Overview

overview

10

Static

static

10

Resubmissions

27/05/2025, 19:20

250527-x2bnraep6t10

11/03/2025, 16:30

250311-tz8zpaxrz210

11/03/2025, 16:06

250311-tkc9gaxm1610

11/03/2025, 16:06

250311-tj3sqsxm1310

10/03/2025, 17:34

250310-v5yatasnz910

20/02/2025, 10:50

250220-mw8festjaz10

20/02/2025, 10:49

250220-mw12cavpw610

16/02/2025, 02:33

250216-c1244ayjc110

16/02/2025, 02:26

250216-cw6xgsxldq10

12/02/2025, 14:54

250212-r9zgwswmej10

Sharing

Copy URL Twitter E-mail

Errors

Reason
config extraction: IcedidFirstLoader: EOF

General

  • Target
    beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
  • Size 8.5MB
  • Sample250211-behmwstpdv
  • SHA256 beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
loaderguloaderratransomwarerezer0minerblacknetblisterguloaderloaderbotmimikatznetfilternetwirepseudomanuscryptquasarroyalxtremeratzeppelinkandykornhellokittymassloggermerlinmountlockernefilimsodinokibixmrigdridex

Malware Config

Signatures

  • BlackNET payload 1 IoCs
  • Blacknet family
    blacknet
  • Blister family
    blister
  • Detect Blister loader x32 1 IoCs
    loader
  • Detect KandyKorn payload 1 IoCs
  • Detect XtremeRAT payload 1 IoCs
  • Detected Mount Locker ransomware 1 IoCs
  • Detects PseudoManuscrypt payload 1 IoCs
    loader
  • Detects Zeppelin payload 1 IoCs
  • Dridex family
    dridex
  • Guloader family
    guloader
  • Guloader payload 1 IoCs
    guloader
  • HelloKitty ELF 1 IoCs
  • Hellokitty family
    hellokitty
  • Kandykorn family
    kandykorn
  • LoaderBot executable 1 IoCs
  • Loaderbot family
    loaderbot
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Masslogger family
    masslogger
  • Merlin family
    merlin
  • Merlin payload 1 IoCs
  • Mimikatz family
    mimikatz
  • Mountlocker family
    mountlocker
  • Nefilim family
    nefilim
  • Nefilim ransomware executable 1 IoCs

    File contains patterns typical of Nefilim samples.

  • NetFilter Dropper 1 IoCs
  • NetFilter payload 1 IoCs
  • NetWire RAT payload 1 IoCs
    rat
  • Netfilter family
    netfilter
  • Netwire family
    netwire
  • Pseudomanuscrypt family
    pseudomanuscrypt
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Royal Ransomware 1 IoCs
    ransomware
  • Royal family
    royal
  • Sodinokibi family
    sodinokibi
  • Sodinokibi/Revil sample 1 IoCs
  • XMRig Miner payload 1 IoCs
    miner
  • Xmrig family
    xmrig
  • Xtremerat family
    xtremerat
  • Zeppelin family
    zeppelin
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

File Explorer

  • beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
    8.5MB

beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9

  • SHA256 beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
  • MD5 SHA1 SHA512 SSDEEP

  • BlackNET payload

  • Detect Blister loader x32

    loader

  • Detect KandyKorn payload

  • Detect XtremeRAT payload

  • Detected Mount Locker ransomware

  • Detects PseudoManuscrypt payload

    loader

  • Detects Zeppelin payload

  • Guloader payload

    guloader

  • HelloKitty ELF

  • LoaderBot executable

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • Merlin payload

  • Nefilim ransomware executable

    File contains patterns typical of Nefilim samples.

  • NetFilter Dropper

  • NetFilter payload

  • NetWire RAT payload

    rat

  • Quasar payload

  • Royal Ransomware

    ransomware

  • Sodinokibi/Revil sample

  • XMRig Miner payload

    miner

  • mimikatz is an open source tool to dump credentials on Windows

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Patched UPX-packed file

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.