Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    c105d4787dde8f7183c57c1285e9f808

  • Size

    5.7MB

  • MD5

    c105d4787dde8f7183c57c1285e9f808

  • SHA1

    91111164eb5a8b996eefe72a6363bad3f1a858b0

  • SHA256

    a8d8a6f9478a60a05d3b8c57a616da20c83b99bc7877c46163fcd126bbb25409

  • SHA512

    5f97fdcdb34d8ce3d3e7272a30e27d93766bf0214a54ac55cdafd41e3bbfb57ebc537fe5955a7af80fee578c17f81116410e69cf865aa38a2d93280ff0c308a1

  • SSDEEP

    98304:x7CvLUBsg7C0ijhUYMUpUqOnvqpM2GSEw1kHyaNgUvI745IRZYriuyY7x77:xALUCg7Cj1DavBHyQgUQ7XYiuyY7xv

  Score

  10^/10

  cryptbotnullmixerprivateloadersmokeloadervidarzgrat706pub5aspackv2backdoordiscoverydropperevasionloaderratspywarestealerthemidatrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot payload

  • Detect ZGRat V1

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2