Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    225KB

  • MD5

    bfc55c93babb2fdbe8e1679f713f1d04

  • SHA1

    c18f51842c2dd332096c758f47782be0389f278e

  • SHA256

    c26d93b2dc38db64e470819c16d1432046989f1e6fd4cdadfe319536333d7195

  • SHA512

    16963a63d50fc91e01c420b4f013963830e38bd588db98f92dd548f235b70c8e02909a50b9984bec34549fd547c517aa255b7ba4d7772e068d31ff7300a1e7ed

  • SSDEEP

    6144:nPiYHdpZG06NqGskIbTju+dRr6sMRR7T:nn9pZGb5skYdt6sGRv

  Score

  10^/10

  djvugluptebaredlinesmokeloaderlogsdiller cloud (tg: @logsdillabot)up3backdoorcollectiondiscoverydropperinfostealerloaderransomwaretrojanxmrigevasionminerspyware

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2