Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    4363463463464363463463463.zip

  • Size

    4KB

  • MD5

    ef8cefd3add0abb43471ade5c7c0e5cb

  • SHA1

    37d88e8a6a8bff50c40dee86ffdf2963b85a6cb6

  • SHA256

    d9effa261325842f2c4a3eab4af0b32ef4184af057ab10a6f571756acca51258

  • SHA512

    9de9f6841b9cbbec637668708cf36b1a2ed59ad0ed364763b4b3f67d046b2057f084a9a0ded95d22677c9beec9b818d287c474c856af02b1a3e2a8eadf4d8c07

  • SSDEEP

    96:3Bf1inGx9SfZ+VCv3wlTDMQ1kyKXyyJNOBIKkNvL5qK+7zHf6MlYOQVPGmcEQ:3BfwncSf8Cv3w9DZjKXjmBIKEvLs97DX

  Score

  10^/10

  asyncratgh0stratjigsawphorphiexquasarredlinexmrigxwormzharkbotdefaultnewbundle2testbotnetdiscoveryevasionexecutioninfostealerloaderminerpersistenceprivilege_escalationpyinstallerransomwareratspywarethemidatrojanupxvmprotectworm

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Detects ZharkBot payload

    ZharkBot is a botnet written C++.

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Jigsaw family

    jigsaw

  • Modifies security service

    evasion

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot

  • Zharkbot family

    zharkbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Async RAT payload

    rat

  • Renames multiple (1000) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1