Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    Setup Virus.zip

  • Size

    5.6MB

  • MD5

    f28c248eee341079a3b8b1d6b3c6d69f

  • SHA1

    b38bc018c9b1271c7fd1b080e4fc9e21280f0796

  • SHA256

    c736b51d529275f2d913f67ae5c5658bea675f2c5e8f3e20cc115e0500bc06cc

  • SHA512

    53549aca5ba9579e3805ae2374a0a4988ad7b80b071672f07c92bd4fd88ed7dff709b94857caca2a5e7e6c95d29cda4ea70d48101427ac80cdab876def889549

  • SSDEEP

    98304:jQrBbfoRhB9PNDGgr5TrD98alGby1bPkNrYYG+tuttQlv4q3fIvf2FEHaB2GYyMK:jQrtgRL9ZGm558wG+dctw2N4qyWEHaca

  Score

  10^/10

  gcleanerlgoogloadersmokeloadersocelarsvidar915pub3aspackv2backdoordownloaderloaderspywarestealertrojan

  • Detects LgoogLoader payload

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Blocklisted process makes network request

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3