Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00380.7z

  • Size

    16.4MB

  • MD5

    d52392253e837d87a4d550b3b0e17ebb

  • SHA1

    f11f1b17d06b749034346cdddac52007aca54926

  • SHA256

    c019141bc3d483634d38672e50660478aa452db9066da062e72cd099a7d4937a

  • SHA512

    a79021e35a83223e47371f9468ecba168dcb02b806a7d2b97a0e915047d8249cc9c78766f3abfec25d50241ec96356f5d3bd4588ce2bc05e92d27318ea96f6e1

  • SSDEEP

    393216:8Iy7MoOupjBZ1VPIIwiV2NQVk9V0J0vTIdwJ1KXtaGXPJ1:Zy7MPuRvTPzYD957Id6ikWJ1

  Score

  10^/10

  agentteslaazorulthakbitmazezgratdefense_evasiondiscoveryevasionexecutionimpactinfostealerkeyloggerransomwareratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect ZGRat V2

  • Disables service(s)

    evasionexecution

  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit

  • Hakbit family

    hakbit

  • Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze

  • Maze family

    maze

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Zgrat family

    zgrat

  • AgentTesla payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Contacts a large (1609) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1