Extracted

• • Target
    Nuker 1.2.exe
  • Size 6.0MB
  • SHA256 7fd20dd1ce4c8e54f077ef9880dd8794158fc2406d66b7656e239f798eacfeee
  • MD5 ea52bb50895e85eba81d29a84318cb62
  • SHA1 198d852c2baf2304e44da82e4ba74d591cf31776
  • SHA512 8bbc5061f167f36deea84a909e1df87ac67a53e04195874f6892b73b37a0a79285ed945ae509972721a85c0df1cf5207486978ba870965810d9de8014e87f0f7
  • SSDEEP 98304:UAmoDUN43W5NjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6ag1Rjtj4:UAumWDOjmFwDRxtYSHdK34kdai7bN3mz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  upxredlinesectopratmamutcollectioncredential_accessdefense_evasiondiscoveryexecutioninfostealerpersistenceprivilege_escalationratspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    �r� �_.pyc
  • Size 857B
  • SHA256 98eb1fad7ffe9370ab327db1b8669da78e38a15efcf83f39444a0860eec4f05d
  • MD5 17329d1b9218461171654c85ce0b28f0
  • SHA1 0900a4f3014fc31055b776a06c8a773894fcbf1c
  • SHA512 1886767d399a078c62835659bea9dbb74cb85ab1bce8aeaf17dbe46a765fdd12333fd05803f302fe6a91b2d2890ceef2a56c54a42bf6a65c867da4b95999c3ee
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral3behavioral4