Extracted

Extracted

Extracted

Extracted

• • Target

    993090179a1b4cf5b1e0e14ea3c0efa3fc184c8dc3aa09feb7b7bc54ffd084cc

  • Size

    534KB

  • MD5

    0920b81c7287b3eb06ed4755b7c9faef

  • SHA1

    35d2343493b38698236947f677cdadf8b106fb1d

  • SHA256

    993090179a1b4cf5b1e0e14ea3c0efa3fc184c8dc3aa09feb7b7bc54ffd084cc

  • SHA512

    05029028c2a5babb4873ad76c2c4948195edc1385e2f8008d0bf724a6d79f55455c499d46ad1169b6b9b945d71732476694f66ed0cc66e8479fe2de6f1215bee

  • SSDEEP

    6144:P+4UxvdjNgBoHFIZ0YesFZITJuUQnDYm6u59fV:zQNg2FTJuUQnDYHuvV

  Score

  10^/10

  fabookiegluptebasmokeloaderxmrigup3backdoordiscoverydropperloaderminerspywarestealertrojan

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1