Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    2695e9c3407b633d957cf77bb878f5f2.exe

  • Size

    5.9MB

  • MD5

    2695e9c3407b633d957cf77bb878f5f2

  • SHA1

    ec0caded0b9a4b143a0e6793d21fdf4eccfa8484

  • SHA256

    e4fd314579515e6065e60382d2f266607ba872608bb0c9e29a6fda8b9c702383

  • SHA512

    b3eeb4d3f9744c8a0b8144e1b3253a1ef3644b331bee8900d9cfdb86d019303f3dca08ee3b2e620f6ef6829dd90d1b356a26ac58f016cbec655a35dd6474906f

  • SSDEEP

    98304:xyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4l:xyeU11Rvqmu8TWKnF6N/1wg

  Score

  10^/10

  dcratdefense_evasionexecutioninfostealerrattrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    26988aa536baefc2f8043cdb0d2e49e800d009b362f5cbd38692511fc5198f1a.exe

  • Size

    256KB

  • MD5

    f8711c1a5b36f91d9c58dd4f367e40d1

  • SHA1

    750ee2c764fcdd0f6bd986eca9caa3795469d32a

  • SHA256

    26988aa536baefc2f8043cdb0d2e49e800d009b362f5cbd38692511fc5198f1a

  • SHA512

    e9cd3add054705913fa59e6ad01e583c24cc1319b8c592afa02cf289de68290359c22720a8c3970691a59a46eaf13eda88bc0a600ab654463fc60da36ea3ea3c

  • SSDEEP

    6144:85p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ+q:EeGUA5YZazpXUmZhlq

  Score

  10^/10

  nanocoredefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    26c11dac9dc4d37ddb0c44f4fba7be9fe1bf84f46cc3f369c46b099fbef02bae.exe

  • Size

    27.2MB

  • MD5

    033e360ce118a4bdb0b816f7c68de8cf

  • SHA1

    286a289a4e92105656ee1fcccac5e0814c0d24bc

  • SHA256

    26c11dac9dc4d37ddb0c44f4fba7be9fe1bf84f46cc3f369c46b099fbef02bae

  • SHA512

    786f1898f09d6eb643ddd04922ebf7f0e432cbd7cbe428325eeea1553a3f8f8fe29c8fa1223f8323f4dd84fa0d7d923fd496d892b918475c10eb915928f6ae70

  • SSDEEP

    12288:nssssDsssssssssssssssssssssssssssssssssssssbsssssssssssssssssssD:/

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral5behavioral6

• • Target

    26cf08ffef5a40b6849f2afec99ac8d4.exe

  • Size

    175KB

  • MD5

    26cf08ffef5a40b6849f2afec99ac8d4

  • SHA1

    86c276b3569218b1f1cb9f490d4631017aa85c52

  • SHA256

    ca0d16b1805984d77294ae4cbd3fc5c3c9d33cf60bc35d3c12e2b60245331521

  • SHA512

    9b31ae192c6c0ed9b4fafc751212c94cd7f566e4d82191ab1dfb42a5d5ff57712972dca2449e3e6742e5aa306c33953b1c8f77c7d9b16f140fe78a6187028680

  • SSDEEP

    3072:/e8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gT8fwAqE+Wpor:KXtb5KcXr7XmfgqtjhAxZ0b2p

  Score

  10^/10

  asyncratstormkittydefaultdiscoverypersistenceprivilege_escalationratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral7behavioral8

• • Target

    2731468d18a92b65fce6a2c8a04538e0.exe

  • Size

    2.0MB

  • MD5

    2731468d18a92b65fce6a2c8a04538e0

  • SHA1

    1777e3398d8716138d84b29d66a9428d6b285766

  • SHA256

    876eb243829a1a476315a159a2768ec07505d29aabc5234a0dcc877d8fa8d644

  • SHA512

    deed4e0b686914b866144ef7d9ab190d21a2f430d338c666db6831e98301a10005c5128d3f082caeae05de94d24009a74dd8d81c1f64e0fd1c10d858d9a5aa72

  • SSDEEP

    49152:brYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:bdxVJC9UqRzsu+8N

  Score

  10^/10

  dcratinfostealerrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  behavioral10behavioral9

• • Target

    2743ade13f30458e6811f8eb99cf64cec0739d268d241b2a00ba57a9ffac835f.exe

  • Size

    15.2MB

  • MD5

    6d2849c0ff4b4cf3ef02f4fde0d92351

  • SHA1

    1173bd4bd5c3c107ac9cb9b6b92379b85d0ace71

  • SHA256

    2743ade13f30458e6811f8eb99cf64cec0739d268d241b2a00ba57a9ffac835f

  • SHA512

    553b31e4c338239be5aca5b58722432c7e9cb7dfa96950952035a5f316f44127c4cec3978db80312b80196be319f0ca920a687204de3367a0a10d82728266743

  • SSDEEP

    393216:LGg4aQGg4aDGg4aRGg4aTGg4akGg4auGg4awGg4aDGg4a1Gg4aPGg4at:r+zZDSsezdPt

  Score

  10^/10

  xredbackdoordiscoveryexecutioncollectionpersistencespywarestealer

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral11behavioral12

• • Target

    275ed71ebe32729141c2916b8abcca8763d60d2a4af82de387b9979a37495ada.exe

  • Size

    135KB

  • MD5

    955370c2069f2a6d1e61acf033cea200

  • SHA1

    d6b5e253980b7744802e5fe3c1d1b2b9ce0572b3

  • SHA256

    275ed71ebe32729141c2916b8abcca8763d60d2a4af82de387b9979a37495ada

  • SHA512

    373ceafa1a982eff2f0bf93c728f7e1fab4df393e600aa5bcb4939eae8ad7959713cda9fa22a379a507431d6c2ea9bbccb4f254fdac434ec4f0e3c7aa9b9387a

  • SSDEEP

    1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjK6:xPd4n/M+WLcilrpgGH/GwY87mVmIXt0Z

  Score

  10^/10

  discoverypersistenceremcoshostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral13behavioral14

• • Target

    27603eafb6dd5000efc17b4d67e142aa.exe

  • Size

    999KB

  • MD5

    27603eafb6dd5000efc17b4d67e142aa

  • SHA1

    bb6cfbad15876e4d37a7355618d6d29ab487245a

  • SHA256

    cca55400b39ebc83a4b99277a47d4f83e0af9172b5f8008427ecab55d5c63f67

  • SHA512

    b3aadec99d7c1fab9ded1efe5023537d6675fe16ef18bda9885722ca76cc008ba0676106c559300fbb412351a72aa9c959c524d049e794bd22fa1b418d592661

  • SSDEEP

    12288:H9pLLk45WSSY1BX6f4bIS7rMNetPfC9Vs6IFGs0jxAqXj9xPSI0dzNgCoD7WX+Iu:H9pP5WS3lrMNyC9TJPCXBi

  Score

  10^/10

  dcratinfostealerpersistencerat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral15behavioral16

• • Target

    2774cc3c0042f6c83a21daa4b7ea0d0f.exe

  • Size

    34KB

  • MD5

    2774cc3c0042f6c83a21daa4b7ea0d0f

  • SHA1

    02504384a948854d039399a1b95a295902e4f9d1

  • SHA256

    1ff24ee66a68e8257f500d0432ea0b0905c7527d493927fec6c6b3fc7c0e6e31

  • SHA512

    f7c3edbc702de77958c75e764e3d23f3fa8e4e99f921b0649b0b712ce06a1e5317f14eac0989930c3253d03e383e114f8759acf7450fd2222175198337284299

  • SSDEEP

    768:FXHYasu0INg1C4C7V9FZ9jhWyOjhQ/cU:F3YtbBgzFZ9jhWyOjq0U

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  behavioral17behavioral18

• • Target

    277de6643cae0dcc918de5342ba5f386.exe

  • Size

    23KB

  • MD5

    277de6643cae0dcc918de5342ba5f386

  • SHA1

    21ea2be08f0383e17920bc69e0ca8093e736f6ce

  • SHA256

    034571fe3806bfc17dba77d5b97ee76375df0989a4462f72d79287b7231dd040

  • SHA512

    ad17ff0df3b8d13dc17752ed4e7d66ff69a8d52207b0b6c860a4ec0cdaeeb775fc69bac4c5f27d8f89f48a96d0598420cd45149edb3ac10eb578f2299da41f5e

  • SSDEEP

    384:/AQ+SAN7uprgvM5OSUswZXg6rgbm4hfpFmRvR6JZlbw8hqIusZzZVb:vOaxVUxRpcnue

  Score

  10^/10

  njrattnakt fikdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral19behavioral20

• • Target

    279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe

  • Size

    1.6MB

  • MD5

    f088c5388663eeeed395b7263d1f4993

  • SHA1

    698d5eaabf3b5ce145f89f810311a0b42dade120

  • SHA256

    279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819

  • SHA512

    c9d946db7a10abed675d764436f3af3482b5259589fa976758b28bcd7c5b380bde9e338783611cbc5925cfdabbe0c9ba930bdb85aec7e6190d935b678b5dbba6

  • SSDEEP

    24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE

  Score

  10^/10

  dcratexecutioninfostealerrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral21behavioral22

• • Target

    279dab20ac900bec30b0f1793b059f0d.exe

  • Size

    885KB

  • MD5

    279dab20ac900bec30b0f1793b059f0d

  • SHA1

    746b709243322cebafc65da649e8b2a9955033b0

  • SHA256

    035e4ad513f0cb3ac0e1ef6c550e753ba271cf1795721a84f019c877cc53bfe5

  • SHA512

    5a02f8bef439ed12276e3e7fbbb0b405988289cb2958c33a26f22c5a21d28f0befa0cc5df26abf1e1a51a0a81d37f2da945cc22f48ebd20503e7987ec5265338

  • SSDEEP

    12288:UlNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:UlNCv6XJ5BClaXfD9vUha+u

  Score

  10^/10

  dcratinfostealerrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral23behavioral24

• • Target

    27aa584234053a57f89d2e393478ef04.exe

  • Size

    97KB

  • MD5

    27aa584234053a57f89d2e393478ef04

  • SHA1

    56969025047f74cd434cbb444de6ff3ce3a96cb5

  • SHA256

    54ad65b8e1afd5bb9dbd5ad7b5c66eeb36461d9c814ec6854abcbd33959ff2a8

  • SHA512

    fed56d5eda48e1738e6a45b78fe2278bfa8fbf8ee4cf8c2566efea51e38894f33c4899a5fff756a81b67ba69030b021a578c41df54432f282503cf9ed6f56401

  • SSDEEP

    1536:MYxlY23kGwgMBUQGum2U8aVCguHEvQEbFeDVC3woFRKpTdeE:DlY23kg3sguGDFaXeE

  Score

  10^/10

  njratneufdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral25behavioral26

• • Target

    27b356f4e4551c76a9bd9011156ba560.exe

  • Size

    846KB

  • MD5

    27b356f4e4551c76a9bd9011156ba560

  • SHA1

    bc2cb4421dbfbe573db2a923bd0cf460e1bc7102

  • SHA256

    3deb9bf412bb63728f56e63c25669fa7f615e89fdaf872c7f4345ca892b98cad

  • SHA512

    bf497517e7d8d48da9a6562959354d71d9fcc08a8fb0430be0b437e6b4404e3d98a347255fc1f9e61f63f37ae238666ca3379e1b2301ddea06d2c360dd1d3d52

  • SSDEEP

    12288:BdZnbEo7qAJSjwGlfaaZFo0b5UrEBauMYFjcaxjMJ51A/POFUI7U5GGXBu/647Q7:9bEiOwyaWXUluLFRxjM9AXdI7+Gku

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral27behavioral28

• • Target

    27f2cdcc8ecc897dfe40d5af2b4122fc9a40843d60a0506a4a2d5044650a5f20.exe

  • Size

    135KB

  • MD5

    62e5ced86ccb25c5692dda3779968bbf

  • SHA1

    5d329227cb51365c98b76fa301c7491064e37824

  • SHA256

    27f2cdcc8ecc897dfe40d5af2b4122fc9a40843d60a0506a4a2d5044650a5f20

  • SHA512

    1463b8b98848cb10d72e654ed2f872fedb9ae4fe394c1974d328c04b552937fcf8d4e33bf37fc324e726cff8e9ee3486b5bfc69d6edbb7199522736d3de11092

  • SSDEEP

    1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKA:xPd4n/M+WLcilrpgGH/GwY87mVmIXQ

  Score

  10^/10

  remcoshostdiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral29behavioral30

• • Target

    27f98377943c5b084728d381bf46e854.exe

  • Size

    97KB

  • MD5

    27f98377943c5b084728d381bf46e854

  • SHA1

    9593940f427419dfd2adf4cd1ad4286826ff3845

  • SHA256

    0a1bda6f7c5c6c9696164a73a94bd91a553333582082c08eb974d7b5aad215da

  • SHA512

    1c9197b189fc3e1fdbccae8c847e96e2b3c44f5b2af93a0f8805735a55d4b65c106966db4cb0136c19e6d3118f75c5f6a3065e7fbb8a6fc7fa5d1d10f7ec9de7

  • SSDEEP

    1536:18w4O/aH3jJ6tWOh1OErrUS652utcA6KmWoLPdCJ:183WWtErr7652zmuPd6

  Score

  10^/10

  discoverycollectionspywarestealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral31behavioral32