General

  • Target

    saved from malware.7z

  • Size

    221.2MB

  • MD5

    4bbc54320807c97bc1877e27381ab2bc

  • SHA1

    7c140610d8c4534929e2ae46192647b3fcc0a0c8

  • SHA256

    1c4b4534f2cc5f8ce484d9fc8330294254bb617af8c9ba893d23b0e7e72c3872

  • SHA512

    729e425896aea8397c38be27b02b1db4e88908982b44ed0a7f32e247b277602ebfc57ea41b8ab64923b20c69688c5d5d05e823a86ad54a55c0fed3ac217fdd11

  • SSDEEP

    3145728:LPuwsv1jkJkEIHQYOXk3DfvTQc2wAYfjqJV1RnCQ0DDzwJg1nGkciRWgenMpkTX6:LPuwsv1wgfzvTLMYfjqVkRGtnykTXBU

Malware Config

Extracted

Family

cobaltstrike

Botnet

391144938

C2

http://123.207.55.181:80/match

Attributes
  • access_type

    512

  • host

    123.207.55.181,/match

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    80

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVbfK+aNqW68J4Ay8nuTPwy/YyzgEWgKb15Nlriq/m6jzu4pl/djNPmAw/hxNxanb6RunI1tnl0c97uAJ8JX7W535XzES5Vq6HLKbMGw6bCAh90FsfHLkllLJ1ytX1ALKEF7tCAtFFg1u+MLBQbnMNGnszM82Ce2Djv51ux3lIVQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)

  • watermark

    391144938

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://77.91.77.92/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes
  • mutex

    x66x54x66x

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Extracted

Family

redline

C2

38.180.203.208:14238

185.215.113.9:12617

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

103.42.55.251:8080

Extracted

Family

redline

Botnet

kir

C2

147.45.44.73:6282

Extracted

Family

nanocore

Version

1.2.2.0

C2

91.92.240.41:7575

Mutex

7029ef73-6025-47e5-b0d0-fb5b27c261b8

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    91.92.240.41

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2024-05-23T20:48:22.996317836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    7575

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    7029ef73-6025-47e5-b0d0-fb5b27c261b8

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    91.92.240.41

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    5000

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1604

127.0.0.1:22253

eu-central-7075.packetriot.net:6606

eu-central-7075.packetriot.net:7707

eu-central-7075.packetriot.net:8808

eu-central-7075.packetriot.net:1604

eu-central-7075.packetriot.net:22253

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • Cobaltstrike family
  • Detect Xworm Payload 1 IoCs
  • Metasploit family
  • Mimikatz family
  • Nanocore family
  • Phorphiex family
  • Phorphiex payload 16 IoCs
  • RedLine payload 3 IoCs
  • Redline family
  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • XMRig Miner payload 2 IoCs
  • Xmrig family
  • Xworm family
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Detects Pyinstaller 2 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 125 IoCs

    Checks for missing Authenticode signature.

Files

  • saved from malware.7z
    .7z
  • saved from malware/Files/%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
    .exe windows:5 windows x86 arch:x86

    a18c466a89c034cf01801b0439542035


    Headers

    Imports

    Sections

  • saved from malware/Files/%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • out.upx
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • saved from malware/Files/-.exe
  • saved from malware/Files/02.08.2022.exe
  • saved from malware/Files/1.exe
    .exe windows:5 windows x86 arch:x86

    e3b708193fe03ba1bfd096b4ae42f3b9


    Headers

    Imports

    Sections

  • saved from malware/Files/11.exe
    .exe windows:5 windows x86 arch:x86

    e3b708193fe03ba1bfd096b4ae42f3b9


    Headers

    Imports

    Sections

  • saved from malware/Files/1111.exe
    .exe windows:4 windows x86 arch:x86

    74aaf0b5a0230a863603c8c6bcd8756b


    Headers

    Imports

    Exports

    Sections

  • saved from malware/Files/4ck3rr.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/Files/66ab1b27ae40b_BotClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/Files/66ab1b27ae40b_BotClient.exe5wDUFGqU3QeuQlEX
    .exe windows:6 windows x86 arch:x86

    b855a851b141e89d180e7702048417ce


    Headers

    Imports

    Sections

  • saved from malware/Files/66ae9b239854c_crypto.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/Files/66b09d7d34310_DefragManager.exe
    .exe windows:6 windows x86 arch:x86

    30af0fe2c05b84c5732b235ff670af9b


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/Files/66b1c36969eae_main.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/Files/66b7a2aef1283_doz.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/Files/ChatLife.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/Files/Crack.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/DelHosts.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/DownSysSoft.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/Downaqzh.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/Downdd.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/Downggzh.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/Downty.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/JQMain.exe
    .exe windows:5 windows x86 arch:x86

    052a42c495a0aeaeca141d0e9c942b5e


    Headers

    Imports

    Sections

  • saved from malware/Files/L.exe
    .exe windows:6 windows x86 arch:x86

    08b1b12afb6e1cdcf5adc795ee884ca6


    Headers

    Imports

    Sections

  • saved from malware/Files/M5traider.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/Files/Meredrop.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/PXHMAIN.exe
    .exe windows:5 windows x86 arch:x86

    af336d68081186dd2f182d0abf3f6e86


    Headers

    Imports

    Sections

  • saved from malware/Files/Project_8.exe
    .exe windows:6 windows x86 arch:x86

    1a5e4ddad4ba385b765de613acbb20f9


    Headers

    Imports

    Sections

  • saved from malware/Files/SvCpJuhbT.exe
    .exe windows:6 windows x64 arch:x64

    f0ea7b7844bbc5bfa9bb32efdcea957c


    Headers

    Imports

    Sections

  • saved from malware/Files/a.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/aaa.exe
    .exe windows:5 windows x86 arch:x86

    d4aa9ed1c24f35a9649cb4146576e0ec


    Headers

    Imports

    Sections

  • saved from malware/Files/abc.exe
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • saved from malware/Files/amadey.exe
    .exe windows:6 windows x86 arch:x86

    dc5e346c01606ee3d3aee4549b4acd39


    Headers

    Imports

    Sections

  • saved from malware/Files/build_2024-07-27_00-41.exe
    .exe windows:5 windows x86 arch:x86

    227c2d4ce0274b95ccaadb855c19748d


    Headers

    Imports

    Sections

  • saved from malware/Files/clear.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/cmd/pocketrar.chm
    .chm
  • saved from malware/Files/cmd/rar.ini
  • saved from malware/Files/cmd/rar.ppc_arm.cab
    .cab
  • saved from malware/Files/cmd/uninstall.exe
    .exe windows:4 windows x86 arch:x86

    e5d29e6665d4ae72a2942abbe17a361c


    Headers

    Imports

    Sections

  • saved from malware/Files/cmd/whatsnew.htm
    .html
  • saved from malware/Files/ds.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/Files/firefox.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • saved from malware/Files/guardservice.exe
    .exe windows:4 windows x86 arch:x86

    7c0a45853a19590104720910cc56837f


    Headers

    Imports

    Sections

  • saved from malware/Files/m.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/mimikatz.exe
    .exe windows:5 windows x86 arch:x86

    ff6abb25b3369620afef1dacd4a21f4c


    Headers

    Imports

    Sections

  • saved from malware/Files/nc.exe
    .exe windows:4 windows x86 arch:x86

    09d0478591d4f788cb3e5ea416c25237


    Headers

    Imports

    Sections

  • saved from malware/Files/newtpp.exe
    .exe windows:5 windows x86 arch:x86

    e3b708193fe03ba1bfd096b4ae42f3b9


    Headers

    Imports

    Sections

  • saved from malware/Files/npp.exe
    .exe windows:5 windows x86 arch:x86

    7fda7734b056db13fe95f35927509e47


    Headers

    Imports

    Sections

  • saved from malware/Files/nxmr.exe
    .exe windows:4 windows x64 arch:x64

    f7505c167603909b7180406402fef19e


    Headers

    Imports

    Sections

  • saved from malware/Files/o.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/pei.exe
    .exe windows:5 windows x86 arch:x86

    7fda7734b056db13fe95f35927509e47


    Headers

    Imports

    Sections

  • saved from malware/Files/peinf.exe
    .exe windows:5 windows x86 arch:x86

    fb0ee5bafbb99ce467989526f0be15c6


    Headers

    Imports

    Sections

  • saved from malware/Files/pered.exe
    .exe windows:5 windows x64 arch:x64

    a6cec5b1a631d592d80900ab7e1de8df


    Headers

    Imports

    Sections

  • saved from malware/Files/pi.exe
    .exe windows:5 windows x86 arch:x86

    2ffdf0a1519d1adada787fd4df5a5fec


    Headers

    Imports

    Sections

  • saved from malware/Files/pimer_bbbcontents7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/Files/pocketrar350sc.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/Files/pp.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/ps.exe
    .exe windows:6 windows x86 arch:x86

    c8bf48e03c8c37268b47f1d2591aa6fd


    Headers

    Imports

    Sections

  • saved from malware/Files/r.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/random.exe
    .exe windows:6 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • saved from malware/Files/request.exe
    .exe windows:6 windows x86 arch:x86

    015966a997659caed7ef58f6ab2e8bde


    Headers

    Imports

    Sections

  • saved from malware/Files/s.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/sthealthclient.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • saved from malware/Files/t.exe
    .exe windows:5 windows x86 arch:x86

    e3b708193fe03ba1bfd096b4ae42f3b9


    Headers

    Imports

    Sections

  • saved from malware/Files/t1.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/t2.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/tdrpload.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/tools.exe
    .exe windows:4 windows x86 arch:x86

    f6243a15fa8eee8ee96b5e1144d461f6


    Headers

    Imports

    Sections

  • saved from malware/Files/tpeinf.exe
    .exe windows:5 windows x86 arch:x86

    68ea642d9ea854cd557366cd6c8ee49a


    Headers

    Imports

    Sections

  • saved from malware/Files/tt.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/twztl.exe
    .exe windows:5 windows x86 arch:x86

    2e23372b9869b74c90162a6fda4f170d


    Headers

    Imports

    Sections

  • saved from malware/Files/v.exe
    .exe windows:5 windows x86 arch:x86

    38ca2cef077b08d131c2be3bfd70789c


    Headers

    Imports

    Sections

  • saved from malware/Files/xmrig.exe
    .exe windows:4 windows x64 arch:x64

    16bb67d62ee484974f9392fc52c45722


    Headers

    Imports

    Sections

  • saved from malware/a/1111.exe
    .exe windows:4 windows x86 arch:x86

    74aaf0b5a0230a863603c8c6bcd8756b


    Headers

    Imports

    Exports

    Sections

  • saved from malware/a/66ae96cb3d23b_crypted.exe
    .exe windows:6 windows x86 arch:x86

    ddd411113fce64ff664d110a3ad7d003


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66ae9b239854c_crypto.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66af4e35e761b_doz.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66af531b832ee_main.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66af9bdbf0f60_Team.exe
    .exe windows:5 windows x64 arch:x64

    c346eaddb975f381aa1bae852c6a8010


    Headers

    Imports

    Exports

    Sections

  • saved from malware/a/66afa0d3934d8_ultfix.exe
    .exe windows:6 windows x64 arch:x64

    5929190c8765f5bc37b052ab5c6c53e7


    Headers

    Imports

    Exports

    Sections

  • saved from malware/a/66b09f01e0030_dozkey.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b0ba4420669_main.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b0ee142cf8f_PhotosExifEditor.exe
    .exe windows:6 windows x64 arch:x64

    c595f1660e1a3c84f4d9b0761d23cd7a


    Headers

    Imports

    Exports

    Sections

  • saved from malware/a/66b1b02a20b5a_cry.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/a/66b331646d2cd_123p.exe
    .exe windows:6 windows x64 arch:x64

    3fac356340f08f787f93cbf317f090cd


    Headers

    Imports

    Sections

  • saved from malware/a/66b331997e05e_main21.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b382f122c02_stk.exe
    .exe windows:6 windows x86 arch:x86

    add63f909d344437ae54d223c75de68e


    Headers

    Imports

    Sections

  • saved from malware/a/66b38609432fa_sosusion.exe
    .exe windows:6 windows x64 arch:x64

    e902806dc6753d09a7c13ca6f68bc7e5


    Headers

    Imports

    Sections

  • saved from malware/a/66b38b9ae0da3_palnet_new.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66b4af430a0a1_files.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66b4b5e40dbf6_template832components.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66b4ed2ceb0d7_stealc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b5ac1092454_otraba.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b5ac957cc65_crypta.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b5ace3a06b0_dozkey.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66b5b75106ac6_stealc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b5d9d3adbaa_defaultr.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b74da9b163e_1234.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b7a2aef1283_doz.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66b7a4a075311_AsianAsp.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66b7d12b3a8ea_5k.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b7d3a2e7a4d_deepweb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/66b837290469c_vidar.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/66b85f47d1f63_stealc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/ApertureLab.exe
    .exe windows:5 windows x86 arch:x86

    986447145f752ee174944cbcb0f6260b


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/Extreme%20Injector%20v3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/GGWS.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • saved from malware/a/GGWSUpdate.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/Identifications.exe
    .exe windows:5 windows x64 arch:x64

    93b0547f5090c9427cc4f187c26f3f73


    Headers

    Imports

    Exports

    Sections

  • saved from malware/a/InstallerPack_20.1.23770_win64.exe
    .exe windows:5 windows x86 arch:x86

    42d651751c1d75ed4fa8fe71751854ff


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/NJTCFVIV.exe
    .exe windows:4 windows x86 arch:x86

    b5a014d7eeb4c2042897567e1288a095


    Headers

    Imports

    Sections

  • saved from malware/a/OpenArk32.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/a/OpenArk64.exe
    .exe windows:5 windows x64 arch:x64


    Headers

    Sections

  • saved from malware/a/STHealthUpdate.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • saved from malware/a/T7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/T9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/TTF.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/U.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/Update/server.txt
  • saved from malware/a/WE.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/asusns.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/authenticator.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/backdoor.exe
    .exe windows:4 windows x86 arch:x86

    8e93afb33c433eede3fd358369a7f47e


    Headers

    Imports

    Sections

  • saved from malware/a/build2.exe
    .exe windows:5 windows x86 arch:x86

    0275392671bba1542f88797f29212ff8


    Headers

    Imports

    Sections

  • saved from malware/a/c7.exe
    .exe windows:6 windows x86 arch:x86

    08b1b12afb6e1cdcf5adc795ee884ca6


    Headers

    Imports

    Sections

  • saved from malware/a/cookie250.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/exec.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/keylogger.exe
    .exe windows:4 windows x86 arch:x86

    aabc7d829ec4bcf3eb634829eff84ef7


    Headers

    Imports

    Sections

  • saved from malware/a/l2.exe
    .exe windows:6 windows x86 arch:x86

    28410aacd961a705a3e199dc5b1733bd


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/msedge.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/mservice64.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/nano.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/networks_profile.exe
    .exe windows:5 windows x64 arch:x64

    2cdcfb3a828433ba76b5b41f45519bd9


    Headers

    Imports

    Sections

  • saved from malware/a/out_test_sig.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • saved from malware/a/pimer_bbbcontents7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/regasm.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/request.exe
    .exe windows:6 windows x86 arch:x86

    015966a997659caed7ef58f6ab2e8bde


    Headers

    Imports

    Sections

  • saved from malware/a/robotic.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/sahost.exe
    .exe windows:4 windows x86 arch:x86

    61259b55b8912888e90f516ca08dc514


    Code Sign

    Headers

    Imports

    Sections

  • saved from malware/a/settings.xml
  • saved from malware/a/sthealthclient.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • saved from malware/a/stub.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • saved from malware/a/wahost.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections