Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    New Text Document.zip

  • Size

    1KB

  • MD5

    3c8b819becd177edcbab3aaa436f1038

  • SHA1

    191e32ee0095c03ed38fb0cf656830eed585e53d

  • SHA256

    f5091b65f748236c24c4f1d289cfafe78236dfea4768929a1f1fa91b2e5d0779

  • SHA512

    a26c1b88243c14aad3e5d3cbddd63dcdd0ff00b0fa790db592ac89b3207220784cd77e861098448bc158816f8d352c139f7b1569441e4058170797ea3d0f0112

  Score

  10^/10

  amadeydcratformbooknetwirenjratprivateloaderquasarriseprostealcxwormhackedoffice05tb8ibotnetevasioninfostealerloaderpersistenceratspywarestealerthemidatrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detect Xworm Payload

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Formbook payload

    rat

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1