Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    scary.exe

  • Size

    75.3MB

  • MD5

    ca39d405dfa59baece7fdbfae5479674

  • SHA1

    1c8b5c81ddb04c342a25518fe10be28294e323cf

  • SHA256

    bfe1158258e04a58d37eab94edfe9cdf88438a0f7244747d73f81fd7c5798c4b

  • SHA512

    5a5e37fc6e9148ed17cfb80657fd49a4d2346c5ab4e8311ea060bbe66829dc146b6feec45446163a334783279878eb89c3bb3bf2e5965fad333fd135e1712be5

  • SSDEEP

    1572864:1X7oHaEUo7olZfWmsJme3ZwzCPSyeGEmjx/IwyVCOdjlBkhod8sz+cjpz0IE:1M98NWdhJwzCHeGfjNyMOdjDeodjUI

  Score

  10^/10

  marsstealermodiloaderquasarstealeriumumbralwannacrydefaultoffice04bootkitcredential_accessdefense_evasiondiscoverypersistenceransomwarespywarestealertrojanvmprotectwormexecution

  • Detect Umbral payload

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Marsstealer family

    marsstealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • ModiLoader Second Stage

  • Stops running service(s)

    defense_evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3