Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    ICQLiteShell.dll
  • Size 56KB
  • SHA256 515c8e0b93f0fef15da3e2573ad92b7e7840374140e65e5d73df63d8e22cb3e8
  • MD5 05e61539b8917fca37c03756bbdd043d
  • SHA1 5a72e0e528260de0ea5b34badb9e5f9873cb4245
  • SHA512 565d57783e6044d6e7e2026c79dbd897e637c5e1d96e7930dc704ef2b6d801669b38f0c26382f00e67e26668439274941e937a0ade54666de50b5d84f6da7e97
  • SSDEEP 768:YEGJ9blT7XZBSbHwJU+tGR0KZUyGKZ0ZgwmF1+3UVambg:YEGJ9bln5o0KZjGKZ0Z1mF1+3UVayg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2behavioral3
• • Target
    ICQRT.dll
  • Size 32KB
  • SHA256 53e1f40144bab532f9700ff25ec3d5c6a39784a98e17fada583b4ee6d9dd5dbc
  • MD5 1aedcb8994d6ad63ef9dcb87016e028f
  • SHA1 f5b891aa15c6353b681bdb7e2d96c6ac8a5f02d7
  • SHA512 89c0f408797c4d78afc52335a9e162345c614e1e419f55487cb358c14f7a69ec82138a7e6250be3133233386ba3659d241e80ab63c9b972b6c8b26b0424cb0c8
  • SSDEEP 384:+qtTeds1tkMAp4TxCW9su5UcSu93ggoXUQQIPGEANHl:FTedukelF95RjQUUPpANHl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral4behavioral5behavioral6
• • Target
    Language/WinRar.exe
  • Size 3.2MB
  • SHA256 26b40c79356453c60498772423f99384a3d24dd2d0662d215506768cb9c58370
  • MD5 b66dec691784f00061bc43e62030c343
  • SHA1 779d947d41efafc2995878e56e213411de8fb4cf
  • SHA512 6a89bd581baf372f07e76a3378e6f6eb29cac2e4981a7f0affb4101153407cadfce9f1b6b28d5a003f7d4039577029b2ec6ebcfd58e55288e056614fb03f8ba3
  • SSDEEP 98304:lJXOBfK92HbAw0CNB3kJElzNsy8vGUvfCo3ABH43:lJ192HbAXCvDlzNsy8vGUyo3AB8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8behavioral9
• • Target
    LiteRes.dll
  • Size 735KB
  • SHA256 afa884228afc5c05f4b47e90b6de42854d5a8886ec5ed15a253faeccd5309036
  • MD5 88962410244bc5c03482b82a7e3cb5e1
  • SHA1 4622be2d3deda305bf0a16c0e01bc2ecf9d56fad
  • SHA512 c6e7667f91c1439e33ad4d9e2052b7c9fcc3ca2c7688d9e2bc0550b71a5762b76aa76427331df0217429d9bd984925997c7a8d009f25e44e2776c5ce7cc9d98c
  • SSDEEP 6144:x9Ej/jb82/HRoXO1q2pt+Mc1/PDPicsUzM+gYESoE/wOuET8F62bH5vnGfcJvl+b:fqptG/PDPo0no2Iq8F6CHBTWqU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10behavioral11behavioral12
• • Target
    LiteSkinUtils.dll
  • Size 48KB
  • SHA256 9fa7cacb5730faacc2b17d735c45ee1370130d863c3366d08ec013afe648bfa6
  • MD5 059d94e8944eca4056e92d60f7044f14
  • SHA1 46a491abbbb434b6a1a2a1b1a793d24acd1d6c4b
  • SHA512 0f45fe8d5e80a8fabf9a1fd2a3f69b2c4ebb19f5ffdcfec6d17670f5577d5855378023a91988e0855c4bd85c9b2cc80375c3a0acb1d7a701aff32e9e78347902
  • SSDEEP 768:FPGeoWyuTx6vrP/zAdWQS6Z9CSKh64crVKTl9inMUAK:tGeJxIHepSKzjVK9iMUAK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral13behavioral14behavioral15
• • Target
    setup.exe
  • Size 717.0MB
  • SHA256 aafb7f16f653a0d189981974bc16214fea9e9ab8ba6ea13f0e4d389d2bc97f12
  • MD5 c3c8543919bbd677773e9bb97e12eb62
  • SHA1 dbce58ffd5606a2aa99983b1359bd509ffe14248
  • SHA512 ba6d954d49fd76084f436cd54e63104ffbd9d655c6fb665a4206863576404f972035d828a917d81125da000ee48f8d63394e0b6684a01eccfbc9697df3b8d7f6
  • SSDEEP 98304:3Y6P2L8j12IU+fHyGTQVobss/lHGxeAo:IRw2I7Q+mxe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  djvugluptebalummariseprosmokeloaderstealczgratpub3backdoordiscoverydropperevasionloaderpersistenceransomwareratspywarestealerthemidatrojan

  • Detect ZGRat V1

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral16behavioral17behavioral18