agenttesla

Target

Downloaders.zip
Size

12KB
Sample

240509-b51w6aeb68
MD5

94fe78dc42e3403d06477f995770733c
SHA1

ea6ba4a14bab2a976d62ea7ddd4940ec90560586
SHA256

16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
SHA512

add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
SSDEEP

384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB

Malware Config

Extracted

Family

amadey

Version

4.18

http://185.172.128.3

Attributes

install_dir
One_Dragon_Center
install_file
MSI.CentralServer.exe
strings_key
fd2f5851d3165c210396dcbe9930d294
url_paths
/QajE3OBS/index.php

rc4.plain

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kino2.top
Port:
587
Username:
[email protected]
Password:
]]KMGj9lIqJ#
Email To:
[email protected]

Extracted

Credentials

Protocol: ftp
Host:
tff.hu
Port:
21
Username:
[email protected]
Password:
domschitz.matyas

Extracted

Credentials

Protocol: ftp
Host:
bodenonline.eu
Port:
21
Username:
[email protected]
Password:
andreas

Extracted

Credentials

Protocol: ftp
Host:
superwomen.de
Port:
21
Username:
[email protected]
Password:
donvito14

Extracted

Credentials

Protocol: ftp
Host:
4herself.com
Port:
21
Username:
[email protected]
Password:
kut02?hi

Extracted

Credentials

Protocol: ftp
Host:
4herself.com
Port:
21
Username:
admin
Password:
kut02?hi

Extracted

Credentials

Protocol: ftp
Host:
4herself.com
Port:
21
Username:
4herself
Password:
kut02?hi

Extracted

Credentials

Protocol: ftp
Host:
andrea-sat.it
Port:
21
Username:
[email protected]
Password:
infoasat

Extracted

Credentials

Protocol: ftp
Host:
mikus.org
Port:
21
Username:
[email protected]
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
blachura.com
Port:
21
Username:
[email protected]
Password:
kam123456

Extracted

Credentials

Protocol: ftp
Host:
mikus.org
Port:
21
Username:
gisbert
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
blachura.com
Port:
21
Username:
kamil
Password:
kam123456

Extracted

Credentials

Protocol: ftp
Host:
mikus.org
Port:
21
Username:
admin
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
andrea-sat.it
Port:
21
Username:
andrea
Password:
infoasat

Extracted

Credentials

Protocol: ftp
Host:
mikus.org
Port:
21
Username:
mikus
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
blachura.com
Port:
21
Username:
admin
Password:
kam123456

Extracted

Credentials

Protocol: ftp
Host:
andrea-sat.it
Port:
21
Username:
admin
Password:
infoasat

Extracted

Credentials

Protocol: ftp
Host:
blachura.com
Port:
21
Username:
blachura
Password:
kam123456

Extracted

Credentials

Protocol: ftp
Host:
twin-set.es
Port:
21
Username:
[email protected]
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
twin-set.es
Port:
21
Username:
milena.righetti
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
andrea-sat.it
Port:
21
Username:
andrea-sat
Password:
infoasat

Extracted

Credentials

Protocol: ftp
Host:
twin-set.es
Port:
21
Username:
admin
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
twin-set.es
Port:
21
Username:
twin-set
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
ftp.mikus.org
Port:
21
Username:
[email protected]
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
ftp.mikus.org
Port:
21
Username:
gisbert
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
ftp.mikus.org
Port:
21
Username:
admin
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
ftp.mikus.org
Port:
21
Username:
mikus
Password:
mertesucker

Extracted

Credentials

Protocol: ftp
Host:
ftp.twin-set.es
Port:
21
Username:
[email protected]
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
ftp.twin-set.es
Port:
21
Username:
milena.righetti
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
ftp.twin-set.es
Port:
21
Username:
admin
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
ftp.twin-set.es
Port:
21
Username:
twin-set
Password:
millymilly

Extracted

Credentials

Protocol: ftp
Host:
66.96.133.1
Port:
21
Username:
wiebes
Password:
,"mel123"

Extracted

Credentials

Protocol: ftp
Host:
ftp.c9n.com
Port:
21
Username:
[email protected]
Password:
sbandes

Extracted

Credentials

Protocol: ftp
Host:
ftp.c9n.com
Port:
21
Username:
8lacksam
Password:
sbandes

Extracted

Credentials

Protocol: ftp
Host:
ftp.c9n.com
Port:
21
Username:
admin
Password:
sbandes

Extracted

Credentials

Protocol: ftp
Host:
ftp.c9n.com
Port:
21
Username:
c9n
Password:
sbandes

Extracted

Credentials

Protocol: ftp
Host:
ftp.caradoc.co.uk
Port:
21
Username:
[email protected]
Password:
chrisharris

Extracted

Credentials

Protocol: ftp
Host:
ftp.caradoc.co.uk
Port:
21
Username:
20kcirtapll
Password:
chrisharris

Extracted

Credentials

Protocol: ftp
Host:
ftp.caradoc.co.uk
Port:
21
Username:
admin
Password:
chrisharris

Extracted

Credentials

Protocol: ftp
Host:
ftp.caradoc.co.uk
Port:
21
Username:
caradoc
Password:
chrisharris

Extracted

Credentials

Protocol: ftp
Host:
grupobeta.com.mx
Port:
21
Username:
[email protected]
Password:
fmoralesm

Extracted

Credentials

Protocol: ftp
Host:
grupobeta.com.mx
Port:
21
Username:
811026
Password:
fmoralesm

Extracted

Credentials

Protocol: ftp
Host:
grupobeta.com.mx
Port:
21
Username:
admin
Password:
fmoralesm

Extracted

Credentials

Protocol: ftp
Host:
grupobeta.com.mx
Port:
21
Username:
grupobeta
Password:
fmoralesm

Extracted

Family

redline

Botnet

siski

168.119.242.255:7742

Extracted

Family

xworm

209.145.51.44:7000

Mutex

iLWUbOJf8Atlquud

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

remcos

Botnet

RemoteHost

107.173.4.16:2560

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KDW6BI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

amadey

Version

4.20

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

NvCHbLc8lsi9

Attributes

delay
3
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.ai/raw/o87oy6ywss

aes.plain

Extracted

Family

redline

Botnet

7001210066

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

redline

Botnet

5637482599

https://pastebin.com/raw/NgsUAPya

Extracted

Family

redline

Botnet

5345987420

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

lumma

https://whispedwoodmoodsksl.shop/api

https://acceptabledcooeprs.shop/api

https://obsceneclassyjuwks.shop/api

https://zippyfinickysofwps.shop/api

https://miniaturefinerninewjs.shop/api

https://plaintediousidowsko.shop/api

https://sweetsquarediaslw.shop/api

https://holicisticscrarws.shop/api

https://boredimperissvieos.shop/api

Extracted

Family

socks5systemz

http://bdlbeqm.com/search/?q=67e28dd86c08f72b460daf4c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa13c1e6979932

http://bmhoajx.com/search/?q=67e28dd83a09fa2d165cad4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978a571ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffa13c1e697993a

http://ayrbsxi.ru/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa13c1e6969939

http://ayrbsxi.ru/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12eab517aa5c96bd86eb978f45805a8bbc896c58e713bc90c91936b5281fc235a925ed3e01d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee90983ac46c9514

http://aqtevem.ru/search/?q=67e28dd8655ba77a135ffe187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978a571ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffa13c1e6979933

http://aqtevem.ru/search/?q=67e28dd8655ba77a135ffe187c27d78406abdd88be4b12eab517aa5c96bd86ec90864e845a8bbc896c58e713bc90c91d36b5281fc235a925ed3e06d6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee90983ac46d951e

Targets

- Target
  
  4363463463464363463463463.exe
- Size
  
  10KB
- MD5
  
  2a94f3960c58c6e70826495f76d00b85
- SHA1
  
  e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
- SHA256
  
  2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
- SHA512
  
  fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
- SSDEEP
  
  192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Score

10^/10

agenttesla amadey blackmoon zgrat banker evasion execution keylogger persistence rat spyware stealer trojan dcrat hijackloader quasar redline rhadamanthys sectoprat xworm siski discovery infostealer loader pyinstaller themida upx
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect Blackmoon payload
- Detect Xworm Payload
- Detect ZGRat V1
- Detects HijackLoader (aka IDAT Loader)
- HijackLoader
  HijackLoader is a multistage loader first seen in 2023.
  loader hijackloader
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Contacts a large (781) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  New Text Document mod.exe
- Size
  
  8KB
- MD5
  
  69994ff2f00eeca9335ccd502198e05b
- SHA1
  
  b13a15a5bea65b711b835ce8eccd2a699a99cead
- SHA256
  
  2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
- SHA512
  
  ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
- SSDEEP
  
  96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Score

10^/10

amadey asyncrat blackmoon lumma privateloader redline remcos risepro socks5systemz 5345987420 5637482599 7001210066 default remotehost banker bootkit botnet collection discovery evasion execution infostealer loader persistence pyinstaller rat spyware stealer themida trojan upx
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Async RAT payload
  rat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  
  New Text Document mod.exse
- Size
  
  8KB
- MD5
  
  69994ff2f00eeca9335ccd502198e05b
- SHA1
  
  b13a15a5bea65b711b835ce8eccd2a699a99cead
- SHA256
  
  2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
- SHA512
  
  ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
- SSDEEP
  
  96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Score

10^/10

amadey asyncrat blackmoon lumma redline risepro socks5systemz 5345987420 5637482599 7001210066 default banker bootkit botnet collection discovery evasion execution infostealer persistence pyinstaller rat spyware stealer themida trojan upx privateloader remcos remotehost loader
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Async RAT payload
  rat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral5 behavioral6