Static task
static1
General
-
Target
9626e81e0fe04bfaba1657d1594f5fae86d921956813a72d66faf4d6bdc08c55
-
Size
18.5MB
-
MD5
5f194907e35bb5ed727933f178a7ba4e
-
SHA1
f636326e8a1dbd187ce080a551ff02ec7e877f70
-
SHA256
9626e81e0fe04bfaba1657d1594f5fae86d921956813a72d66faf4d6bdc08c55
-
SHA512
eae51b473ad42f8333c3720ec8eee28068d17eac90d12c951780a76c92b008b84dfcd9967bb525a85d64838e2426e12e2acf31e8d74b7615086a6ff560411114
-
SSDEEP
196608:1lbGrJCRYsMmtOLkhG5QmLs9aQB8RnvgLe1hf2QeXH+4CxwlSBev8EINgdnLAayN:BTo
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
Processes:
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Detected Mount Locker ransomware 1 IoCs
Processes:
resource yara_rule sample RANSOM_mountlocker -
Detects Zeppelin payload 1 IoCs
Processes:
resource yara_rule sample family_zeppelin -
Gcleaner family
-
HelloKitty ELF 1 IoCs
Processes:
resource yara_rule sample family_hellokitty_elf -
Hellokitty family
-
Industroyer IEC-104 Module 1 IoCs
Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.
Processes:
resource yara_rule sample win_industroyer_w3 -
Industroyer family
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
resource yara_rule sample masslogger_log_file -
Masslogger family
-
Merlin family
-
Merlin payload 1 IoCs
Processes:
resource yara_rule sample family_merlin -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Mountlocker family
-
NetFilter payload 1 IoCs
Processes:
resource yara_rule sample netfilter_payload -
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule sample netwire -
Netfilter family
-
Netwire family
-
Remcos family
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
XMRig Miner payload 1 IoCs
Processes:
resource yara_rule sample family_xmrig -
Xmrig family
-
Zeppelin family
Files
-
9626e81e0fe04bfaba1657d1594f5fae86d921956813a72d66faf4d6bdc08c55