Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    1dd26b1cd62aea1dd09f03541dc05448cc215e18

  • Size

    8.9MB

  • MD5

    6f36bb5a55e529c45eaff76ec91f1949

  • SHA1

    1dd26b1cd62aea1dd09f03541dc05448cc215e18

  • SHA256

    13bb0e481be407e8244a6c1f5b0be8a436d433040e2be69f5d27f5922aa2882c

  • SHA512

    e503f5809bb988a863ccb4e4674fe3dc191a49c03909f36d0d2dc4a7feeda6b17c69c2cda41a86bf839e59645248e7f1176bd4489b7d4af21bb18fa91a7670a0

  • SSDEEP

    196608:JHdWOynKXKz9zqngdwRI8jCqNlZcv3GscUTZXT0+pkU0X5J:J9WOynUKz9zqgd/ulKvcUTZXMUE5J

  Score

  10^/10

  fabookiegcleanernullmixerredlinesmokeloadersocelarspub3supertest2012aspackv2backdoordiscoverydropperexecutioninfostealerloaderspywarestealertrojanvmprotectsame1evasion

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Fabookie family

    fabookie

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Nullmixer family

    nullmixer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars family

    socelars

  • Socelars payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops Chrome extension

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    setup_installer.exe

  • Size

    8.9MB

  • MD5

    3b9cfea9ed7c16c3f27df255da4baf9d

  • SHA1

    b7f3f6f1c6e0e2a596b31e242fffced8e3d0c516

  • SHA256

    388485cce05113764a70a4d24cbccc85ee63bbe8159dd638f3f307c8c3d2dcf5

  • SHA512

    5341e023db4209af75473ba730159e5ad8f226733208977455ff86acae8f64b5ed1a46b43c6cceda1b81e78958a5acc77fe874f32a0634fbab20d26616b8022a

  • SSDEEP

    196608:x5kWHY2+T/CohKJTWpCagmfiMIzMRFzQZeA3VOoeMOD:xyWHY2CCiniMLzGFHdOD

  Score

  10^/10

  fabookiegcleanernullmixerredlinesmokeloadersocelarspub3supertest2012aspackv2backdoordiscoverydropperexecutioninfostealerloaderspywarestealertrojanvmprotect

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Fabookie family

    fabookie

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Nullmixer family

    nullmixer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars family

    socelars

  • Socelars payload

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4