Extracted

Extracted

Extracted

Extracted

• • Target

    00fefd16f15e960eb79785f6b8702747ede96c523d37fd5d5c3ffb3a1a0ba2bb

  • Size

    1.4MB

  • MD5

    6436151cfe4cf195d2371bbf2e8588ea

  • SHA1

    229c3f2fb235a69dbc557b7d3b5641e5ed7b9124

  • SHA256

    00fefd16f15e960eb79785f6b8702747ede96c523d37fd5d5c3ffb3a1a0ba2bb

  • SHA512

    bdeb682cce2989f74640fc55d477371de0721249bd7c8f3a58d9bc9d7b9e61a49ff7e129bee4aed66cd53c3c30a1ee466b9487bf3a59b45c1fdc40b950253659

  • SSDEEP

    24576:LyT3TlHT3TvRNUvekIsjcMGdBFDREcG7WR2Bzy6H4FDG4+HpFY:+fZ3SeDo3GNVE7WR2BH4Vsp

  Score

  10^/10

  gluptebamysticredlinesmokeloaderstealczgrattaigaup3backdoordropperevasioninfostealerloaderpersistenceratstealertrojan

  • Detect Mystic stealer payload

  • Detect ZGRat V1

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1