Extracted

Extracted

• • Target
    x.exe
  • Size 11.6MB
  • SHA256 9382ff9b4e5ed4b170c306526dad14d4b3fc8d2f0e0c3f7febd6fa3e9d797adf
  • MD5 db34e85e25da2e5b3b8ff777bbb68e4c
  • SHA1 7c0e50f60c6470e0b8b6bedd89e4fe7f85df52cf
  • SHA512 35053bb9f51f7f9f166e3f41cedd663e6a7733cb78f9236282177d8b9d986239c26fca5db9a5a95c0cbf05bfdd78769f63dc698a2e05cde52f3dc7197b51170e
  • SSDEEP 196608:/B7v86gV1rbQQOOl2szsHFUK2r7UyTAdQmR8dA6lM8Qnf2ODjMnGydScSEPVrBO8:tWV9hZ2YsHFUK2JAdQJlsF3MnG3tOVr5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  berbewcobaltstrikegh0stratmodiloadermydoomredlinesalityxwormaspackv2backdoordefense_evasiondiscoveryevasionexecutioninfostealerpersistencepyinstallerrattrojanupxworm

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Cobalt Strike reflective loader

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Detect Xworm Payload

  • Detects MyDoom family

  • Disables service(s)

    evasionexecution

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Windows security bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Contacts a large (8895) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1