Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    The-MALWARE-Repo-master.zip

  • Size

    121.3MB

  • MD5

    be2f06e08241e418152c6ce91176085b

  • SHA1

    145e7527506be10c6f25e7b3c231ccc38f044bee

  • SHA256

    c738c78fd727e661119899099f61ada68dd59df7c9b66c0810f4549a906a6c8f

  • SHA512

    cd86644e1875ee4b48c6c233a45e5a0516e1a8515b6b86973c8dfcc53a0caf74cbfab6ebb819f61c109310153aeed112cb0fa7dee0e04317613dc5f26f5a7a23

  • SSDEEP

    3145728:wNl3aFs1C4SA2hlHf9Rfi5xuT+FAiilgJcPdlwCzCLfH:wNl3aFW2h9/fiqaiiilpwCzCL/

  Score

  10^/10

  cryptolockerbootkitdefense_evasiondiscoverymacromacro_on_actionpersistenceransomware

  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Cryptolocker family

    cryptolocker

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1

• • Target

    The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe

  • Size

    2.7MB

  • MD5

    48d8f7bbb500af66baa765279ce58045

  • SHA1

    2cdb5fdeee4e9c7bd2e5f744150521963487eb71

  • SHA256

    db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

  • SHA512

    aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

  • SSDEEP

    49152:bbevayZlMTWkygVy0nQZfVY2BtZzpPL4PuQ65+6Dv7m0KXTn:bbexZlMQcEVY2BtZzpPL4WQI9U

  Score

  10^/10

  danabotbankerbotnetdiscoverytrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot family

    danabot

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral2

• • Target

    The-MALWARE-Repo-master/Banking-Malware/Emotet.zip

  • Size

    102KB

  • MD5

    510f114800418d6b7bc60eebd1631730

  • SHA1

    acb5bc4b83a7d383c161917d2de137fd6358aabd

  • SHA256

    f62125428644746f081ca587ffa9449513dd786d793e83003c1f9607ca741c89

  • SHA512

    6fe51c58a110599ea5d7f92b4b17bc2746876b4b5b504e73d339776f9dfa1c9154338d6793e8bf75b18f31eb677afd3e0c1bd33e40ac58e8520acbb39245af1a

  • SSDEEP

    3072:N3HIYWf7q41qPhYhIYCjvqSrBlh2iui/EJEZ6yQ:N3HfWf75qPhYhIdjvqS4McJIW

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  behavioral3