Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    New Text Document.exe.zip

  • Size

    1KB

  • MD5

    0206983f12db26f622bbe73b165f126f

  • SHA1

    e71f9fc602245a337f728e27917b0b716d3828f9

  • SHA256

    6b81b36622febc198dbe4596349b7b781cd6b278e9db9145a2de8b14b045e128

  • SHA512

    296372c60204ead1709a556001fd2a932e98814d30b42771beb19cc1298f92f3823372a83c1752f49f8073ea238e60f4c5e270a85b6dba2821621e68fd6f5cfc

  Score

  10^/10

  agentteslaformbookloaderbotlokibotprivateloaderredlinesmokeloaderzgratpub14hc5backdoorevasioninfostealerkeyloggerloaderminerratspywarestealertrojanupxvmprotect

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Formbook payload

    rat

  • LoaderBot executable

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1