Extracted

• • Target

    Maple Raider.exe

  • Size

    34.1MB

  • MD5

    ba1d0780f519ee2807e153d51df5916e

  • SHA1

    03f9b5b21a1911ea068e668b041ff827ca0891d7

  • SHA256

    aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29

  • SHA512

    d31b05daeb984427c4b5c476169cdab442723c51324938fc3df700f91ecb35b5b5ba5b1b11297c170fcee0bf2c56d9db7b2ef18b289042eb7a7373745faa9d89

  • SSDEEP

    786432:3p039FS+ab44n6ASQSc6k00CZcKoTMS4uEgbFtNFEtKN:3ps9Fnab4+6DQSc6JUCS1NOK

  Score

  10^/10

  gurcumilleniumratevasionexecutionpersistenceprivilege_escalationpyinstallerratspywarestealerupx

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1

• • Target

    main.pyc

  • Size

    437B

  • MD5

    e3a83cc96bc468e8ed5e99b61ab1b08c

  • SHA1

    fc094fba9141e8ace98cce0309e1472b2471b631

  • SHA256

    893f6af6a7c380817dd8a1e5f63e72225b82c9775dc8ca40a449ed86c0427932

  • SHA512

    6d629486b39cef47bd2ce9b79ff792eebee83e4bdcbb30a756aabcbce75473a732ce2f3e89f0d200a4f9dc98765ce07538a9737cd428b2b372a6d36f4e78630d

  Score

  3^/10
  behavioral2