Extracted

• • Target

    x.exe

  • Size

    11.6MB

  • MD5

    db34e85e25da2e5b3b8ff777bbb68e4c

  • SHA1

    7c0e50f60c6470e0b8b6bedd89e4fe7f85df52cf

  • SHA256

    9382ff9b4e5ed4b170c306526dad14d4b3fc8d2f0e0c3f7febd6fa3e9d797adf

  • SHA512

    35053bb9f51f7f9f166e3f41cedd663e6a7733cb78f9236282177d8b9d986239c26fca5db9a5a95c0cbf05bfdd78769f63dc698a2e05cde52f3dc7197b51170e

  • SSDEEP

    196608:/B7v86gV1rbQQOOl2szsHFUK2r7UyTAdQmR8dA6lM8Qnf2ODjMnGydScSEPVrBO8:tWV9hZ2YsHFUK2JAdQJlsF3MnG3tOVr5

  Score

  10^/10

  ardamaxberbewblackmooncobaltstrikefloxifgh0stratmodiloaderbackdoorbankercollectiondefense_evasiondiscoveryevasionexecutionkeyloggerratstealertrojanupx

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax main executable

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Cobalt Strike reflective loader

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Detect Blackmoon payload

  • Disables service(s)

    evasionexecution

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Detects Floxif payload

    backdoor

  • ModiLoader Second Stage

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • System Binary Proxy Execution: Verclsid

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1