Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.exe
  • Size 144KB
  • SHA256 08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d
  • MD5 9e9bb42a965b89a9dce86c8b36b24799
  • SHA1 e2d1161ac7fa3420648ba59f7a5315ed0acb04c2
  • SHA512 e5ba20e364c96260c821bc61eab51906e2075aa0d3755ef25aabfc8f6f9545452930be42d978d96e3a68e2b92120df4940b276c9872ebf36fa50913523c51ce8
  • SSDEEP 3072:ep1qwbk6Wbh/UR++pz1OBrNtZtHpspurmxwPtnneZY:epoP6WV/C116rNbtHpsYrmSP1neZY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  zloadermain26.02.2020botnetdiscoverypersistencetrojan

  • Zloader family

    zloader

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1
• • Target
    0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
  • Size 355KB
  • SHA256 0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51
  • MD5 b403152a9d1a6e02be9952ff3ea10214
  • SHA1 74fc4148f9f2979a0ec88ffa613c2147c4d5e7e5
  • SHA512 0ac24ef826ae66bbba8bd5de70cb491d765ae33659452da97605701b3a39a33933f9d2795af1e8a8615cc99ae755fccc61fc44737122067eb05d7b1c435a4ec8
  • SSDEEP 6144:Fs3o0YvJiTQLmCUmLG0HhLjSKHkYp6dDERdBHMlU8LF:Fs3FmDL5P6YpaAt8LF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral2
• • Target
    0di3x.exe
  • Size 111KB
  • SHA256 d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158
  • MD5 bd97f762750d0e38e38d5e8f7363f66a
  • SHA1 9ae3d7053246289ff908758f9d60d79586f7fc9f
  • SHA512 d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39
  • SSDEEP 1536:4SYTPSLUTRZaEioqsQRPRXplmbH50B+dLDOZrZRzKZvJj5RmLFs8hN:43OLUra1oqxvplQ50BrStJ9RmLFs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Deletes itself

  • Loads dropped DLL

  behavioral3
• • Target
    4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab
  • Size 524KB
  • SHA256 4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab
  • MD5 4aa199c19c28cd1d176b7f6ff59bd713
  • SHA1 ec321c45f365ad178bbbef4f873578ffc52b6114
  • SHA512 b764a3378677a4d7ceba3d57442b98028581c0c2841bdac287c5caced0f350638a2c1c0a6136873d29627420b208789873c0d5a5ad4d28e3f1e3758e3a12a6f5
  • SSDEEP 3072:3izUDxPs3Wo9MuFaNJXzWPfdidHzaCiZv1DwWD3aw8Vnx/VJqX8IoxKOgl9aYz4h:SuyRLavQTjd8VzJSnyK1UYzSx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  zloadergoogleaktualizacijagoogleaktualizacija1botnetdiscoverytrojan

  • Zloader family

    zloader

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  behavioral4
• • Target
    2019-09-02_22-41-10.exe
  • Size 251KB
  • SHA256 30f9db1f5838abb6c1580fdfb7f5dcfd7c2ac8cfac50c2edd0c8415d66212c95
  • MD5 924aa6c26f6f43e0893a40728eac3b32
  • SHA1 baa9b4c895b09d315ed747b3bd087f4583aa84fc
  • SHA512 3cb6fd659aff46eaa62b0e647ccebeecb070ba0bb27e1cc037b33caf23c417e75f476e1c08e1b5f3b232c4640995ae5afa43bfd09252d318fe5eec0d18de830a
  • SSDEEP 6144:2E5sHpScP2xeQhp4wGoqPKNDF50AsurB:PsHIiQv4gBNDFiTuF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral5
• • Target
    2c01b007729230c415420ad641ad92eb.exe
  • Size 1.3MB
  • SHA256 5d03fd083b626a5516194d5e94576349100c9c98ca7d6845642ed9579980ca58
  • MD5 daef338f9c47d5394b7e1e60ce38d02d
  • SHA1 c0a07e8c32528d29aae26aaecbf6a67ed95b8c8e
  • SHA512 d0f4050fc2c5f38ab598729fb6930c84bf779d47b5a8b4e860bc0e9ca8be454ad5dce001d8f88299d8a079eafd4c26efcdd2d196352acfe45e940cc107fcebf4
  • SSDEEP 24576:W85y6Jwdt8jtWoJpXWHALGX+C1Co3aP8jvuC7g6zwm4m53Sb21SR:HXsSGuC/MIvuC5kFm53Sy1SR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral6
• • Target
    31.exe
  • Size 12.5MB
  • SHA256 7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
  • MD5 af8e86c5d4198549f6375df9378f983c
  • SHA1 7ab5ed449b891bd4899fba62d027a2cc26a05e6f
  • SHA512 137f5a281aa15802e300872fdf93b9ee014d2077c29d30e5a029664eb0991af2afbe1e5c53a9d7bff8f0508393a8b7641c5a97b4b0e0061befb79a93506c94e1
  • SSDEEP 393216:oKzkshyIMtAcwzhQ/CceAocPwz3fwnjWKlDc8F6tB:BzkmSmzS/Be/cPquj7D36r
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladanabotdharmaformbookgoziraccoon86920224i0qiw9zagilenetbankerbotnetcryptonedefense_evasiondiscoveryexecutionimpactkeyloggerpackerpersistenceransomwareratrezer0rm3spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot family

    danabot

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Raccoon family

    raccoon

  • AgentTesla payload

  • CryptOne packer

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Formbook payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral7
• • Target
    3DMark 11 Advanced Edition.exe
  • Size 11.6MB
  • SHA256 400b64f8c61623ead9f579b99735b1b0d9febe7c829e8bdafc9b3a3269bbe21c
  • MD5 236d7524027dbce337c671906c9fe10b
  • SHA1 7d345aa201b50273176ae0ec7324739d882da32e
  • SHA512 e5c2f87923b3331719261101b2f606298fb66442e56a49708199d8472c1ac4a72130612d3a9c344310f36fcb3cf39e4637f7dd8fb3841c61b01b95bb3794610a
  • SSDEEP 196608:8YG+5pO1Ppb1rAMQQkIscfAb3mO5iW8uO2Kq1TIxz2HU6QPXJ0M2m9b/hE4:8/Bv1zsG2fm2bTcWBIXJHVrW4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral8
• • Target
    42f972925508a82236e8533567487761.exe
  • Size 3.7MB
  • SHA256 8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
  • MD5 9d2a888ca79e1ff3820882ea1d88d574
  • SHA1 112c38d80bf2c0d48256249bbabe906b834b1f66
  • SHA512 17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
  • SSDEEP 98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratbabylonratdarkcometnjratwarzonerat2020nov1nulldefense_evasiondiscoveryinfostealerpersistenceprivilege_escalationrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylon RAT payload

  • Babylonrat family

    babylonrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Njrat family

    njrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • Warzone RAT payload

    rat

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral9
• • Target
    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
  • Size 669KB
  • SHA256 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
  • MD5 ead18f3a909685922d7213714ea9a183
  • SHA1 1270bd7fd62acc00447b30f066bb23f4745869bf
  • SHA512 6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
  • SSDEEP 6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverypersistenceransomwareupx

  • Renames multiple (179) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral10
• • Target
    c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286
  • Size 983KB
  • SHA256 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286
  • MD5 e15e3cfa542459e8d87e8bfdf70a38a1
  • SHA1 1c98fbf7b780fc8ab7f73d468ab77b41570c9665
  • SHA512 fd55639cc4f757f90a01236b10bf33bd678ef7a141c6538a5285133aa8d610bb0bf287043717557a26d28a924f3c44fbf37c13421f27a389f2e8fc76ce4b91fe
  • SSDEEP 24576:Fp90jN2CdssXMZ/ggHEfsLJ4qFKqyqG5nFYR1t:N0NDdssygGl94qFKqyqYa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  djvudiscoverypersistenceransomware

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Djvu family

    djvu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral11
• • Target
    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  • Size 80KB
  • SHA256 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
  • MD5 8152a3d0d76f7e968597f4f834fdfa9d
  • SHA1 c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
  • SHA512 eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
  • SSDEEP 1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  hakbitcredential_accessdefense_evasiondiscoveryexecutionransomwarespywarestealer

  • Disables service(s)

    defense_evasionexecution

  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit

  • Hakbit family

    hakbit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral12
• • Target
    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
  • Size 21KB
  • SHA256 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
  • MD5 6fe3fb85216045fdf8186429c27458a7
  • SHA1 ef2c68d0b3edf3def5d90f1525fe87c2142e5710
  • SHA512 d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
  • SSDEEP 384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  revengeratstealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral13
• • Target
    948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
  • Size 17KB
  • SHA256 948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654
  • MD5 aa0a434f00c138ef445bf89493a6d731
  • SHA1 2e798c079b179b736247cf20d1346657db9632c7
  • SHA512 e5b50ccd82c9cd5797dfc278dbd4bef6b4cb4468424962666d2618707a3c69e0154e8fb11846e0f529dd6e903fd9de2a2f4dd3b526821b10f08530371a0c6952
  • SSDEEP 384:rnhZ7/5eOHY9FmMoEIPJvnbisVK8ysLu2s2:bhdQOS8EIRmIa2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  revengeratpersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral14
• • Target
    95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.exe
  • Size 260KB
  • SHA256 95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9
  • MD5 9e9719483cc24dc0ab94b31f76981f42
  • SHA1 dad2cbcedfa94a2d2f0fde521d6f57a094d7c85b
  • SHA512 83cff2d55df7d40aea1357515cc673792b367718e57624a2eedd531fd51c49ff165e5e69065efa09148d550644ea1106f54dea35aaadcebaa9ed911532c44309
  • SSDEEP 6144:HP2sOvpPfQUH6+SqpcH1lH0CIuK8AWaULcka:HPXOv9RH6fEcH1h0vuLNyk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  5^/10

  discovery

  • Suspicious use of SetThreadContext

  behavioral15
• • Target
    Archive.zip__ccacaxs2tbz2t6ob3e.exe
  • Size 430KB
  • SHA256 005d3b2b78fa134092a43e53112e5c8518f14cf66e57e6a3cc723219120baba6
  • MD5 a3cab1a43ff58b41f61f8ea32319386b
  • SHA1 94689e1a9e1503f1082b23e6d5984d4587f3b9ec
  • SHA512 8f084a866c608833c3bf95b528927d9c05e8d4afcd8a52c3434d45c8ba8220c25d2f09e00aade708bbbc83b4edea60baf826750c529e8e9e05b1242c56d0198d
  • SSDEEP 6144:vU9Q9tD5WuDQa4t3BMgLkzvCOnYxcEaSAOPou8BWinO8DR:8Q9tD5WyQlBBVAnYxRhr8DR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  discovery

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral16
• • Target
    DiskInternals_Uneraser_v5_keygen.exe
  • Size 12.9MB
  • SHA256 a64f6d4168bbb66930b32482a88193c45d8aae6af883714d6688ed407e176a6e
  • MD5 17c4b227deaa34d22dd0addfb0034e04
  • SHA1 0cf926384df162bc88ae7c97d1b1b9523ac6b88c
  • SHA512 691751cf5930563fc33aa269df87284ef5d69ae332faed3a142529babd988c54ec86a3517ea2e71373491bbb39962e801feb731e1d564c7294ae517b754ffc0c
  • SSDEEP 196608:zGeHGoZMYsFL0NBneaD/TuEIp8TnWh5bpe0RCQElmYzD9gXYToUdYZF0Nz6AV:yKGDYsdUBnTHLIpWnUeXQeEXU6s
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral17
• • Target
    f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
  • Size 248KB
  • SHA256 f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a
  • MD5 8b273f919ea075cff8c652c51a301bbb
  • SHA1 917baa65532900d1dbd0a3925a898ecf0b4cd569
  • SHA512 b71c4aa7259535889126742045c820f703a5a9caa49b8496620d4566da22f65706e7e617d34ac08e741d96da0f98e617daac2ca02882ab887a4f98fe432d699e
  • SSDEEP 3072:0jtnEgIs/PEbfhRf9VgAFGjMEM6eAzwi1nBfQlcmx7TRIbB21xpgXDPmYC+UUo0m:0xn7/PGR1GvMEM2T8xqB2oLCV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  emotetepoch2bankerdiscoverytrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Emotet family

    emotet

  • Emotet payload

    Detects Emotet payload in memory.

    trojanbanker

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral18
• • Target
    ForceOp 2.8.7 - By RaiSence.exe
  • Size 1.0MB
  • SHA256 26509645fe956ff1b7c540b935f88817281b65413c62da67e597eaefb2406680
  • MD5 0a88ebdd3ae5ab0b006d4eaa2f5bc4b2
  • SHA1 6bf1215ac7b1fde54442a9d075c84544b6e80d50
  • SHA512 54c8cde607bd33264c61dbe750a34f8dd190dfa400fc063b61efcd4426f0635c8de42bc3daf8befb14835856b4477fec3bdc8806c555e49684528ff67dd45f37
  • SSDEEP 24576:sAOcZ1SxlW2YT6EtAcl0URqqqUeiG3STJq3n:64SK2YT6E1l0EqqqU1GwcX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral19
• • Target
    HYDRA.exe
  • Size 2.6MB
  • SHA256 f8c17cb375e8ccad5b0e33dae65694a1bd628f91cac6cf65dd11f50e91130c2d
  • MD5 c52bc39684c52886712971a92f339b23
  • SHA1 c5cb39850affb7ed322bfb0a4900e17c54f95a11
  • SHA512 2d50c1aa6ca237b9dbe97f000a082a223618f2164c8ab42ace9f4e142c318b2fc53e91a476dbe9c2dd459942b61507df5c551bd5c692a2b2a2037e4f6bd2a12b
  • SSDEEP 49152:HnUXzRe4cjAx+L/G/3JHQZutOnmSzZniyui0EJHezdcc/DK9kTO1S:HUD8djA0LOvJdtOmSlniyuiPFePmS61S
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoordiscoverypersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral20
• • Target
    #/power.exe
  • Size 507KB
  • SHA256 1bee45423044b5a6bf0ad0dd2870117824b000784ce81c5f8a1b930bb8bc0465
  • MD5 743f47ae7d09fce22d0a7c724461f7e3
  • SHA1 8e98dd1efb70749af72c57344aab409fb927394e
  • SHA512 567993c3b798365efa07b7a46fda98494bfe540647f27654764e78b7f60f093d403b77b9abb889cfb09b44f13515ce3c041fc5db05882418313c3b3409dd77bf
  • SSDEEP 12288:0nMyjYPYhJDDNo6YdXTVq/ywZE8ktb/3o0:ppPEDDy68Yp+8k9/3T
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21
• • Target
    #/sant.exe
  • Size 12KB
  • SHA256 3fd826fc0c032721466b94ab3ec7dcfe006cc284e16132af6b91dfbc064b0907
  • MD5 5effca91c3f1e9c87d364460097f8048
  • SHA1 28387c043ab6857aaa51865346046cf5dc4c7b49
  • SHA512 b0dba30fde295d3f7858db9d1463239b30cd84921971032b2afb96f811a53ac12c1e6f72013d2eff397b0b89c371e7c023c951cd2102f94157cba9918cd2c3e0
  • SSDEEP 192:I0EFK6COuHNlcW/1bXMvP8trt2mS3+dlRXwaziCP4kAIschKp0jeaJYrIC+sD:I0m/50t9bGPMrXSyGCP4kA6LyrIle
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral22
• • Target
    #/ufx.exe
  • Size 272KB
  • SHA256 dc7ee8b1ffec35c19e1e767265c1b40e6eb6af51157eaa8b05d51329697d16fa
  • MD5 4ccfdd49dbab092a4cc7b650372c4f91
  • SHA1 e842881fd09001a871e737c816f5c3d11ea45448
  • SHA512 ebb8e34a991809094a7e1e28135ef4e81ff4681d6e4afbb7caa2fc4093a3461eecc63b1171ae3f8da9c182d2ee68825fb50cbf7080b704d284feca07acd1b63e
  • SSDEEP 6144:ma4InuJg58BkgqPoDH49n8Bb/c2aXZGjQ//rAsDGf83wlUY:mat0EAH49n8BQGYtyfiwln
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23
• • Target
    #/va.exe
  • Size 88KB
  • SHA256 3139bf3c4b958c3a019af512aecdb8161b9d6d7432d2c404abda3f42b63f34f1
  • MD5 c084e736931c9e6656362b0ba971a628
  • SHA1 ef83b95fc645ad3a161a19ccef3224c72e5472bd
  • SHA512 cbd6485840a117b52e24586da536cefa94ca087b41eb460d27bc2bd320217957c9e0e96b0daf74343efde2e23a5242e7a99075aabf5f9e18e03b52eb7151ae1f
  • SSDEEP 1536:k6qvIQATBG8PT6vx3a1JKG8Z8YavU2apUsLLcIbw3PsjQ4YIeuPlP9:MIFTf23eJK9Z8YavLapUsLLcIU3pIeu/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral24
• • Target
    KLwC6vii.exe
  • Size 17KB
  • SHA256 a8745addaf2f95e0fe6afbc6d6712f817d4a819cf1d08bf7c0ff01822e18e1db
  • MD5 1ded740b925aa0c370e4e5bd02c0741f
  • SHA1 64731e77b65da3eb192783c074afdcb6a0a245a8
  • SHA512 fdaaa6633196851725fe088fafd539eb17483555d9b926338a7caeb961354c12cabcd3f55aa51f32297ce4a884806fbc337dfa725583cc1c86b8ca6c97218d4e
  • SSDEEP 384:fC68at8DHSXzdgcrS5RnVLeDbSbXsVKWyF5yN:p8MsIWtbeDGHY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral25
• • Target
    Keygen.exe
  • Size 849KB
  • SHA256 88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b
  • MD5 dbde61502c5c0e17ebc6919f361c32b9
  • SHA1 189749cf0b66a9f560b68861f98c22cdbcafc566
  • SHA512 d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb
  • SSDEEP 24576:uSdQdKdRdOdHdmHBnWs/nROBiGR4+hazer+Vufo/JxBYQ5:hH9DnR1Z+45Ufo/PBL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral26
• • Target
    Lonelyscreen.1.2.9.keygen.by.Paradox.exe
  • Size 13.4MB
  • SHA256 b2f43148c08f4fe2a0902873813fd7bbb9b513920089939c220826097480396c
  • MD5 48c356e14b98fb905a36164e28277ae5
  • SHA1 d7630bd683af02de03aebc8314862c512acd5656
  • SHA512 278ae5723544691844aae917938c7ab835f5da9c01c59472497112ca9f5d326a2586fa0bc79fbd0d907aab972b3f855c0087656c5e10504adc760b756ada221b
  • SSDEEP 196608:t7JG5fYHJl9nhdOvPuAZxFa9dfoyG5euyHvf97+pbgEtBRNBL1LFWIHWdgku7:t7BXWGldf+Au6VGBjFmJq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral27
• • Target
    LtHv0O2KZDK4M637.exe
  • Size 10.6MB
  • SHA256 3e385633fc19035dadecf79176a763fe675429b611dac5af2775dd3edca23ab9
  • MD5 5e25abc3a3ad181d2213e47fa36c4a37
  • SHA1 ba365097003860c8fb9d332f377e2f8103d220e0
  • SHA512 676596d21cab10389f47a3153d53bbd36b161c77875a4e4aa976032770cb4ec7653c521aaeda98ab4da7777e49f426f4019298d5fc4ed8be2f257e9d0868d681
  • SSDEEP 196608:Lj43l1SYnShCcjEtOsZ1MJWTqHkzNcWUU5QH7MiXBhxsns3qveh1DCJv/zdM:LGzUCcUOmKoTqH0N9UV7VxHsnpjXK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  azorultrmsaspackv2defense_evasiondiscoveryexecutioninfostealerlateral_movementpersistenceprivilege_escalationrattrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies visiblity of hidden/system files in Explorer

    defense_evasion

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • Rms family

    rms

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Stops running service(s)

    defense_evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Password Policy Discovery

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral28
• • Target
    Magic_File_v3_keygen_by_KeygenNinja.exe
  • Size 8.6MB
  • SHA256 72fae9a9d8cfd546975fd86222bc1f7f70133d0845798a683569bb8119ffa3b1
  • MD5 80e5a163c5396401b58a3b24f2e00d38
  • SHA1 589accaeeca95b8d69fa7bc14f402925dd338a6a
  • SHA512 cc0ede6416032035943522e5249ac378da4ba58ab836d13b53907567a65f0c296aa7263523ca23f1843fb86a88d123864e9385f4b97bac870a110f6fd2ddf1e6
  • SSDEEP 196608:t5N9rzUBJGKoeyIf6Rffyo5JDXdhz10MaIjP:jN9/EJQO6FX5JDXdhZ0Ma0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral29
• • Target
    OnlineInstaller.exe
  • Size 3.6MB
  • SHA256 59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834
  • MD5 4b042bfd9c11ab6a3fb78fa5c34f55d0
  • SHA1 b0f506640c205d3fbcfe90bde81e49934b870eab
  • SHA512 dae5957c8eee5ae7dd106346f7ea349771b693598f3d4d54abb39940c3d1a0b5731c8d4e07c29377838988a1e93dcd8c2946ce0515af87de61bca6de450409d3
  • SSDEEP 98304:ghXqJiXwwhwvxR7FI6wYroMUQrYeoFj6bjsKzZx7T7:ghXqsX3hs79bxiEbgKX7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  discovery

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Checks for any installed AV software in registry

  • Drops file in System32 directory

  behavioral30
• • Target
    REVENGE-RAT.js
  • Size 1.2MB
  • SHA256 4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e
  • MD5 8ff99e0a81c684cefbc2a752c44f30a1
  • SHA1 61b8dbc7483abcb72d2c633e6309feb26ac16eb0
  • SHA512 7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364
  • SSDEEP 24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  revengerattenaktdiscoveryexecutionpersistencetrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral31
• • Target
    Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
  • Size 9.5MB
  • SHA256 970645912c0c0b6eb857236e6bcbfcafcb0eaf0f19d2b278c5b180ee31bb8a5d
  • MD5 edcc1a529ea8d2c51592d412d23c057e
  • SHA1 1d62d278fe69be7e3dde9ae96cc7e6a0fa960331
  • SHA512 c8d9fc14c74c87284ed92d7879e5968129572b8fc4e921f48a14b82b98f26737f89daa87213cd9068fa53a8ef84b8e07f1ce053f06790d417ff8dc621b346cab
  • SSDEEP 196608:xQc+2jD8ZyCMeiA24G4jLonzU04DjmLy8OVKLlVT7H39:2c+cD4DMvA24PLMzU0+mLyJVKfX9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral32