Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    setup_installer/Wed0901eb1dae126e32.exe

  • Size

    401KB

  • MD5

    199dd8b65aa03e11f7eb6346506d3fd2

  • SHA1

    a04261608dabc8d394dfea558fcaeb216f6335ea

  • SHA256

    6d5f838b8826f5fcfc939db18f02b7703b37f9ecab111bda1aeca6030dd3aa13

  • SHA512

    0d28ba3232fac0caccc63c0b287ddd81bbc8493d8ec6d90b74f6a3d490903efb2e561cb62e6c9bae94f3bf81d6b298f72c02475f13b775312541ea579e2c4228

  • SSDEEP

    12288:hHQgV1Jp/BGdA5wjdik1RBZscArkSN4dDEvXqX2:hwqJc

  Score

  10^/10

  redlinechrisdiscoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    setup_installer/Wed094c47c32b.exe

  • Size

    1.3MB

  • MD5

    b5cfd3a9dc9e645e24c79991bca60460

  • SHA1

    0d6bcdca2121d279bbe87c66cab515ac2478f555

  • SHA256

    852bffb94dbd3ed18ac11311b701ee80400209a19b3660b544146b41fa3b9768

  • SHA512

    55861773c758e5f3cc7440d012d820892f7b9155b542baeab940a8c80fd50ffd1001fca6f9f9dae7eca3ae53919eba795aca53d5bb3aaaf29a111acd016d24e6

  • SSDEEP

    24576:4ny/f9u3poiauUTvKptPMfEd4tic/3wFzUm72uuQ2HrvcFM71J7d2SMpBcBuAKlm:BFpxuUTSMNtPgJUmiQ2H9jkSpceGU

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Blocklisted process makes network request

  behavioral3behavioral4

• • Target

    setup_installer/Wed096a1bff61.exe

  • Size

    8KB

  • MD5

    c4d0ec0c74d01acc7135e8045630b182

  • SHA1

    d954fa19b63df6062c013093ed22f8dc5218c48b

  • SHA256

    8d3586126ec20da9b63930b9995d9ad9826540a71fb958431b73ff48ff6b18e2

  • SHA512

    7cc8d2d033447eed31a1ccab040a4b52803f483d7957c488ad2165db4a308b5cf84f8e2420717436bb146e6e5d33b5d65a53b2381e3caec14b092562b940a9ed

  • SSDEEP

    96:kJOElmu1B9ilJJMOfEkdEKozt1F4fCxcqkTzNt:cLkJwGE3F4r1

  Score

  1^/10
  behavioral5behavioral6

• • Target

    setup_installer/Wed0971f17486f8.exe

  • Size

    390KB

  • MD5

    83be628244555ddba5d7ab7252a10898

  • SHA1

    7a8f6875211737c844fdd14ba9999e9da672de20

  • SHA256

    e86ad9f9c576959b71ef725aaf7d74c0cf19316e1afbda61a8060d130e98fb3f

  • SHA512

    0c09cce580cd0403191a3944f37688c079d79a21dccb014ac748620835eac542a5327a4e325a3dab0cd6c3bd0db6cb523f51bd05b027596e0b8199d0503b78e2

  • SSDEEP

    12288:iQofVEJpvBG6b59bZVJI6REjEnOgydDETXe9Gss:TTJ16

  Score

  10^/10

  redlinemedia26discoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    setup_installer/Wed09977fdc12334.exe

  • Size

    125KB

  • MD5

    6843ec0e740bdad4d0ba1dbe6e3a1610

  • SHA1

    9666f20f23ecd7b0f90e057c602cc4413a52d5a3

  • SHA256

    4bb1e9ad4974b57a1364463ca28935d024a217791069dd88bedccca5eaad271a

  • SHA512

    112a327b9e5f2c049177b2f237f5672e12b438e6d620411c7c50d945a8a3d96ec293d85a50392f62651cdf04a9f68d13d542b1626fb81b768eb342077409d6d3

  • SSDEEP

    3072:opLxpeJYmCJZ/QXhdH4QzzMx0JwqFsM76bNbcOvuMaDw4e7dA/rhfL9tG:qeW0hl5zwzM7ROvuMaHJt

  Score

  6^/10

  discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral10behavioral9

• • Target

    setup_installer/Wed09abf83d9c2.exe

  • Size

    89KB

  • MD5

    03137e005bdf813088f651d5b2b53e5d

  • SHA1

    0aa1fb7e5fc80bed261c805e15ee4e3709564258

  • SHA256

    258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd

  • SHA512

    23bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd

  • SSDEEP

    1536:4ZxrW2eq7mQeNzn26jO0+7I+LeScuT1Gd5anG7IW1V7hYxamr+s8jcdMTWsM/D:4bEZQC26S0+7NeSrTcTanGEWLh477MTI

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral11behavioral12

• • Target

    setup_installer/Wed09b2a8bc4f16cb.exe

  • Size

    321KB

  • MD5

    94d45a7ff853b3c5d3d441cf87a71688

  • SHA1

    3327a1929c68a160ef6287277d4cff5747d7bb91

  • SHA256

    172362b2f1f5dca51f1520fc186c1e67c7002f924420c5828b90e099e96b0476

  • SHA512

    14d60e3dec00bb95d1ac35b85c4a63aef3f0157a783c79284b874691b14fc73480f34fc95e09a1e4f9a830ed73addbccb21fe99e5a8b7f3c9f6300ae21cca88f

  • SSDEEP

    6144:HGxNBYU+iYJ5WWlFhY4yhsvPxP5Ji1HvmdgA/uA:cBYU+iE5DlFhY4yhsvPxGNv6gan

  Score

  10^/10

  smokeloaderpub5backdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader
  behavioral13behavioral14

• • Target

    setup_installer/Wed09b3a5ca1a712d390.exe

  • Size

    63KB

  • MD5

    1c80f27a97ac4ce5c1c91705e0921e5a

  • SHA1

    23b8834a95a978b881f67440ceef1046d3172dd1

  • SHA256

    5f3d434aa99f8e88b605495e49588a87fd0aacd47092f149ff795ae983b81ae1

  • SHA512

    31bbd0054559111b8bdbdb89947e02029d1dbe8180996ad16dc732fa317b22a2a56d782f3f563f6261e14c66fae3f4603721d473a3ec2b22470ac971edff0702

  • SSDEEP

    768:qZVzklgF8dGIgRH1X4QE6acJl09JEr0tbzmq5wFL+2PhNagN18z+dcYzKRKYUD56:MOBSHN4QFacJmWr0X5wBafz+dDzKoSu

  Score

  6^/10

  discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral15behavioral16

• • Target

    setup_installer/Wed09c42cad92c20f79.exe

  • Size

    421KB

  • MD5

    48c91156511d520353b21c4df6253944

  • SHA1

    a5fffe608205c897fea58541ae844d30a2fa4a0f

  • SHA256

    bb8872a748020b855eacb3df80cc431edf7104a4bdd3805f0a8bb31341cb3b92

  • SHA512

    fb95ccf301d3461232d436070ef0710f57137860e63285eaff25ef3f22e5e381278ece8c1a6a52d889ae5a80316a7c41d4176311d32aa1034866bc91a973deaa

  • SSDEEP

    6144:ieYFPNS99AlAKfp6fgMUhcVxyK90h4QSAmTdNWlrdJhMRUeERyQbPawZd1YoM:clBf2Uh9OCmLorfhMRUeERy3+d1fM

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral17behavioral18

• • Target

    setup_installer/Wed09cfb2f9758281d8.exe

  • Size

    362KB

  • MD5

    dcf289d0f7a31fc3e6913d6713e2adc0

  • SHA1

    44be915c2c70a387453224af85f20b1e129ed0f0

  • SHA256

    06edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5

  • SHA512

    7035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca

  • SSDEEP

    6144:FFTcfqsL9FV/NzaTCoJZrrWkPsMAtexET4ftYDIy8+Dxxs:bcfq6B5oBrfPsMAtexhfteIa

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral19behavioral20

• • Target

    setup_installer/Wed09d27135e5a8b3b.exe

  • Size

    379KB

  • MD5

    9b07fc470646ce890bcb860a5fb55f13

  • SHA1

    ef01d45abaf5060a0b32319e0509968f6be3082f

  • SHA256

    506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b

  • SHA512

    4cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc

  • SSDEEP

    6144:6/QiQPMzDY39EiBeNyz9P8S9vkOQ/UBTlakaBdGOzGfnXpiQCsoazZPElpMQgqok:CQiGMwNEiBePS9v+MBTlPadSfXioRcpn

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral21behavioral22

• • Target

    setup_installer/Wed09d8d6edfaff2ac.exe

  • Size

    126KB

  • MD5

    003a0cbabbb448d4bac487ad389f9119

  • SHA1

    5e84f0b2823a84f86dd37181117652093b470893

  • SHA256

    5c1df1c4542e2126a35d1b2ed8cb50482650e1aafa18e1229bcfb22ea49ca380

  • SHA512

    53f9b6dbe2aac2c6148b4d0072129977755cc4de9f5d558ce5bbf08bcf07dd9bcfeb02fecc52dfb94ae6cb8d7c48f09e36626581fe2cb6e353b1f7d7f2e30f02

  • SSDEEP

    3072:cYcvhNpnPpJZ/gXhNH4QzzMx0JwqFsM76bNbcOvuMa8w4e7dA/3Whfk9WG:cxkhV5zwzM7ROvuMalOW

  Score

  6^/10

  discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral23behavioral24

• • Target

    setup_installer/Wed09db0d52c38.exe

  • Size

    1.4MB

  • MD5

    5810fe95f7fb43baf96de0e35f814d6c

  • SHA1

    696118263629f3cdf300934ebc3499d1c14e0233

  • SHA256

    45904081a41de45b5be01f59c5ebc0d9f6d577cea971d3b8ea2246df6036d8a9

  • SHA512

    832c66baff50e389294628855729955eb156479faa45080cba88ece0ee035aeef32717432e63823cbb0f0e9088b90f017a5e2888b11a0f9ede2c9ff00f605ed1

  • SSDEEP

    24576:oop4e+P7hGI5Yn3H4pIkOIkWsRhehSrob1gBckkcf6XKYQcjxW:xpQcZ62sa9kk6XKYQcdW

  Score

  10^/10

  socelarsdiscoveryspywarestealer

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars family

    socelars

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops Chrome extension

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral25behavioral26

• • Target

    setup_installer/Wed09e95ff6b5.exe

  • Size

    846KB

  • MD5

    c9e0bf7a99131848fc562b7b512359e1

  • SHA1

    add6942e0e243ccc1b2dc80b3a986385556cc578

  • SHA256

    45ed24501cd9c2098197a994aaaf9fe2bcca5bc38d146f1b1e442a19667b4d7b

  • SHA512

    87a3422dad08c460c39a3ac8fb985c51ddd21a4f66469f77098770f1396180a40646d81bdae08485f488d8ca4c65264a14fe774799235b52a09b120db6410c5a

  • SSDEEP

    24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaOaT5:bh+ZkldoPK8YaOW

  Score

  3^/10

  discovery
  behavioral27behavioral28

• • Target

    setup_installer/Wed09f257bb7877d00b2.exe

  • Size

    1.3MB

  • MD5

    bdbbf4f034c9f43e4ab00002eb78b990

  • SHA1

    99c655c40434d634691ea1d189b5883f34890179

  • SHA256

    2da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae

  • SHA512

    dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec

  • SSDEEP

    24576:X/mj8gr6siw8y8KbE0N4TMAeulQI1N6y83bMJb2dtGulJe:XOjH7iby84E0aTrlQcNkbYidv

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral29behavioral30

• • Target

    setup_installer/libcurl.dll

  • Size

    218KB

  • MD5

    d09be1f47fd6b827c81a4812b4f7296f

  • SHA1

    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

  • SHA256

    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

  • SHA512

    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

  • SSDEEP

    6144:Kk3jgivfCVSRrLV7yAVzKZIjCbanUKWw+ba//PXHUo:30iH0iVPVzKOOunLWf2//0

  Score

  3^/10

  discovery
  behavioral31behavioral32