Extracted

Extracted

Extracted

• • Target

    RNSM00309.7z

  • Size

    2.2MB

  • MD5

    4e649bb49bbb535557a97f987259c701

  • SHA1

    f705f30ce7b16a957e88f24a7fe401fc489a07ef

  • SHA256

    1600aa05440a0e8020f0ac6624e9eb177b2c76b0fbdb8baff60fce1e5514fe77

  • SHA512

    7a4ca45e7f936fa43d5b69d31358bc105c1cf7f9fe9b404a83f36cdce940b6a18c16f005e06624abf4ebd031bf7942e23e46dbb8e2617eda47f250faf41c79ca

  • SSDEEP

    49152:pEqkI1iXTIV2Ah0RwzLoKJnD3kg2/S+sMqi0jeAjc1MTiKqbwy:pZiXTiYKtD2S+sMlhA9cbj

  Score

  10^/10

  lokibotnetwireremcoshostbotnetcollectiondefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Contacts a large (7712) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1