Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    e5c4fa967fdecbbe065b0a31e5f4d23d.bin

  • Size

    1.5MB

  • MD5

    d65e1d087b0a5ecd6542606a1b573619

  • SHA1

    29e81405afb91d001938f50e2aae5e698052615d

  • SHA256

    bcabb547936785850133a9e9959a54c30f9bb91b3caac58f40740ff14ae4b6bd

  • SHA512

    d3fff8f2a124427025a96331caed4aaa48966f2d6124ea9ba28754feef48caf3798d64dacfbb19dcd6772987b7737951ba261867c21a85947a9c0dcc0c5ecbd7

  • SSDEEP

    24576:q/2W8gn9ImV8B6S7NOTyctUuh8Z+8TbQT6GTlzuoga+amrHUMr8GQtQvWwnDsDjz:nWyU8B6S02c+XQT6GTl6ogbHUMr/Qtjr

  Score

  1^/10
  behavioral1behavioral2

• • Target

    9a03ba6733f992cbc3485444fdc92aa4281a21ccb20c88c7ad359c14ba06701a.exe

  • Size

    1.5MB

  • MD5

    e5c4fa967fdecbbe065b0a31e5f4d23d

  • SHA1

    46f57ec0e35f5ab49e37a8d4a953d45c9ac8f039

  • SHA256

    9a03ba6733f992cbc3485444fdc92aa4281a21ccb20c88c7ad359c14ba06701a

  • SHA512

    6c32bdfce7b0a55b19e900ba6e611f18e56f1f13a9088a4a0cbb36e4b1482113fa6ec2f030d792245ee700ac202e27a9969778bbd2202b71cb24e8ee22c9987b

  • SSDEEP

    24576:UyJmlwZic895l6HwA1M7+8MYQBgQfFixIXEZyyg2dUtnOBGMJkV/lJATt0Ody:jklwZ5QsdgjQB3f4xIXEZe9nC+L0tHd

  Score

  10^/10

  amadeygluptebaraccoonredlinesectopratsmokeloaderzgrat6a6a005b9aa778f606280c5fa24ae595@ytlogsbotgromekinzapixelnewup3backdoordropperevasioninfostealerloaderpersistenceratstealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect ZGRat V1

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3