Extracted

• • Target

    0eac1dd90fbafb505a3b627d166d9ef62db4e2df68da9bbc2e39db0573ecd00d

  • Size

    358KB

  • MD5

    350b0557936a6ed2d688f895cbbd50ad

  • SHA1

    1f6469a384f9af3489a189a8331d82cda0ec6613

  • SHA256

    0eac1dd90fbafb505a3b627d166d9ef62db4e2df68da9bbc2e39db0573ecd00d

  • SHA512

    6bacfa711c5dba242a4da1307153f0d423151fd6e5281f85f05ad64fc14b065275075992049d3e678591dcb51bd9b12d478bd7d04318d36c79c5b5a76fd11efb

  • SSDEEP

    6144:k9AZdOmF2ry5xxRG5YJyZyz8JsK1et+IFWBzMdNDlXK4tDk:9vB7sEeHZ2+3IjUAI

  Score

  10^/10

  neshtadiscoverypersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2

• • Target

    119f9287f46d3ed3888403c3c21054974a0e8926ef247fc065164a8d58303c9c

  • Size

    2.4MB

  • MD5

    d4bfc09f4e75c9eef1ead04768aaabc9

  • SHA1

    7b9fe73a44da7b5b7b1c8743b8227e07723c8175

  • SHA256

    119f9287f46d3ed3888403c3c21054974a0e8926ef247fc065164a8d58303c9c

  • SHA512

    345a4248cedf541acb667925893db6d3660102ee9e5df9086d69cd03719e038f3f7fae01f1b7a21235a7b57ad2aa49c0d044db793eb2ac9a509e9f355d2a81a6

  • SSDEEP

    24576:WNisxv4HA62oNMBzF0MkcFRGP4/G/iE/K3LI7DE3Q1V+Z02cyxxGj:CisqNAz2sGPYspK393bZ02cyx6

  Score

  10^/10

  redlinesectopratbuild4discoveryinfostealerrattrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    202588cc1d6cebb32b5888f7e9bbbfa9aa1d5e3ab6a116892cb90486ac4e7d10

  • Size

    4.6MB

  • MD5

    c7620b77d05f9dac8105469b7d0c854f

  • SHA1

    5368819b5aa8db1ee7f5cc5b4b50ecb6aa6faf55

  • SHA256

    202588cc1d6cebb32b5888f7e9bbbfa9aa1d5e3ab6a116892cb90486ac4e7d10

  • SHA512

    0fb1e57e2fd053bacbba7a0aabc00c162432c33a9332bac2c45036173fccbe5bebc2906568d2facea4fcf0963dcfcb557bff932dbb2dc2ec5b8cd736213101d3

  • SSDEEP

    98304:I1qaURDb8PNfMVNnlqKL0T/46KhPLQYVVW4G1jOUc/hItwGn:I1zsf8PNfkl/m4zdLQYPZGNI/hmVn

  Score

  10^/10

  evasionexecutionpersistencetrojan

  • Modifies Windows Defender notification settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral5behavioral6

• • Target

    28b51218b1f1a5250f851180c3bca3c79397a9fc36089a2e356f45b667881209

  • Size

    4.6MB

  • MD5

    6c8e7b9edb130c9dab130f66f9bad1c3

  • SHA1

    332e1d7efdf2dc5ecaf6349db417f143b48d60e3

  • SHA256

    28b51218b1f1a5250f851180c3bca3c79397a9fc36089a2e356f45b667881209

  • SHA512

    74998f93ff487d554c7734e5e7be148a0811d71164447c2a6816469338cc1b00b201e28b2ae01aa3162f63f8908782626206d84a8d62bb64960d0aa8ef38f6c3

  • SSDEEP

    98304:N1Mie3EZD4qxp6QQ7Xs/Vd28BfkFsIjfxVFms:N17ZDxpFQ7XYZfkFsEf8s

  Score

  10^/10

  evasionexecutionpersistencetrojan

  • Modifies Windows Defender notification settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral7behavioral8

• • Target

    583c56547b1a00fcb4c0f4920998e0c0ee812691c2bfae7a643dab639e7faa6a

  • Size

    957KB

  • MD5

    d4c108f52d1ab06f96ce081199bcfb31

  • SHA1

    3cf70a986e72b14bdd11e51625a4e81e6b8bf789

  • SHA256

    583c56547b1a00fcb4c0f4920998e0c0ee812691c2bfae7a643dab639e7faa6a

  • SHA512

    2dd84482f2c38120d4b4e29565b1bdaf27844f5797bc469e20196cba65a822ec9e26b4e07b5a505b310b034f0539f21e24f5b525d2fe116e95e9566a7503fa44

  • SSDEEP

    24576:EQSyyuBxEdF4cbi1mKp4JCZQ5vabA8JEFn:1VEdFnU4CZJI

  Score

  3^/10

  discovery
  behavioral10behavioral9

• • Target

    73782bd2a7e22ad9b0cf75db952caac03b1db76549dfa8d79d68af50056359e8

  • Size

    753KB

  • MD5

    c2cdc14235b70d09dbad55af6202d7eb

  • SHA1

    72145ec4baac4c0839c409a028aa473a7403673b

  • SHA256

    73782bd2a7e22ad9b0cf75db952caac03b1db76549dfa8d79d68af50056359e8

  • SHA512

    b1bd8d30c399ef18b2cc473778ab26b9489dec6cbe1b921b043fdaa3bd99a4e6796be1db5f02490da606cf48096c9b538e47fd6422c93084d1774688095086e7

  • SSDEEP

    12288:w3rHcIck2bHbGVItlponOR0dHc3mlasg1wvIVtfBl858QFGBqM8f:w3BwO1nDH2BXrk58QFmEf

  Score

  10^/10

  discoveryevasionpersistencetrojanupx

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral11behavioral12

• • Target

    d279fb4121b6a7e552133823a497b4d2502b1494bc0864e2c8689fe92eef7fd7

  • Size

    32.2MB

  • MD5

    cb3eb826c1c6e385209f0be254c03dfc

  • SHA1

    abbf755333db672605802aa1ebaf3b1f2f0fdb6b

  • SHA256

    d279fb4121b6a7e552133823a497b4d2502b1494bc0864e2c8689fe92eef7fd7

  • SHA512

    b448c6fbd518cc3e146974b3f823412caa5229a3971c15a7d445b30a6ef8a92eb5e1db43e53ad0fa8c03705fc3ac0eea66b458108b11aff3d082e864a1f580b8

  • SSDEEP

    786432:BzH0kJTHa3EEITUJRAikwZbvQBnOtNsf2jd8AwvDkQ7rt3A+6x:BNFarIIGirZDAZf2j+LDl7rtY

  Score

  10^/10

  floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

  • Floxif family

    floxif

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Detects Floxif payload

    backdoor

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral13behavioral14