Overview
overview
10Static
static
101.exe
windows10-2004-x64
31221.exe
windows10-2004-x64
16b282d34fv2.exe
windows10-2004-x64
1B000CEF.exe
windows10-2004-x64
1Builder.exe
windows10-2004-x64
1POVOFJYqCo...Iu.exe
windows10-2004-x64
10Terracotta.exe
windows10-2004-x64
1TerracottaGUI.exe
windows10-2004-x64
1Zver.exe
windows10-2004-x64
3a.exe
windows10-2004-x64
10amdcontroller.exe
windows10-2004-x64
10bg.exe
windows10-2004-x64
10bin.exe
windows10-2004-x64
10bin2.exe
windows10-2004-x64
7ej.exe
windows10-2004-x64
1fban4.exe
windows10-2004-x64
1glash.exe
windows10-2004-x64
1johngotovo (2).exe
windows10-2004-x64
10johngotovo...al.exe
windows10-2004-x64
10ktg.exe
windows10-2004-x64
1otIXAOPqOV...LX.exe
windows10-2004-x64
3scvsots.exe
windows10-2004-x64
10setup.exe
windows10-2004-x64
10shit.exe
windows10-2004-x64
10ss.exe
windows10-2004-x64
10stealedd517v2.exe
windows10-2004-x64
1steel.exe
windows10-2004-x64
1ted.exe
windows10-2004-x64
1update_b.exe
windows10-2004-x64
1update_z.exe
windows10-2004-x64
1uyo.exe
windows10-2004-x64
1v72d8z2.exe
windows10-2004-x64
1General
-
Target
URLhaus.rar
-
Size
23.8MB
-
Sample
231209-zshf2sadhl
-
MD5
be69fd1c468ef26067d7d22388e26728
-
SHA1
694f87484f5b5c816fc54d796695506ae237bdb8
-
SHA256
477cb83fd991d5267507f61b98b7f7523a2ae79bcb1f2e52a71d9daa20b0b93e
-
SHA512
718bf21546f5e9674d18ac7f3bd54d0c1f0ad61e87fbd81bc32f139fe1a08147581840a4d6383e5a335de017fafb66b7f2eda32c01a3f1a5a0474dec8fbdfba8
-
SSDEEP
393216:5HW6ZoE6wc2WPVHdoz07MHQ2q+SWJUlp/DBD3WnDrzbI6GnTaIE0AGyYSgXiBx7V:JW86wDIVH80Mw2q+SmUlpNszM6afAGyr
Behavioral task
behavioral1
Sample
1.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral2
Sample
1221.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
6b282d34fv2.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral4
Sample
B000CEF.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral5
Sample
Builder.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral6
Sample
POVOFJYqCoZfOoPkWOsSBcVYWIu.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
Terracotta.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral8
Sample
TerracottaGUI.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral9
Sample
Zver.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral10
Sample
a.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
amdcontroller.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral12
Sample
bg.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral13
Sample
bin.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral14
Sample
bin2.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral15
Sample
ej.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral16
Sample
fban4.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral17
Sample
glash.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral18
Sample
johngotovo (2).exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral19
Sample
johngotovo (2)_original_original.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral20
Sample
ktg.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral21
Sample
otIXAOPqOVgvIKePlwFQLX.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral22
Sample
scvsots.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral23
Sample
setup.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral24
Sample
shit.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral25
Sample
ss.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral26
Sample
stealedd517v2.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral27
Sample
steel.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral28
Sample
ted.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral29
Sample
update_b.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral30
Sample
update_z.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral31
Sample
uyo.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral32
Sample
v72d8z2.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
pony
http�--kek.b4mb4m.ru/gate.php
http://b4mb4m.ru/kek/
http://jo-blanc-fils.com/vsop/panelnew/gate.php
-
payload_url
http://185.222.202.114/uploads/uploads/update_z.exe
Extracted
formbook
3.8
da
chainwalkchambers.com
foxyhaul.com
yetisnackdesigns.com
paleodiettips.xyz
51zxsf.com
jisulianxiufu.com
qianbianyun.com
unitedresponders.info
contentlab.video
traveloyunnan.com
tonybehrenslaw.com
adithyafuels.com
huanayule.net
conscious-cross.com
link2register.com
anchoritis.com
vicente20.com
jnmbc.info
m-1944.com
naap-tol.com
cakedupweed.com
banhxeyhoc.com
gci-explorer.com
pinsentmasonsbda.com
walt-app.com
mingkanhui.com
mygeniekart.com
stawarrior.com
meneldur.win
324sdaf.com
flatlinepublications.com
bcgdigitalmarketing.com
kissantrees.com
annotader.com
agvstl.men
pnzqn.com
helpfixsf.city
kumawatart.com
pharmersbrand.net
iphone-10.support
hiworld.biz
zimbersale.com
ghostsspread.com
jevington-forensicsolutions.com
loubilab.com
barriosdemdeo.com
abenchbythewindow.com
goingthroughitaly.com
hewlettpackardsavings.com
chinatupian.com
silverudio.net
r4hubynw9bc.biz
saiyo-jecc-net.com
meiwasns.com
propelev8.com
duke4u.com
mashahir-elearning.com
aliinfluencer.com
ukano-ryu.com
aichankang.com
pddcall.com
askvest.com
mbclighthouse.com
xezu.ltd
solabentvx.com
Extracted
remcos
2.0.5 Pro
RemoteHost
194.68.59.44:9074
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-D19I5H
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
azorult
http://i42325.hostru2.fornex.org/index.php
Targets
-
-
Target
1.exe
-
Size
582KB
-
MD5
5bbe49ada7ef535b87bd1e3c3d2b42c3
-
SHA1
1e94057198bdf893683d30591601aa88f51eed49
-
SHA256
7be2a5923ba5e4acb9f1e5eee42c04b2b6620c82efe013e751415a495590895d
-
SHA512
f859b1efc80ddcfe3f54aae4ebb4a3f4612a8a4b1ecd0b965f1e65f8decf8018999ce48e32a71515f78bc223c24815aa8bd645b517947d65227e083d0ff9c45d
-
SSDEEP
12288:S1lqDbsmSxn3Iv9XyePFQkLkRvJSA5V40mjz5Auz6r0Sn:i4Db7Sxn3IvrRgRRSwL4tz6rd
Score3/10 -
-
-
Target
1221.exe
-
Size
789KB
-
MD5
10dec51d466fde5077a06dbbedcbfad7
-
SHA1
a667d6c1aca853f5eda2763fc982a0ecc6d801db
-
SHA256
da0d1f2e79659c06cb55a3d6b11f9e3ae9af3ce7de9df26049ff9a8e78ec4e29
-
SHA512
79a1883e71afdc251f344047a830a3bbb71321dd8a5d1f9989a56b425b85887195669abe33e426d18eca3f6f7cff0f9aa44c666b437b116bcfd58cad610d31da
-
SSDEEP
12288:keSNcgbb1Ku4XYxqSSFFYrh1Zxn7FrY4f38S33ueK4gZfj7J:kVXqYQKLZp9F339RgZ7F
Score1/10 -
-
-
Target
6b282d34fv2.exe
-
Size
1.1MB
-
MD5
f7f866371543363a694b8a6f0c5e2c13
-
SHA1
89bd0d071b273bd1cffc2e4d2871f7063973447f
-
SHA256
c0242d686b4c1707f9db2eb5afdd306507ceb5637d72662dff56c439330dbdf1
-
SHA512
8b253b1910a66425cd920dd04d39ab1732a72b05ff20675ac8d95b66d9916c338c1df0e4b79fedfd9b917f2a38b5551c8e46d28a68275752cc38700c2ecc36dd
-
SSDEEP
24576:3r+0fmbAVqW6sLh8c+Uf2TltunOyBHzbmnfIdNG:3ebkqjs2zNhylzbmfONG
Score1/10 -
-
-
Target
B000CEF.exe
-
Size
936KB
-
MD5
d245c27f94d51b95436b5f778d46ef54
-
SHA1
3e52447eda7da0afd4ae2c0bf1a23d3120d8a794
-
SHA256
0a13fbebefbb460de7565dfc7fd6b86674daecd42cfed4626ddcfe303d2b9670
-
SHA512
e3700b192266387ce5b4c9b34c77300e812f76eb87f15fc7dd2f9e59b73bb14d0dc65d3d8937f55a786b16b75d4beffdeb5c038f7e69e402e21d85e3bc2193fa
-
SSDEEP
12288:bEVDDja8h6jIV1Pe71bw6tZxp8v1sy24wljM1a4NOthR+bFCAtW36r:QI8QY1Pe71bw67A1sKsDth4jWg
Score1/10 -
-
-
Target
Builder.exe
-
Size
1.9MB
-
MD5
01495ba46244aece2b35872ad90f5773
-
SHA1
ff97a566190da9de5405fc457d451c4754ad47a5
-
SHA256
85d88e38495bc011bcaabfd5dd65a8c213b6422ed90001f4002353e59c6edd4a
-
SHA512
54964ef4ad08868afd46b3ed2d827a6eee9cce9aac2087663b861aa27cb1425061c2f648872eeb3a0abe31ac49aa394c37fa2332622ef6a7d4bf07fc69fccaff
-
SSDEEP
49152:aHtlwlZ4xcB1fj7tyHCcG0GGusAwKrohEgdY77IuBIsUg9ijgQO1PMDozYAPz2U:Ey1fj7tyHCcG0GGusAwKrohEgdY77IuQ
Score1/10 -
-
-
Target
POVOFJYqCoZfOoPkWOsSBcVYWIu.exe
-
Size
309KB
-
MD5
c88aedd2caf71b00d90cd1e4e93d97e4
-
SHA1
edf4f0c5cc90df955e92f2b53891904bb6597fde
-
SHA256
0530e8413c58d9e61e84278d6fa2ef0f00184d7ac95786fed515178b23b41502
-
SHA512
57dbb9c26da19d809ae1277a02f76f76db860cc34cccba253ad4a5b8859846e681f5b27318f6e8dba3397c6621e59f82c1853cdfabdf36542f71b2e1c18cbfd7
-
SSDEEP
6144:wObsZ6HLhmV0rVCRzRTr8p/cGPO0oqQrjNcxf3RfUVKWMK:waWc2RT4w0nSjNsfJUYWT
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext
-
-
-
Target
Terracotta.exe
-
Size
2.1MB
-
MD5
e2b3163f5c60dfeb9e46b2887ab911e5
-
SHA1
85b3c6b5421922edda88d674d361a468b015b90f
-
SHA256
03c9b3b5c689fd393784ef484a6c8498fa447d34d0dd207f2d5c30065459b113
-
SHA512
12282d05781329f0a55aebf6f2fd822c9eba056a90e14d438dfd1e6d8791c366682bfcd50d791c0405968bc613663058e863fc3e60fea30ea22b389c8e546401
-
SSDEEP
24576:68DzzrOzftPpnLrR/P5bJcNSkaiM11io8eRuxhmkOmkSkkzwxBkkzwxYkkzwxLEh:6GrOzftL5WIsmkOmk98AwVRsX7b
Score1/10 -
-
-
Target
TerracottaGUI.exe
-
Size
8.7MB
-
MD5
033241bbad592ac7a65d38e97e486754
-
SHA1
e62a800845838ffa8702d79a1d6fac607b256309
-
SHA256
9f169846a0a4a51838f0a804b3b1cd8d8dd2b0ac574e6ee08356a649a7393d70
-
SHA512
a479529d937052b6597e83f67169c5750d323c4d63e1342a855dba5affa3e404c875de384b9c287eb529990a9cd93782363b65a47e1a2af25454a5d56593fceb
-
SSDEEP
196608:AWEEioqrBnBjD5FaalnJodfBUfj5kM8h:AWdioq5FxlnvOh
Score1/10 -
-
-
Target
Zver.exe
-
Size
587KB
-
MD5
fbc7e2ab249193e054efd4fccd18bc53
-
SHA1
4ff3c8466bb95053ebb448d9aa700d5edbf0c0c9
-
SHA256
ec4ea4cf8c0583898bfafe4994c822f4f2848e996431c1847d9acac0d30c8a63
-
SHA512
fa2f43fc5cd06f2d492ece30142a91d821e6827b17e5b9d1077a8eeff097533deecc79ae3119f2db2f14ab3ee3f034fcce5d096515e71f555b3e05001056bacc
-
SSDEEP
12288:Z+v9e7pXF7UERD7jCYp66lpzLDzAy0NQLvDh/i69wP:C9e3PmalpzLPeQ3hEP
Score3/10 -
-
-
Target
a.exe
-
Size
257KB
-
MD5
c6b0de7a393d112604142cdca1605f4a
-
SHA1
db3f8ae80a2257cf00b8ff421f55753acc1a5081
-
SHA256
f40f50cc3f6b7ed49501fb4266672d0a8da960e28dc0912688ad0c8d7fb2c1d3
-
SHA512
83032a2336f0c8b858eddeb9fb940255c5f97469a533de0fd771ff6616d8b3e6bd46e9cc4e1fa30788f1105fba204e8f29f9c9c8f82ef84264904494a839f362
-
SSDEEP
6144:AHJyyLOaBG2TBf1EYxk8T5t7P5qbGVNqbU7U:AHUlhC/xk8ltFqbYNMU7U
Score10/10-
Suspicious use of SetThreadContext
-
-
-
Target
amdcontroller.exe
-
Size
90KB
-
MD5
6b645fbf570f4d09f059d8fed734fa3e
-
SHA1
83f12011bfaa99ac994fa5b9003ff4a7123d4f14
-
SHA256
2573b356452dd5ee24c10537fa4848d882fa40a2a8fa5a181624ba460e1f769a
-
SHA512
ec428673fa3c881de143689b679fcc190897068a7cbee509c8ff6eaa0792ec8951c5b6b620de2c116cccfc3954ed71c142eb19397dcca5a6198f1e7b5d7a45ac
-
SSDEEP
1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIqkzmt2l:2SnMuGc/CfZDap6COU45EIStm
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
bg.exe
-
Size
688KB
-
MD5
054b2bae2fde2432570c1e201915d5c2
-
SHA1
f6ff9c425953a09c43952b7e50287eb9b2962e69
-
SHA256
aa7d7ea346331c9c6967d59a073ee7ae81d11613680f28dee831ca9fbf1fe7fb
-
SHA512
a62a9301a53504284a0d3596429c16887ba95809e28753df86d5cc9a57c5a2fcbe91dd83748678408f4406214b3ab7395b449755c92173577f6f7d588d30a904
-
SSDEEP
12288:QoPCLS7hVU4xHribMZXK7RfXpqHRcSD5RyyBEAge1sMKB/VdmRxuweSG0:Qo02bhKZpqyuUo8/k1eSx
-
Detect ZGRat V1
-
-
-
Target
bin.exe
-
Size
167KB
-
MD5
efb72c1ec0608a79de8bd3ee79c0bad2
-
SHA1
b7ca0fde5e0b4e86d5f7f66defd9c20fbbd2ba23
-
SHA256
a78a59d1d3598c29e0bfba14bb0ca09a2263f7e60af88cd09a85ee39272bcf79
-
SHA512
31e720486a325d89e7f80193b9ed37298c50a9cc1dc34d112c8c6ec6e421590fac4284daa98c49f91ac5b3b6b3bec230d58e1f58f0fa9f47ba150f724365198b
-
SSDEEP
3072:16VXCc3/7KNo2ymzGLo3Kh4zVVBYDPhSkrKjQSKT55oGUFCy:Mj/03zG86KzVVBYDJSAK0T4GUb
-
Formbook payload
-
Adds policy Run key to start application
-
Suspicious use of SetThreadContext
-
-
-
Target
bin2.exe
-
Size
565KB
-
MD5
66a777ef1448979e315f5be959a20a67
-
SHA1
d1b4fb00df2f5d48498a6001007ebf5f91841394
-
SHA256
eec2437b0d9853f2416a800826692e9d74d052ba346465b0541a563c7adb8082
-
SHA512
9adc10f59f6527da9c4ef015827305e0490b3ff0d261ed0c0e029209c28e00f21321552292004e295857e1ac5a511130e9572b84c7a1f85034ef0dde9386f723
-
SSDEEP
12288:2JdJIY6hz+4ewbrOiroANc1nRDWVSpR8dIC/TSTA6YIild+2+XbivoqSlxVJb2:s/Ifz5eavrouynRDWkpOdIC/TSc6YtlV
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
-
-
Target
ej.exe
-
Size
472KB
-
MD5
0948d25e80d3fe36133ea70394d16c93
-
SHA1
b1d9c2f690fb5820055439d9f4a0a2e858621b03
-
SHA256
9c2c89920c9d9d94674149fb789e2cf78cb9e20c451658d63b95cfd77c58a1d5
-
SHA512
538a25805e24f39d122d06a9f877b0116941bc668f21f5c0306a7c8f96e112b98b2ecaa1d8dc8f9ad39fbffe49c4b909407152ac21e78dfd926f00ae9460b772
-
SSDEEP
6144:GCmB8MwX6rWu5dIybQNcpYB1UukBvWxNMfuGe3wRpZSvANzC+3A0RvdtDsAyFRqo:c6X6rId+uEKNOk3EWvczC+Lv9UR4
Score1/10 -
-
-
Target
fban4.exe
-
Size
796KB
-
MD5
7c813b54d429d4b71aca35778bca6d5c
-
SHA1
2dc6d1caab9825998bb735c7fdfef0ba4623a436
-
SHA256
5ceac115340684b175646a247d2eacdefaa695b040985fcf4de3fa19aa15c106
-
SHA512
bd391be9e4ff65e175daec2fbbeae06436f48fded823589f6f64a7cd5ab3a5079909c21f0cb7281b0ce1bca2554670810fb5d900a98a09f1694b00a989386fdc
-
SSDEEP
12288:FYX//nvg7tc+q6y6yLqskH1OjjgUeZ537r3vxFxAqzeJ0im:KPPvE6Z6y6QqskH1Ofgd5rr3vxFxAqz
Score1/10 -
-
-
Target
glash.exe
-
Size
539KB
-
MD5
2f23fd48041dd847519304db897ffbc7
-
SHA1
bd863c5559aeaca2f4179357fb73d54de0215c00
-
SHA256
2fefb8dce78610a357a3c6f37a85da2cbb0940201d7bcd4e2052c4d8bacb6756
-
SHA512
77742f770459d6c70716293227816f2b1ef853d559929e9bfb5ad75cbbb264b95688fc198085cffe4653a237541f18ad989813d9a1cdbb8b51497032d1311ddb
-
SSDEEP
12288:Vs+V1qGTOehWmXcO+7kHsCOhqXcftt3NYqhWKFmy4JI5UNkz2h:V3fPh0Vv3Ey4JXh
Score1/10 -
-
-
Target
johngotovo (2).exe
-
Size
2.6MB
-
MD5
65b91f22c0d3b69a245c374ebdb6d041
-
SHA1
88a51a6128202ee53e2f0ebcc3a6ff33dea9c3fc
-
SHA256
d0f6ed2e665841e4655437c0e83ab5b8ab9d83c4c8ca5367a6f6a7afca204d3e
-
SHA512
8eff45e564ad90755fe1d1b1348e5b184afe109612403461d46a65a90398beb20f3d404e24c3f900841e108b6a85d22bdb7cadd4db71245f3e91d9f76c95c979
-
SSDEEP
49152:pcNRa+mO3X9Qp7ZysBDVPdiw8fM96HOOP2qxuqGSJ+1lInYq6rpyxyD5nrnVvXzD:pcSg967ZHrxV96HV/fGS0IpIDtJXzdSe
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
-
-
Target
johngotovo (2)_original_original.exe
-
Size
2.6MB
-
MD5
7cc005bf1923f56d495fd9de362f4f0e
-
SHA1
ee9ee7221a40c86f35437bf70372a638494e01d5
-
SHA256
c0a6c5b64a00af256ea44c2390f4b533cb7a972ea039152ab9e81fef0df2670a
-
SHA512
6a5dad75958d0fae6b0e4ccf41268187bbe3805fb27c9808a9198b310963df8f1956f9acc394923c312e7b17bf133bc4ebeb10374467ed5d99ef2b2485a37a11
-
SSDEEP
49152:KcNRa+mO3X9Qp7ZysBDVPdiw8fM96HOOP2qxuqGSJ+1lInYq6rpyxyD5nrnVvXzD:KcSg967ZHrxV96HV/fGS0IpIDtJXzdSe
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
-
-
Target
ktg.exe
-
Size
546KB
-
MD5
6774fe92ccdefa34e2f743a885b5a887
-
SHA1
3282f100f3596f423f92b361f66e0726ef6f5a0f
-
SHA256
de7f5c83f3f931c93e57e21eb4811e826d81f8470c54bd3da88043bbaf3bcfba
-
SHA512
f0b7503e387d1000c84567776df354e707a0ebe023cf53e9b0e510caec759ffd8bd1f11f55c5e2df9bc745006d517323afd72efad266a14dd4b93d461d13efc7
-
SSDEEP
12288:7AeENnsFMbHKlNaNiBN3yJOZLvlsj8lsgGwfQ:sBGZNf7GO5vOj6I
Score1/10 -
-
-
Target
otIXAOPqOVgvIKePlwFQLX.exe
-
Size
543KB
-
MD5
db3c474b698889e9f1f05de6dedae185
-
SHA1
78b7e6ca6c4e23080a4d28c287646690c24c3026
-
SHA256
9ba71bc46a160ca3334e8866bab9fc438e671c0f18897aaa08a3dc815281aab5
-
SHA512
c5a1c8531bbb26f0105e6b49d8b7a223783ab7d97c8f4a33989094d96753446bb7c5bc41c6048f0a74d60fde4338de68ddd3d8601cab928531f8059693df2dd1
-
SSDEEP
12288:2Z6nZpubQrDwJ2RPl/Ctpv9QUb43a8gCtSWoCO5qqp:hZpBwJE5CtHQUs3NjoRqq
Score3/10 -
-
-
Target
scvsots.exe
-
Size
2.1MB
-
MD5
fd409d4d20e580215c1ec0803eed9725
-
SHA1
02f9cf94ed6ab9e780755215857c9ba0a3e25065
-
SHA256
483b9102b4ad847f5e96aa478792a613d2a51ef605c8224afe0a369d09a75e79
-
SHA512
253c22cf2895865c407055900617298a71ac9529769561fd0e0f7d373e0461b77db2b6b5b37d383560eca56b833b3e704130b5ade3f09569f369d3850e03fa38
-
SSDEEP
49152:Sq6zl3M9b5H5RB4jyVzsb0cUgq0EtlR3vOtNhHduFYq4sTm:Sq6zMrSyNsb0fP0yitNh5qNS
Score10/10-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
Sets file execution options in registry
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Creates a Windows Service
-
Drops file in System32 directory
-
-
-
Target
setup.exe
-
Size
307KB
-
MD5
a82ad2c37738e8e34cdee6291414e52d
-
SHA1
cff18164a33be214c39b3911675f600de323decc
-
SHA256
ecb9bf008aefc4aebaff02e66aa5d8c518519ac806cf63a44099594cfe9ac1aa
-
SHA512
5551deeff969e4c9864ee13ee9a20f3d1142e8e429a5e5e6c6afc3d160b58538825324ac5564536ca3c74a98d08a2b8f7689feb8f63ef41ad89da51ce1db0fdc
-
SSDEEP
6144:ijJ2Iv1y8mtC/6iCCJQ8ns+NomZLsqyNS0A9gDMuid1WO+Hd3FQFV:ijJnriiCH2hZLsDNSDgIdETd3yFV
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext
-
-
-
Target
shit.exe
-
Size
90KB
-
MD5
86c20760edac3503e9cbffb18e9c0ffd
-
SHA1
e97eb0b6e8489002189f074efdaf44896ba1b175
-
SHA256
eaf3a35a01a43d0be584a1418126e1203836f874b7c9517ebceada3068b6b62c
-
SHA512
b40d2db4443ac625337ef67f4cc0e3efcf4f3d4fc178b5054d0f3fad426f078ed673c0fb2317844c79b2d3c6a56ce4d9ca20e2493582548077487d4221626188
-
SSDEEP
1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIckzmt2l:2SnMuGc/CfZDap6COU45EIwtm
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
ss.exe
-
Size
556KB
-
MD5
e6b6af3fa3af6e9f4ae44fce90988389
-
SHA1
bd325fdf83d8c2d37f04163a07d3ec8eea58bba9
-
SHA256
b2050e70dd2d045b445e372f31e83215291e2128b95461498c91de7d6f82e3af
-
SHA512
88a68cfac89f56a8f9c680de1de47c51125e7dc266592978a39dd145aec190b33d5d5cf5b437162235351c1cb4a1909d8a1d47fc65d372615a9ed898f3675558
-
SSDEEP
6144:xIoSRgtpfD2ywM9r6o/AT59zMXd509EdXYH0U5p4:xwCfD2A9mS859YXdKgn3
Score10/10-
Drops startup file
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
-
-
Target
stealedd517v2.exe
-
Size
1.1MB
-
MD5
32d9482543716162241e4f946254d82f
-
SHA1
e7b5023d456416954568a32b7d7cfb53e02dbff9
-
SHA256
b108dfc054ceb8781ce8e0fd83534ee20b6807328c561ca47c8051af3dbcb5e8
-
SHA512
2e208e1a498f4387534be14f2f5db6e81423f52875379dac8956383626be433d7061449d0b2b4c184319f3fb5b3861b5f7cd9cbf28d95308f11b50e69588e75e
-
SSDEEP
24576:6r+0fmbAVqW6sLh8JD3TAONQzJ1lPXfDMWxvb:6ebkqjs2JD3TJNoJ1lZD
Score1/10 -
-
-
Target
steel.exe
-
Size
636KB
-
MD5
caeec65dafcee7d8af5bd3abbbbad3e3
-
SHA1
ba0d35e7a3fdab8d08da142847fc6c760c54e94a
-
SHA256
0a2dcea9507eae4d7d2f76ba2aaf1199b29355c675bfae6915bd148b9075e64d
-
SHA512
59e4080e653eb7fbd0ae73f46c1022f55057f04f77f90a235a5e0a176672e921e3311f6490a9cc39c4ad957fdc5e4e915206fe08cd27b3ec8db314abe6a7b1f2
-
SSDEEP
12288:aDx8D922G89w35bW1yJQlCFVjI/MXMjVil/NAh5k/g:IiDzH9sKEOlk3XCVG1AXh
Score1/10 -
-
-
Target
ted.exe
-
Size
496KB
-
MD5
9699ff0cbc3936fbc5b223db9c442b04
-
SHA1
6aca03cfda845015eb0026180b6e276e88e0c4ef
-
SHA256
63830225bc72ebde208448beb37f155e9d4e5c360b0e78185af21f348e651cea
-
SHA512
33db8a94e76cbd8b60e43630440ff16860244d55db533a5b5152c62b07f77198859e9e1a6737bff274cf4d675ba76782da0f5d1daf1100521e2fba5d655b94de
-
SSDEEP
12288:aHqClQkf4WNWL821Jmecs00yznXjNdwFEoBxB7TKL7GoWny3Sv7n5lm/JfhSac:aH32U
Score1/10 -
-
-
Target
update_b.exe
-
Size
487KB
-
MD5
1926f559ba4d0a13824a3ac46e664e3d
-
SHA1
d2d6ba1086ff6cf688f666ae0a2cafb9b32b6d5e
-
SHA256
cf5ce1c3f405a009c4a0302a50693b91f956592ec05a088085ad974097ccae88
-
SHA512
1402cf7e8c18cbf6735b23f643139c46c40492c53af8caa4cc5c4bc9cec56a0ec6079e04eed17e4cb617153dce736d1c07848f292a881964a4ac3b19779681ed
-
SSDEEP
12288:N/uViGHpxQlwx8971kFa32D5nVSyYuG0s:4koxQ9XkFuyzDs
Score1/10 -
-
-
Target
update_z.exe
-
Size
486KB
-
MD5
bf340b3ff326cede17c688bc4092a27b
-
SHA1
a6d924bc3dad2877866477e0bb5052e09f11c81f
-
SHA256
7682b842ed75b69e23c5deecf05a45ee79c723d98cfb6746380d748145bfc1af
-
SHA512
0594940822e46b333f8a68443e98b66b05952d10b8f5d389beeb10bf886d1f4bc1026792c3f6fedfbab8d9595533ceab434c061a2393901de5ecba638286e1e3
-
SSDEEP
12288:w/uViGHpxQlwx8971kFa32D5nVSyYuAD/h:NkoxQ9XkFuyzK/h
Score1/10 -
-
-
Target
uyo.exe
-
Size
549KB
-
MD5
9d7e53149f9c3eab69c018e4d11819e0
-
SHA1
8eca9fbe38159b764ec261231d3b0d27be97ed57
-
SHA256
50be7992dce8548caa56a6935e2ede24b1025638f2cd17a992222f03f584a0ed
-
SHA512
df5a3804eda1e4a5b997f50a81e9af127d8f33b8c11734c84fe812aa135e74b8b51418e3c9dab5714d6960ef3089cde387d3611cd36c3c2bfc851ddf225034af
-
SSDEEP
12288:aLgbTG0Y6fh8vUrsJPyGHZ3f+Q6Js93Pjsx1zvJs/U8t1:+2KMyUKy4GQ6JO37g1ST
Score1/10 -
-
-
Target
v72d8z2.exe
-
Size
1.1MB
-
MD5
1acd17efb3edd04e02b84b7eeca8eb95
-
SHA1
39f3c8c574bfd33a2f8f39c1d53a57f48ed54907
-
SHA256
f116f8f5a3d34a6925165ba8c85e4c3ff95ffd2276a11a9d3bfd5847e2f1fc0a
-
SHA512
ab99a13436f0534d0eb2cb949652044c65bb861a3b55176217c91304713d7dd46ec3b2fc4a8da0d673a0228a47b6e1d9723982ae2713449eca1a178c253787f4
-
SSDEEP
24576:2r+0fmbAVqW6sLh8zcC5OwiaTkvED48vuCu/SlQMhtuIHKcL71:2ebkqjs2zx5JiaTkshmnSll5
Score1/10 -
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1