Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    6da198925581418863170f05b832cd1584b923278d0730d779a30ec96513111d.msi

  • Size

    8.5MB

  • MD5

    fbf5d7b4c5f0e86a95b4fcd5c5ccc534

  • SHA1

    51588315ff4ae36412c337361ea65f84810938d8

  • SHA256

    6da198925581418863170f05b832cd1584b923278d0730d779a30ec96513111d

  • SHA512

    3ef2d34071fc10bed59dbe60df3789524f62b89284cc011f1ab0a790196f9010ef6fa41d809947f52668918aa72c90c17211d6be82707b0f8099df548fb40588

  • SSDEEP

    196608:0eS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9OtaQCK0Ex7FVJi0:0dhVs6WXjX9HZ5AQX32WDb0ExZV8

  Score

  10^/10

  darkgatedcratmysticredlinesmokeloaderplexsuperawolfabackdoordiscoveryinfostealermacropersistenceratstealertrojanupx

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Blocklisted process makes network request

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1