Extracted

Extracted

Extracted

• • Target

    quarantine/27JinXS.exe

  • Size

    1.8MB

  • MD5

    36e536a514745cab05f83cbe5f4a412e

  • SHA1

    befb59b14249e5f240bb80281f1a14663438b126

  • SHA256

    539b89630bf205ece9a5e8e8a1326534c5a39dc511839c68ecb99ef9f5a97715

  • SHA512

    63245e2771ce4118f3a51a5d0d87cec398838389e56ad7783299cd21b98f5f5b33dcf99ca015f68b30d9349e94c8cfc1e7ad40ec67f8db2766d38c94202ab88f

  • SSDEEP

    49152:t08XQzvwAeSbDRSBrpRXGEfe1KDe241I0cxcV:t08gfeS4BrnWEfe1KDe24qzxy

  Score

  10^/10

  amadeysystembca4d2cddefense_evasiondiscoverytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    quarantine/DVaKyq7.exe

  • Size

    339KB

  • MD5

    75728febe161947937f82f0f36ad99f8

  • SHA1

    d2b5a4970b73e03bd877b075bac0cdb3bfc510cf

  • SHA256

    0a88c347a294b22b6d6554b711db339bca86c568863dec7844a2badec6ef4282

  • SHA512

    7cfdf76b959895ae44abe4171662d9c6c28dfd444030d570fea0fa4f624adf226e35d655dd89b159a1e0d08bcd97dfe899c3646d7682aacf5f2dabfbdf3d9a67

  • SSDEEP

    6144:WHYaosINWXFGYJabd0UyB8kOKWAKo1Ze7OwEK/MNt8lEdgxbuZm/uPEMCfwoZH:WHH9INsFF4R0UyBSKW0lK/MNWqdgJuYP

  Score

  5^/10

  discovery

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    quarantine/FydOzyQ.exe

  • Size

    532KB

  • MD5

    231c20b0fbf247fb166c6c0ef7bb268d

  • SHA1

    a7d5d46ece3fe59238b9df17d230c2e0354f9773

  • SHA256

    3743b3270450dad9fbf2b4a16fdd7fe4a3d1d171720ea738401e467205041f80

  • SHA512

    9382a6359d777ff8c0877a47204acb149f96f9fe40f0514ad1ea98374a1a9173f5b2b2918db3eba095f59548cec3fa704c06c40f246ae6dd3c4e8d20d27523d1

  • SSDEEP

    12288:DL2of9uNKPZnu3eqJS+fg4QqHH9INsFF4R0UyBSKW0lK/MNWqdgJuYuPE9o5:HkM+fjQid93PblKUNWt4YC

  Score

  7^/10

  discoveryspywarestealer

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    quarantine/mAtJWNv.exe

  • Size

    350KB

  • MD5

    b60779fb424958088a559fdfd6f535c2

  • SHA1

    bcea427b20d2f55c6372772668c1d6818c7328c9

  • SHA256

    098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

  • SHA512

    c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

  • SSDEEP

    6144:eB2ofI2u6ukzPZnu3eb+JZAZBefgAvVGfvu5fp4Dcl/OMeNfsrjDM:eB2of9uNKPZnu3eqJS+fg4Q+5f2olRen

  Score

  10^/10

  vidarir7amcredential_accessdiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    quarantine/systemPTI.exe

  • Size

    1.7MB

  • MD5

    e0b3978f8a8384553ce1c2947fb937bb

  • SHA1

    94098545356accfa3c76e04bcb288599b3bb9079

  • SHA256

    7579644e6717d8dbc7787a7d799104398cb26725ddfdae51745ea341985b49cd

  • SHA512

    5ca37050381b9df8a3ef6e976758b15712e28aaa08c364102b707da8839ae945716539b89d89b0b98b9fa94d6696da8059f7ea9ff8e976d9f431446f661b5b4f

  • SSDEEP

    49152:eudvbUx0bkZq9s3eYwmPTPNmYzA66EWK0V:VYAkcC3XwmPTPjA+WjV

  Score

  10^/10

  systembcdefense_evasiondiscoverytrojan

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral10behavioral9

• • Target

    quarantine/uW8i508.exe

  • Size

    6.8MB

  • MD5

    dab2bc3868e73dd0aab2a5b4853d9583

  • SHA1

    3dadfc676570fc26fc2406d948f7a6d4834a6e2c

  • SHA256

    388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb

  • SHA512

    3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

  • SSDEEP

    98304:fQX0x83hQvVapJdIJc3XO72dn3ffZSjZbkKk5KExKKUkIg5Wo6J:YX02GapHXkAn38jZk5KETUkIglW

  Score

  3^/10

  discovery
  behavioral11behavioral12