Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    1cb080c3d69281ff2af28a3b9f448ba493bba28b1c2fde989d5fe91eef4689ea.exe

  • Size

    1.8MB

  • MD5

    a5ac4af7cce548bcdefe3ea60b226f3c

  • SHA1

    b1571f043347987ffb4e90806fae84165a664399

  • SHA256

    1cb080c3d69281ff2af28a3b9f448ba493bba28b1c2fde989d5fe91eef4689ea

  • SHA512

    58b0e239196b961a36649ab9684d917ca7a88c08a0817aece90c2ec6417ddc637ad6092b4dcb5121acfc05757f84eabf18e528fd225148db3f0d4dcaabc39ae5

  • SSDEEP

    24576:7HQxE8arKdOhxJ3PHjPEb6UKc8sfjX3BqljMJX/ySEx8EFM5fqCeX:LQxzdcVZLsfjX3slAzM8QM5CC

  Score

  10^/10

  stealcsavecredential_accessdiscoveryevasionspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    2161f38eb7e940f7dadbf1cff93e3219846ad9dd1d181aceadddd9b1f549bf70.exe

  • Size

    404KB

  • MD5

    07beff810640c60bf60464f5e1efb5b0

  • SHA1

    2af2ee421ae26a98f9775bfe46821ffb47b406d3

  • SHA256

    2161f38eb7e940f7dadbf1cff93e3219846ad9dd1d181aceadddd9b1f549bf70

  • SHA512

    1ed5082b2652d1253c13803c3607afe4befa564c03f1203a6ad157f0187482382d7a1438e34a95667495c89a6ebe020d838fe61ec7f697de865fc55a3b031fa5

  • SSDEEP

    12288:eQn647UR3tHxUAbjUgMhcdMnAXTwHqsEO:z647UTjXUgVXTrst

  Score

  10^/10

  lummavidarc8450254a9a0920212cb81ae7f386da3credential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700.exe

  • Size

    326KB

  • MD5

    adcbb5fa5706fb287f01370eb99e0d10

  • SHA1

    2bff6fd096b95b1591259d223f7a0ced2bb1c79f

  • SHA256

    27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700

  • SHA512

    c2c9addbbbad6c678069874428ab54060550e583e018af9052a8445ee32bfb72586592711b6ae25d392378e50fdfb2ff9a6741d4aa4a5b15cd0b16176db0b8f1

  • SSDEEP

    6144:Ns/IeaQRgAaVIEs1gsHKyDbrXtkD+yEl9WsAwT92ORxEO:qweRd11d5frdhyEl9WiT93EO

  Score

  10^/10

  stealcdefaultdiscoverystealerlummacredential_accessspyware

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    49299f91e7332c216e492d160c690a529b1b644bfd5879eefaf2ae37e2ea3a9f.elf

  • Size

    8.9MB

  • MD5

    b1e65b4b43992ccfa9d4ec32f37f9c78

  • SHA1

    740c77d328d1fd9d8fcdcfd6e8d4f77051e70a6a

  • SHA256

    49299f91e7332c216e492d160c690a529b1b644bfd5879eefaf2ae37e2ea3a9f

  • SHA512

    8f22de2ebf97abdc016d505c3b7b2f0b4e8b358a883e37e8bda0eb85593e43e61028dc51ea2e192e16c698eb6bc9a41a2933e0949935ca5cec35eba8740f1e56

  • SSDEEP

    196608:3UWaf1Ko6sGqRd2ivzaBt1aXEaLpodb9WMPJwXfqNeVWtlPrQBs:3aQEGhiOBfaX/L6db9WMeXdI

  Score

  4^/10
  behavioral7

• • Target

    6f881e1052c12c0f98f059f796602945b01a359c8d6154eb0e731dd6309a5f93.exe

  • Size

    31KB

  • MD5

    68727ada30812394a13441b47a85f70c

  • SHA1

    88df82dfc945d8972e43fa338b40c2a001884e61

  • SHA256

    6f881e1052c12c0f98f059f796602945b01a359c8d6154eb0e731dd6309a5f93

  • SHA512

    6175b203d266e6ab6954cc3237525ba7cafa49235ba88432c031717bbaa5f335174cac916f1525c60ab974182e8c389cbc0c6dfdfba37a8be809b095983b00fd

  • SSDEEP

    768:UrhO5b13hdwzxLy3os0O/dMRvCnQmIDUu0tiFFKj:mcZ6eh6gQVkXj

  Score

  10^/10

  njratdiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion
  behavioral8behavioral9

• • Target

    a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef.exe

  • Size

    19KB

  • MD5

    dc66a0481a259a5c8820880822ff0b3a

  • SHA1

    cbf0988817adcdf51562a519b1d7d4e5c68e5bf5

  • SHA256

    a8a1a9e80fd7d0ce85227bafd2ec004d2cb52d7e37744cd37bd3641c946822ef

  • SHA512

    508662d93c5b14f18aea08759f32f12a281161d5e3627dfd63447f2e1e3719c8acea15b9f35c52bc5ba99af67f486488c0c51a2203867b88731e9e65f03abe78

  • SSDEEP

    192:bV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2OcJWF8qa1Dojjgi:1qaCF31cix+Dc4zjbjFF46gi

  Score

  10^/10

  cobaltstrike0391144938backdoortrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  behavioral10behavioral11

• • Target

    e52067c5c5842359f70b1196fd0ed1b9e119ae8eb11408f2a08f0487dc2d21a6.exe

  • Size

    3.5MB

  • MD5

    65feff45a4140b9c22043e9227f7c978

  • SHA1

    49f2594e949e49cb97bc14ccddae177d1a890661

  • SHA256

    e52067c5c5842359f70b1196fd0ed1b9e119ae8eb11408f2a08f0487dc2d21a6

  • SHA512

    74f202cd05e0ee599c9405188d6817f59536e714550f667a8aee4a1614e6b420d60ec2322cba8b16f1c387f0c69821eca788e4a61a2a54ddf44d991639b127c4

  • SSDEEP

    98304:Rq7zb/x3ohSLwqyZimcnxTGwvsqXLhUe9eDL:wx3ohxqgcxTPpUeyL

  Score

  10^/10

  discoveryevasionexecutiontrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral12behavioral13