Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    db93b7eff4c2415afc573cba1930c376.exe
  • Size 791KB
  • SHA256 d9731a8aa35b79ab73cf572052820f160fd86948e546eafc9f8cf66c285229ab
  • MD5 db93b7eff4c2415afc573cba1930c376
  • SHA1 104b8b572f8080aa914bf162eb0762d40da1b6ee
  • SHA512 fc8c85a61893ecf962e1b3912f90c31f3950b3b68f05d2a5d6c5918f382b6f7a4b4d5c3a9673120ea69dfdfbd1328bc4dca00b76cf748087569ce7f8f2d1a746
  • SSDEEP 12288:2N0TBLJH+SjPqZ8VfwMnSo7YNQDLPxez8dFlZqBUOZjSVXNpbycdc1mFdj/RA:2N0TBLNDqZ8VDnDwQQz+8PjSfcM7/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredlineriseproxmrig@oni912discoveryevasioninfostealerminerpersistencestealertrojanupxzgrat1@oleh_ps@pixelscloudrat

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2