Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    ResIL.dll

  • Size

    1.4MB

  • MD5

    ee360e256e2b836865cf02a6bdd9e5be

  • SHA1

    cd5118ed4363d7fc0027133622dddb37e1c6bbe6

  • SHA256

    f9be6aea3b674a79872683a6622c3ba77fe628f5a2e7f0a000d379e2a0318310

  • SHA512

    3fe6b9fbddcf402ebdebbd4bcfbb3a8d4632bb576dcb44246c1e248076c1f09e6926448217ca724d4febc8fc879838d0d378eb7cc9d1922381acf093ee2a680e

  • SSDEEP

    24576:NL18jX6HrufWRTVl5DzapRdSdRBgF6MP70D16OAGZvEjm5YgWj55Tr52AaUzhW:fr2eVD9dRBgOv+mYTF2AaUA

  Score

  3^/10
  behavioral1behavioral2behavioral3behavioral4

• • Target

    libGLESv2.dll

  • Size

    4.4MB

  • MD5

    e307e977ebb1df8ba0957a412425ed23

  • SHA1

    e024a7a81e7f485058fec40fd0a745f0d7aecb1e

  • SHA256

    af4f66e79e0cc1e4254f023cfb7f0140561c7d4e38d9bcf6184e8e69b32540db

  • SHA512

    ab5f5beb80915385aea4b62337178c6dfa964edfb7e20c22d364c99cd323fa50df9e2c640d7850765e5a683a07034d6be8f61f47f06a8d1ee1f594da804e6def

  • SSDEEP

    49152:PnBb2OR3KPf/Et3msx8M+TsZ2idR/O0zql9Kgtg6QMsWFxtqhk/bivfhjgrQuIEt:h5qc/622iLAv1NQcoa/bY3g

  Score

  3^/10
  behavioral5behavioral6behavioral7behavioral8

• • Target

    res_mods/1.23.0.0/scripts/client/gui/mods/7zA.exe

  • Size

    722KB

  • MD5

    43141e85e7c36e31b52b22ab94d5e574

  • SHA1

    cfd7079a9b268d84b856dc668edbb9ab9ef35312

  • SHA256

    ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

  • SHA512

    9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

  • SSDEEP

    12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq

  Score

  1^/10
  behavioral10behavioral11behavioral12behavioral9

• • Target

    setup.exe

  • Size

    794.4MB

  • MD5

    6d95cb153d6806c9f408fa1d17253001

  • SHA1

    38371c4df014bf03ea0430392202b78319f4b09f

  • SHA256

    a04defc1f6811ebb64907ad79c63c2ccedb2cba15afca05758f537768da7b934

  • SHA512

    0ab1800b639709648e82c9370e727999de9b5564107cd41b2d0ff5bbbb6f324a854ef5a5269cd8c3f3ac96c669014b9eac398c8902e47d779027b6726aec95d2

  • SSDEEP

    98304:dmg6rK+6/Murdncf8kJPBesTcbMl3sjWpoDELiDKzyeByA:doYMKaP5eqcbM5sOLiDheB

  Score

  10^/10

  amadeyredlinestealctofseee76b71newbuildnewlogsniceevasionexecutioninfostealerpersistencespywarestealertrojanlumma@logscloudyt_botlivetraffoclogsdiller cloud (tg: @logsdillabot)zovdiscoveryprivilege_escalationexelastealer4dd39ddefense_evasion

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Modifies firewall policy service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral13behavioral14behavioral15behavioral16

• • Target

    updates/Uninstall/unins000.exe

  • Size

    1.5MB

  • MD5

    3ab31d714c50ae078f9eaba7b2497191

  • SHA1

    45c5e807e459d95618c03a6ded9debe1d70013f3

  • SHA256

    4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb

  • SHA512

    f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae

  • SSDEEP

    24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKMrexLxB:cIEJxCWluyZ8UbMZz

  Score

  7^/10

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral17behavioral18behavioral19behavioral20

• • Target

    Just.TankCrashWhite.wotmod

  • Size

    602B

  • MD5

    88a7f1d51bc3bf205f9a03e079a87094

  • SHA1

    bb0a335524ab2b054f9d750ac45d3d649359b15a

  • SHA256

    3044772fdebfe4f2aa06996b4b6f28e575d51dbe4dfa66cc71970044afb1aa16

  • SHA512

    389d648105bb5862dc895df923b5342d44b706701aae631d5fa379dd5ac199e1b219af5e471985b1f73d3a054533c49dee7e59805d20d8d1b974cdcfe14841b7

  Score

  1^/10
  behavioral21behavioral22behavioral23behavioral24

• • Target

    vivoxsdk.dll

  • Size

    3.9MB

  • MD5

    2e61c567d528d08cef62b718cb8aa82f

  • SHA1

    43d40774fc9495f9be27f8176b6d1816241237de

  • SHA256

    a887805bf1286725ab930359086fb3302124f5ff81b2d9f43633dc02b97c7577

  • SHA512

    17c9d4fe2d03e2723f37534701238688443041fe75ac77e7cfd8aa1b4a3885fb92dcdb23186a7415119e91def9e6fb6fdd27a7cf2fb810a32ed236ba2230d2b0

  • SSDEEP

    98304:vkp0f3BzK7rh8Kg5IILhzkxJ4dFumlwtDCv49rMe3G0MxVp:cCf3tK7rh8Kg5IILhzhlVp

  Score

  1^/10
  behavioral25behavioral26behavioral27behavioral28