General
- Target 13478994921.zip
- Size 44.4MB
- Sample240811-c8fk3avhqa
- SHA256 f3312ae135274af9cb757246376d2309f6feedf27476099d7b987b78bd61bca7
- MD5 44d3f87708aba8171f36a82a9093de63
- SHA1 e6649e277bd431283237a69358e2d8224f08901f
- SHA512 929e839104a46651958fd0c9c88a6de6545200c27cdc4ed61276e8b2ae561fb8d28d830916cae03c8285b1e09c4245fe94c36c70dbfdefd946a57ddc1f353bf1
- SSDEEP 786432:dqQIaM8wVO5gcEk9GzTTps9KLP0HIzyB1tsxkYYSM0HoqegVFKKaxTIC:dBIEfT9GTpMKL8HFBYYSMsSx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
icedid
Extracted
Family
-
metasploit
Version
-
encoder/shikata_ga_nai
Signatures
- 888rat family
- Android 888 RAT payload 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 family_888rat - Ardamax family
- Ardamax main executable 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 family_ardamax - Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 disable_win_def - Detected LegionLocker ransomware 1 IoCs
Sample contains strings associated with the LegionLocker family.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 family_legionlocker - Detected TEARDROP fileless dropper 1 IoCs
TEARDROP is a memory-only dropper which can read files/registry keys, decode an embedded payload, and load it directly into memory.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 family_teardrop - EvilNum C# Component 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 evilnum_csharp - Evilnum family
- Growtopia family
- Guloader family
- Guloader payload 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 family_guloader - IcedID First Stage Loader 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 IcedidFirstLoader - Icedid family
- Legionlocker family
- LoaderBot executable 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 loaderbot - Loaderbot family
-
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 m00nd3v_logger - M00nd3v_logger family
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 masslogger_log_file - Masslogger family
- Matiex Main payload 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 family_matiex - Matiex family
- Metasploit family
- Nanocore family
- NetWire RAT payload 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 netwire - Netwire family
- Snake Keylogger payload 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 family_snakekeylogger - Snakekeylogger family
- Teardrop family
- XMRig Miner payload 1 IoCs
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 xmrig - Xmrig family
- ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 rezer0 - Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 agile_net - HTTP links in PDF interactive object 1 IoCs
Detects HTTP links in interactive objects within PDF files.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 pdf_with_link_action - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 - Office document contains embedded OLE objects 1 IoCs
Detected embedded OLE objects in Office documents.
resource yara_rule static1/unpack001/be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0 office_ole_embedded
File Explorer
-
13478994921.zip.zip 44.4MB