Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    file

  • Size

    1.4MB

  • MD5

    091f26bedd54809c4dc8c51b83306faf

  • SHA1

    b19d09b14c976edf6260b39152dbb59330d196e6

  • SHA256

    49b6890fb4e62b4d743d96c81db97f018a794c8a383d44438e8b65228da32f69

  • SHA512

    afc6b54ae449187bdecca141e3f0d3e5d4dd518c36def2ae4307d84e68c774670e0cc7f237dedcd899540c1b60731e6df8259d4f0c6d60c275acafb271b41242

  • SSDEEP

    24576:5yAhCYdGHXh8G2Day07FGSiSTFy3dk7ocsspX7zvoGFpIGgb8Z0Zs2Ck0o/K22B6:sAhCTXhJNDF7v+aqsbcsqsBkd/KfB8

  Score

  10^/10

  evasionpersistencetrojanamadeydcrathealerredlinesectopratsmokeloader@ytlogsbotbrehakukishpixelscloudbackdoordropperinfostealerrat

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2