General
- Target 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03
- Size 37.7MB
- Sample241106-w29ecatrhw
- SHA256 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03
Malware Config
Extracted
-
privateloader
-
http://45.133.1.107/server.txt
-
pastebin.com/raw/A7dSG1te
-
http://wfsdragon.ru/api/setStats.php
-
51.178.186.149
Extracted
-
socelars
-
http://www.iyiqian.com/
-
http://www.hbgents.top/
-
http://www.rsnzhy.com/
-
http://www.efxety.top/
Extracted
-
nullmixer
-
http://marianu.xyz/
-
http://wensela.xyz/
-
http://mooorni.xyz/
-
http://sayanu.xyz/
Extracted
-
redline
-
media18
-
91.121.67.60:2151
-
auth_value
e37d5065561884bb54c8ed1baa6de446
Extracted
-
redline
-
Chris
-
194.104.136.5:46013
-
auth_value
9491a1c5e11eb6097e68a4fa8627fda8
Extracted
-
redline
-
fucker2
-
135.181.129.119:4805
-
auth_value
b69102cdbd4afe2d3159f88fb6dac731
Extracted
-
gcleaner
-
gcl-gb.biz
-
45.9.20.13
Extracted
-
redline
-
media20
-
91.121.67.60:2151
-
auth_value
e37d5065561884bb54c8ed1baa6de446
Extracted
-
redline
-
media25
-
91.121.67.60:23325
-
auth_value
e37d5065561884bb54c8ed1baa6de446
Extracted
-
redline
-
ChrisNEW
-
194.104.136.5:46013
-
auth_value
9491a1c5e11eb6097e68a4fa8627fda8
Extracted
-
redline
-
pub2
-
185.215.113.46:80
-
auth_value
4a9525ed658ab62eaade23fdc4f4da23
Targets
-
- Target 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66
- Size 403KB
- SHA256 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66
Score6/10Legitimate hosting services abused for malware hosting/C2
-
- Target 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef
- Size 4.7MB
- SHA256 4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target setup_installer.exe
- Size 4.6MB
- SHA256 07cf30eb7de3a5626ce499d5efdeba147c3c5bd40686cfc8727b4da7f9ab7d1a
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target 578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3
- Size 4.6MB
- SHA256 578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target setup_installer.exe
- Size 4.6MB
- SHA256 e94188908546b2f00a506d7596d3673b814ab62173967b3d258422877bc56f84
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target 9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782
- Size 3.6MB
- SHA256 9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782
Score10/10Detect Fabookie payload
Fabookie
Fabookie is facebook account info stealer.
Fabookie family
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
-
- Target setup_installer.exe
- Size 3.6MB
- SHA256 60e9b75ce4e3333d37a1b44348d3f9ae57bbab2130af8d0a44d8a5b09ce9f3bd
Score10/10Detect Fabookie payload
Fabookie
Fabookie is facebook account info stealer.
Fabookie family
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
-
- Target a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4
- Size 4.4MB
- SHA256 a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target setup_installer.exe
- Size 4.3MB
- SHA256 ecb5c8cb5411d3c5aa5bc7b5138fe50cb5ded78484fcd5a5c88b56f249d7d1e0
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0
- Size 3.5MB
- SHA256 acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0
Score10/10Detect Fabookie payload
Fabookie
Fabookie is facebook account info stealer.
Fabookie family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
-
- Target setup_installer.exe
- Size 3.4MB
- SHA256 043d28836fc545b0c6daf15ed47be4764ca9ad56d67ba58f84e348a773240b9f
Score10/10Detect Fabookie payload
Fabookie
Fabookie is facebook account info stealer.
Fabookie family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
-
- Target cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2
- Size 5.6MB
- SHA256 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2
Score10/10Detect Fabookie payload
Fabookie
Fabookie is facebook account info stealer.
Fabookie family
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Suspicious use of SetThreadContext
-
- Target setup_installer.exe
- Size 5.6MB
- SHA256 318af6913b0c34dd5183c80569604d8366e052de015aa3f428f89f98dfcec448
Score10/10Detect Fabookie payload
Fabookie
Fabookie is facebook account info stealer.
Fabookie family
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Suspicious use of SetThreadContext
-
- Target db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12
- Size 4.6MB
- SHA256 db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target setup_installer.exe
- Size 4.6MB
- SHA256 5aa8a219a096bcf847a56a8066721257823414a098cdcdfeb39b9bd07bb0776e
Score10/10GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
Gcleaner family
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
Nullmixer family
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
Onlylogger family
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Privateloader family
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
Raccoon Stealer V1 payload
Raccoon family
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Sectoprat family
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
Socelars family
Socelars payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Blocklisted process makes network request
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops Chrome extension
Legitimate hosting services abused for malware hosting/C2
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Suspicious use of SetThreadContext
-
- Target e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6
- Size 834KB
- SHA256 e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6
Score10/10Detects PseudoManuscrypt payload
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
Pseudomanuscrypt family
Suspicious use of NtCreateUserProcessOtherParentProcess
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1