Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe

  • Size

    4.7MB

  • MD5

    64a534242627bc0dfc8bdb32f49a4d59

  • SHA1

    8cec059ca3eb9b8a77775c021c155f00c9d18395

  • SHA256

    640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8a

  • SHA512

    b8a677769ade9740f63cb163b69bcaed61583185f9a62fb2e672123b8445c90fafbc2036bbb64f6f301390210d06dda607b12b783ba1155666043d3534405152

  • SSDEEP

    98304:yXmTuJH5FPywbQ/zpgXGfVfhYB726W9B/VIPGbgKVZ1G:yXmqRPYppdfZfVIPEG

  Score

  10^/10

  betabotfabookiegcleanernullmixeronlyloggerprivateloadersmokeloadervidar706aspackv2backdoorbotnetdropperevasionloaderpersistencespywarestealertrojanupx

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Vidar Stealer

    stealer

  • Disables taskbar notifications via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Looks for VMWare services registry key.

    evasion

  • Sets file execution options in registry

    persistence

  • Sets service image path in registry

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2