Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    keygen-step-1.exe

  • Size

    112KB

  • MD5

    c615d0bfa727f494fee9ecb3f0acf563

  • SHA1

    6c3509ae64abc299a7afa13552c4fe430071f087

  • SHA256

    95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

  • SHA512

    d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

  • SSDEEP

    3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeaeWgiZq:faZ1tme++wio

  Score

  10^/10

  azorultdiscoveryinfostealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult
  behavioral1behavioral2

• • Target

    keygen-step-3.exe

  • Size

    873KB

  • MD5

    265cadde82b0c66dc39ad2d9ee800754

  • SHA1

    2e9604eade6951d5a5b4a44bee1281e32166f395

  • SHA256

    40fd6a0b671a0e5074a206201f57f7731a0d01baab5874b28a9b0f019a451c5a

  • SHA512

    c99f3a5464e1ac02402814401c2cb66a9fafb794356395c1081bdf3c4c3534086498c19efe4055780a52a1bb80db81658c2cb4af5271015af51edf7bd3865e7b

  • SSDEEP

    12288:8jCwd+3hwSk5EYjUpfRNHpU1/QQ21fg7n7rOQm1/EMKK9kE8D2sMJnKhUGis5smD:8jC53hATU3NWSq7n7ry3Z62vn4b5HAl

  Score

  7^/10

  discovery

  • Deletes itself

  • Executes dropped EXE

  behavioral3behavioral4

• • Target

    keygen-step-4/Crack.exe

  • Size

    56KB

  • MD5

    7126148bfe5ca4bf7e098d794122a9a3

  • SHA1

    3fe6be3ee8bf1a0c99139b146913c8c6acd7dd64

  • SHA256

    f8c0350d71e5dd14438d477f73915c4845290c7f0620656624722183b76013f5

  • SHA512

    0bec6450d1be17489436de7a5186dbcb88089edd4227c3b5484460c9368e5ca0a2d88c385d31989f449a5d8cc347057c80a997682d6c0ed1b9cfcb85c677eb48

  • SSDEEP

    768:LMyTlenToDMTEp1Gjy76rM9QXPvRePLrlteelLh:LGEYT5y39QXHRErjlLh

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral5behavioral6

• • Target

    keygen-step-4/PBrowFile28.exe

  • Size

    1.8MB

  • MD5

    8902f8193024fa4187ca1aad97675960

  • SHA1

    37a4840c9657205544790c437698b54ca33bfd9d

  • SHA256

    95de484851569f225488320d573e398ebc2312b2d85b6c2b255b63b21aebb82f

  • SHA512

    c351204604cb24c45ddb26847a22f5487a2942ad2b2361dbd31ce0a308c281be91658907d7fe04b483f053b7f9b0c680cae11361709ba7552f7921e727241938

  • SSDEEP

    49152:kqq2BEim5e9JoNLPxZVwNKaLsJi2lZZ6:xYOoNLJk1Yf

  Score

  10^/10

  fabookiegcleaneronlyloggerdiscoveryloaderspywarestealerxmrigminer

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Fabookie family

    fabookie

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • OnlyLogger payload

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    keygen-step-4/Setup.exe

  • Size

    1.6MB

  • MD5

    7009fb80a52366b6c2cd8ec052a65791

  • SHA1

    db0894463edf3ac11e5ca4b4584e8f10d75810f6

  • SHA256

    767c546decf6f669263e4a0a87a0f5d92234e031e9a0de3733fa954a8f3e0255

  • SHA512

    26e50e4b3d0b5fe866423b9ae0c02f61882f632fe4a16c05da117c02fae9aea26a6c81458e4b0bc2bda8acd0407565132f8bd6b7d3e828dd90fc280b1f15f079

  • SSDEEP

    49152:IldcuFGnuxWiOuRg/iyFzb2QN83XfeYav:IldhGnuxWiOl/hNOmB

  Score

  6^/10

  discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral10behavioral9

• • Target

    keygen-step-4/f2217e5f.exe

  • Size

    270KB

  • MD5

    0388a1ce1bb8c076387b69ffcb3b40ec

  • SHA1

    3ec08a53ec024d9be6346440848c37d0e0d7bb80

  • SHA256

    448febc4311881856de2c237285907fe9470818e169946b0dbf1362f332e070a

  • SHA512

    ea5af764d0373c8b9a5faf6d7094c76c9c321e227713bceecd49df50fa888e8fd04b1dfe16c4b75a8727717582b06383825e5d4317db1b875951ee240edd71d5

  • SSDEEP

    6144:MUL2hXyOiNcsRx/wxqbeU5bpG2jre0vzUWop:/2hXpi6sRxjbeQbpG29vzUJp

  Score

  10^/10

  smokeloaderpub1backdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader
  behavioral11behavioral12

• • Target

    keygen-step-4/md1_1eaf.exe

  • Size

    991KB

  • MD5

    f250a9c692088cce4253332a205b1649

  • SHA1

    109c79124ce2bda06cab50ea5d97294d13d42b20

  • SHA256

    0a6c3a23510f93fcdcb6d5acc53ccccbcc51c68f14b1bcbd758ffbf135f8e882

  • SHA512

    80553664f188ae35cef1f89d188fb17df8a490367f8d6fa5f9897115bacf776373905bccd599353add684c7fa6c2554d04cbf1a7f6cc87b299d6c51da33c1b5e

  • SSDEEP

    24576:Eg8uQXK+F/bExmg5L0OiWQfWUWhElcAcF4N78D:1tQXKCqBL0XN8ZrfD

  Score

  10^/10

  ffdroiderdiscoveryspywarestealerevasiontrojan

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • FFDroider payload

  • Ffdroider family

    ffdroider

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral13behavioral14

• • Target

    keygen-step-4/ss.exe

  • Size

    100KB

  • MD5

    9a6071c1a67be3fb247f857fe5903bbf

  • SHA1

    4a2e14763c51537e8695014007eceaf391a3f600

  • SHA256

    01a9cb71df1d038bbec243ec7f2c1dd12d65a735297469c7f72be80886842e3c

  • SHA512

    c862ed8670b48e23b081e1c91280599ffdd963e714665b80553b41540cb3584c823a25f05c75e47eaea1473c687a9ef7c9a219d724d059e5bd77ac6d127f5e68

  • SSDEEP

    768:Ul73Z0pTqcoADKt1o0CkL8IF5gRsmDj5s7piwWWs333333333333333333333334:cXgKtES89jTVApkG

  Score

  1^/10
  behavioral15behavioral16

• • Target

    keygen-step-6.exe

  • Size

    267KB

  • MD5

    093bc5ebd2d2a39d84c1d35fbd2d9efa

  • SHA1

    e028ca17fe2c7cbf7ad234b28cd50ad2c7c440e5

  • SHA256

    ee2994ea7f202516db816f85f23aac0a13ec32743d0555f81d68568bb40f4811

  • SHA512

    da58e87b099d520f02715ffcf6b50e2a586b6baec5b64d5ee39fb4c4a81ee9b8c18c8e341ee8befcf9048088661d7f182a937a7948aacfac926f1710fa77bcfa

  • SSDEEP

    3072:zj2TWGwUnHdJzhuM67W+ZkYhvchGk9ICkxu1yxWjznBSGZBcPmSa1eTNlhWJYZoi:zGWinH8MvGKy8cP1WT/VHWpdN

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral17behavioral18

• • Target

    keygen.bat

  • Size

    149B

  • MD5

    0b2622826dd00820d5725440efd7d5f4

  • SHA1

    0a9f8675e9b39a984267d402449a7f2291edfb17

  • SHA256

    82723c93594b47e60cc855d7d113a09763bb4636330ff44bbbb949eb0fdcf54f

  • SHA512

    9f2ffa1065e7eeeda6a139ba1d85465cbb56a9be1419c90e599e604fc718244fc8b77b2bc46bbf3abba36e985b543c72d1e154e2d2d615c8519a9379e94804f3

  Score

  10^/10

  azorultdiscoveryinfostealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral19behavioral20