Extracted

• • Target

    Tool/ConsoleApp1.dll

  • Size

    6KB

  • MD5

    65b7dd9376f29f87d752de844959a3b3

  • SHA1

    9f7dd0a81bdb61c6e7b52aa4656b63cae27fc7b0

  • SHA256

    bda7b191c57f03dac42b18bcca21edb0627854d3a81386a174d72737aa7186e8

  • SHA512

    a5780071dcdbb4bb65a5609a6311e7cff6fc29709458cf11abec210b568dee8b8e9460065f7109713d4bece434443e4757ecb15b86e6b507886573d794c01986

  • SSDEEP

    48:6lQFWe88sFwau1S95ChVh909zL6+ifOVvTBOzuQMrsKXj1Uv7a/tdlr59aU6yLKY:N8sgqEVLM+To5op7P9ezNt

  Score

  1^/10
  behavioral1

• • Target

    Tool/Mono.Cecil.Pdb.dll

  • Size

    87KB

  • MD5

    6d5eb860c2be5dbeb470e7d3f3e7dda4

  • SHA1

    80c76660b87c52127b1a7da48e27700f75362041

  • SHA256

    447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4

  • SHA512

    64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5

  • SSDEEP

    1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO

  Score

  1^/10
  behavioral2

• • Target

    Tool/Mono.Cecil.Rocks.dll

  • Size

    27KB

  • MD5

    6e7f0f4fff6c49e3f66127c23b7f1a53

  • SHA1

    14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a

  • SHA256

    2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e

  • SHA512

    0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e

  • SSDEEP

    384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd

  Score

  1^/10
  behavioral3

• • Target

    Tool/Tool.exe

  • Size

    2.5MB

  • MD5

    5eb488fde8ae946dbe2ee631a44e2264

  • SHA1

    7a7c0b9d4dfb605bed6d6f1fe256cb2b9e8799db

  • SHA256

    f4894d1b685f8b6a53bfcbc23869c806258c0b7e7def3f4f946c2d6a7019dfad

  • SHA512

    29fe591da31225aeb09490ddfed86e3a48c47bc17d2110ca63a7a1b243516cc8fc7f5c3a33e364c718183a4872d145b7ab8d80a5c8b932d69229cae065318c06

  • SSDEEP

    49152:QS5WRuchCqDjoexP05/h+kaFCxLli+brfU5c47RiPcCfwiUZW8XQJKDRgR:Q6Kuch/DZW5AkaY7iurM247M743M8AYm

  Score

  10^/10

  xmrigevasionexecutionminerpersistenceupx

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral4

• • Target

    Tool/stub.dll

  • Size

    96KB

  • MD5

    625ed01fd1f2dc43b3c2492956fddc68

  • SHA1

    48461ef33711d0080d7c520f79a0ec540bda6254

  • SHA256

    6824c2c92eb7cee929f9c6b91e75c8c1fc3bfe80495eba4fa27118d40ad82b2b

  • SHA512

    1889c7cee50092fe7a66469eb255b4013624615bac3a9579c4287bf870310bdc9018b0991f0ad7a9227c79c9bd08fd0c6fc7ebe97f21c16b7c06236f3755a665

  • SSDEEP

    1536:9G6ijoigzKqO1RUTBHQsu/0igR4vYVVlmbfaxv0ujXyyedOn4iwEEl:BSElHQ/ORUYos0ujyzdZl

  Score

  10^/10

  redlinesectopratinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  behavioral5

• • Target

    Tool/x64/Mono.Cecil.Pdb.dll

  • Size

    87KB

  • MD5

    6d5eb860c2be5dbeb470e7d3f3e7dda4

  • SHA1

    80c76660b87c52127b1a7da48e27700f75362041

  • SHA256

    447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4

  • SHA512

    64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5

  • SSDEEP

    1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO

  Score

  1^/10
  behavioral6

• • Target

    Tool/x64/Mono.Cecil.Rocks.dll

  • Size

    27KB

  • MD5

    6e7f0f4fff6c49e3f66127c23b7f1a53

  • SHA1

    14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a

  • SHA256

    2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e

  • SHA512

    0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e

  • SSDEEP

    384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd

  Score

  1^/10
  behavioral7

• • Target

    Tool/x64/fix.exe

  • Size

    95KB

  • MD5

    1f327a277466f1bb04aa5cfcd279c0f7

  • SHA1

    9bcb7bbac28992b9c7c35ba0573dce7db32ca18f

  • SHA256

    e8432406bc918c6ce0d245a3bc5bb8c021b218593f94b5d09ebcda7e549f1fc0

  • SHA512

    82c750475dc42d974c3fd33a4329bce7e99a5c15bf88fe4e802627b321b6c91f78e8be4b82e72380ee34c4de407878d17b18af26d7f5667104fdc55020f68a9d

  • SSDEEP

    1536:Bqs+FRcqWClbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2ZtmulgS6pUl:veRclyY7+zi0ZbYe1g0ujyzdJU

  Score

  10^/10

  redlinesectoprattelegramonediscoveryinfostealerratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral8

• • Target

    Tool/x64/fix1.exe

  • Size

    7.0MB

  • MD5

    150f7378fd18d19ecc002761fa112de5

  • SHA1

    a5ef247183d14dcd0d9b112306c1965c38720a1e

  • SHA256

    b3bfd7d408a13096897fe8cbaff158cb8ff34f6d2d2269b25a1a268daeef387c

  • SHA512

    dd3739f3e7736c6d6319dbf71346addfdab60d668c84b91d9c87bdf5ee7c6ea085b49a314c52338cb196cceb212067fdbf804da91d9f517a34e1b0978ceebb6d

  • SSDEEP

    196608:YrUXA1HeT39IigDvKub75bcjWgbkzf7AkjdW86:k1+TtIisvB5IjWqkzZ

  Score

  7^/10

  persistencepyinstaller

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral9

• • Target

    Tool/x64/stub.dll

  • Size

    96KB

  • MD5

    625ed01fd1f2dc43b3c2492956fddc68

  • SHA1

    48461ef33711d0080d7c520f79a0ec540bda6254

  • SHA256

    6824c2c92eb7cee929f9c6b91e75c8c1fc3bfe80495eba4fa27118d40ad82b2b

  • SHA512

    1889c7cee50092fe7a66469eb255b4013624615bac3a9579c4287bf870310bdc9018b0991f0ad7a9227c79c9bd08fd0c6fc7ebe97f21c16b7c06236f3755a665

  • SSDEEP

    1536:9G6ijoigzKqO1RUTBHQsu/0igR4vYVVlmbfaxv0ujXyyedOn4iwEEl:BSElHQ/ORUYos0ujyzdZl

  Score

  10^/10

  redlinesectopratinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  behavioral10