Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    a7c903bb30f41066a670c09194a07955
  • Size 3.3MB
  • SHA256 321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb
  • MD5 a7c903bb30f41066a670c09194a07955
  • SHA1 594ed4dc9e2a66c9e7bc147b779b40914ecff1bd
  • SHA512 e81c7a1136b4943d9dd09f5e668ad9ca980913d994855278efa028a93ccc4264522b46d6145a958a4e27d5b06de140ef51de763d07e01228ba1ba351f301dff3
  • SSDEEP 98304:JOXanYNtzmnI/zxUzvLvn6hZppH2GtbyQjH1nemzR1Hc:Jhn+onxLnYZpF2G37t9c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nullmixerprivateloaderredlineriseprosectopratsmokeloaderanioldpub5aspackv2backdoordropperinfostealerloaderratspywarestealertrojanvidar706persistence

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Modifies Installed Components in the registry

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    setup_installer.exe
  • Size 3.2MB
  • SHA256 f456651ae6531c2a3a00277625c832ab58043212c27cb3f341ea6ddd10be0aa5
  • MD5 8138b1878af967b8faa5ae3339a29ab8
  • SHA1 a6e02d8d97ef8278d68972c810bf26cedc3a5bc1
  • SHA512 61b44cdd2a20f1fa1898bb89eadb6a84a5053c034dd800a8cd3e4cffa9bd2ee852e51c41fc126c1198abce516cfb997d340715e172c5db5b4d94bfdafc1c5277
  • SSDEEP 98304:x8yPC41vuFKLfNnNXfnjHy90j31n3GAwCvLUBsKguQFcq:xlvuunfnjS90TBTNLUCK5QFcq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nullmixerprivateloaderredlineriseprosectopratsmokeloadervidar706anioldpub5aspackv2backdoordropperinfostealerloaderratspywarestealertrojan

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4