral4