Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Toxic/21.exe
  • Size 54KB
  • SHA256 8abb47ca7c0c4871c28b89aa0e75493e5eb01e403272888c11fef9e53d633ffe
  • MD5 ebefee9de7d429fe00593a1f6203cd6a
  • SHA1 4bed4b7f9d15e5f4cfe6b8e61f7bca865b7ce641
  • SHA512 dee06c0ec0dc0a9be293f5916e39cac62fd78293a9c5b645f3a94c315d8c324276cb52ebd12c9236c160ad28ede02c6b96e8b40eaef63675395b0822960483ad
  • SSDEEP 768:4EyjLgnDw5oEC+WOill+du3tOWxZtrDm9qPcQ4qWto9iP22WIps6qceX5VykiKoG:2LgDwjC+WOE+Q9FZtrDGHUuUIjgps4v
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoverytrojanupx

  • UAC bypass

    defense_evasiontrojan

  • Deletes itself

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1
• • Target
    Toxic/6B97B3CD2FCFB4B74985143230441463_Gadget.exe_
  • Size 25KB
  • SHA256 5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
  • MD5 6b97b3cd2fcfb4b74985143230441463
  • SHA1 8985c2394ed9a58c36f907962b0724fe66c204a6
  • SHA512 736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
  • SSDEEP 192:HULB0P1oynsSW42fyu335/wJirNmL/8Qpkqs1Iu55+ebCfN54U6Gn:0Fa1GwK3mirILu1vPbCzvn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral2
• • Target
    Toxic/7z.exe
  • Size 2.3MB
  • SHA256 d2cc1135c314f526f88fbe19f25d94899d52de7e3422f334437f32388d040d71
  • MD5 80c32b291a7074423e179769183897f2
  • SHA1 fce7daaf4fd6e89b95e05c2df003d19155299a6b
  • SHA512 858bf4474e9ef3c2701ce3cd81f9d66c5839ae892fac4b0eaccaead4bd8193a29ca03b43fd9b05791a75c715eebb999e0478536f47ef8b06b5cd71eb2cd638a8
  • SSDEEP 3072:Hql8vVLcN6YJ7WjcozS/cBIyifagqwiMKmkw9fXpv+1aKQI675JRAIB9qAEM9XVK:xvKYYcK+h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cobaltstrike100000backdoortrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Cobaltstrike family

    cobaltstrike
  behavioral3
• • Target
    Toxic/ALPHALocker.exe
  • Size 307KB
  • SHA256 84bde248e4f4c504384bb3a3b9703e4ea7e033f9aa1160089fec9c30af6632d7
  • MD5 7364d0eef2367ceabaed34a13410503f
  • SHA1 ff0faabc1b7da97720f789cbff5b9ef199033e74
  • SHA512 0f186367ce3df05d3a6b79859974c9d183645bf775506a3f655c1b0fc09cf6963f00a0429cb3c22d8f5324a9dfc754db360de45ea037e812ac7299cc74209be5
  • SSDEEP 3072:8Tf2FsIuams6/mAx44xb7kevcmFsIuLms6/xAxj3j10z:tOJ/m6l7kYOC/x6d0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  discoverypersistence

  • Adds Run key to start application

    persistence
  behavioral4
• • Target
    Toxic/Adobe, Acrobat PDF Writer 3.exe
  • Size 1.1MB
  • SHA256 ef1503f018dc86161d663071e2a7fd06eec504895334fcd692b4a17272013d60
  • MD5 7b4c5557e985327361f8e2ca302e20ac
  • SHA1 0a957de7b5ba7b90d3d612e2deb0e6043cded7b3
  • SHA512 a81936cb6c2c00317b10aeafdeb9ebb6f7cc66dc9efbea5205408286b9cdf5ea34a317d5a927e3f7dfde0ab56449be24f6c267af22354ba0b7346f181fb79324
  • SSDEEP 24576:NjAdohWjcleqtObhdRmTrf0PHWUj3dqtpTenVQrMi6n6bYcNKX:ZlhWjcl9gbhUjkLEtpTeV16kcW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  5^/10

  discoveryupx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5
• • Target
    Toxic/AgentTesla.exe
  • Size 2.8MB
  • SHA256 18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9
  • MD5 cce284cab135d9c0a2a64a7caec09107
  • SHA1 e4b8f4b6cab18b9748f83e9fffd275ef5276199e
  • SHA512 c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f
  • SSDEEP 49152:4HEHIHP6z9goDKncJkYgCB7UODoQvjZMElnp0zGMPokHz5xZtYgxsdexHwNbUMb:ZdRFBmnQ7rjZMYSzGbkHzXxWeu6W
  • MD5 SHA1 SHA512 SSDEEP

  Score

  4^/10

  discovery
  behavioral6
• • Target
    Toxic/Ana.exe
  • Size 2.1MB
  • SHA256 117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb
  • MD5 f571faca510bffe809c76c1828d44523
  • SHA1 7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2
  • SHA512 a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51
  • SSDEEP 49152:OwVYlfBUDiZx8Fa/Q0NuB3btlnCItWNSwoy:OxPUDQmso0NuBZlnCItM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  defense_evasiondiscoverytrojanupx

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral7
• • Target
    Toxic/Annabelle.exe
  • Size 15.9MB
  • SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
  • MD5 0f743287c9911b4b1c726c7c7edcaf7d
  • SHA1 9760579e73095455fcbaddfe1e7e98a2bb28bfe0
  • SHA512 2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677
  • SSDEEP 393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y:UMcKX+Lbjgd7W1RNVC9ku1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral8
• • Target
    Toxic/Antivirus2010.exe
  • Size 775KB
  • SHA256 1501affdcf557a9dcb73ae34d43365d5301532a48328564160fdc1f3acb01e2e
  • MD5 f49bcb5336b1e1212ae82cbb98f8dfe4
  • SHA1 fc87518aee297f9c18e40f4604ea048aec0342c4
  • SHA512 51a4b1a5ede81e4dbeb9a335fe3a370e6ae452a46d4f4ce8753b37d6e399b00e0de3b066921febf1b5b20f5e3356e0d93da5df366acd2002b792ecb7eb32a7e4
  • SSDEEP 12288:msCyG0JUuqby8mkxhZZIQUopL1UnDs1WxWM1W0pdNkFGNjB7tDWYK:j/kxX/ZLwo1WgMPACBv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discovery

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral9
• • Target
    Toxic/AntivirusPlatinum.exe
  • Size 739KB
  • SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
  • MD5 382430dd7eae8945921b7feab37ed36b
  • SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
  • SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b
  • SSDEEP 12288:kUWA3AheuswygKEOKlC0DaWL8ldxj1UT1fzosC2kyINJATi1v2yUQpf84i:kUWqistgKErL8P6VzosCfE6TNpf8D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoverytrojanupx

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral10
• • Target
    Toxic/Azorult.exe
  • Size 10.0MB
  • SHA256 dd396a3f66ad728660023cb116235f3cb1c35d679a155b08ec6a9ccaf966c360
  • MD5 5df0cf8b8aa7e56884f71da3720fb2c6
  • SHA1 0610e911ade5d666a45b41f771903170af58a05a
  • SHA512 724ce5e285c0ec68464c39292be62b80124909e98a6f1cd4a8ddee9de24b9583112012200bf10261354de478d77a5844cb843673235db3f704a307976164669a
  • SSDEEP 196608:NjIrZDbMLq8TKqTNNRYWzmf1e4Qx/PMPTZPkTGX9sqiL/aVvTA:N2Z4DRYWXdaZPGy9sJL/aVv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  azorultrmsaspackv2defense_evasiondiscoveryexecutioninfostealerlateral_movementpersistenceprivilege_escalationrattrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies visiblity of hidden/system files in Explorer

    defense_evasion

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • Rms family

    rms

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Blocklisted process makes network request

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Stops running service(s)

    defense_evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Password Policy Discovery

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral11
• • Target
    Toxic/CoronaVirus.exe
  • Size 1.0MB
  • SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
  • MD5 055d1462f66a350d9886542d4d79bc2b
  • SHA1 f1086d2f667d807dbb1aa362a7a809ea119f2565
  • SHA512 2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
  • SSDEEP 24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (840) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral12
• • Target
    Toxic/CryptoLocker.exe
  • Size 338KB
  • SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
  • MD5 04fb36199787f2e3e2135611a38321eb
  • SHA1 65559245709fe98052eb284577f1fd61c01ad20d
  • SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
  • SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptolockerdiscoverypersistenceransomware

  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Cryptolocker family

    cryptolocker

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral13
• • Target
    Toxic/EternalRocks.exe
  • Size 5.0MB
  • SHA256 cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30
  • MD5 c52f20a854efb013a0a1248fd84aaa95
  • SHA1 8a2cfe220eebde096c17266f1ba597a1065211ab
  • SHA512 07b057d4830d3e2d17c7400d56f969c614a8bae4ba1a13603bb53decd1890ddcfbaad452c59cc88e474e2fd3abd62031bf399c2d7cf6dc69405dc8afcea55b9a
  • SSDEEP 98304:oix7H2smW+eW/4oEAxd1jzOYGYSXmNjT2opEqH+IHK:XGW2dpOXoFWqrH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral14
• • Target
    Toxic/FIX_NIMDA.exe
  • Size 40KB
  • SHA256 3f5a6d8334f31acd4d9e2811ca705e0bcf4a1c9f672d2fb4933a00adf46b2f5a
  • MD5 36d433dc87fdbffababde57ef3c3c130
  • SHA1 9fa53295884a9cf15c7e7ac4576ec6b0ea7f181f
  • SHA512 83203d2f21e6d2cb8ca4d217c2f96106bbbca13bbc74445824c61a10496d83f9471ffe1aca104e978d767ed5db7cff4d684558d4143c3f13b32afd7e0305dc9d
  • SSDEEP 768:3pv2fhHBFd+PweJHaknr1mA5qvvjpoF5I:ZvNPpJHamr/Oo0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  credential_accessdiscoveryspywarestealer

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral15
• • Target
    Toxic/Flasher.exe
  • Size 246KB
  • SHA256 30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
  • MD5 9254ca1da9ff8ad492ca5fa06ca181c6
  • SHA1 70fa62e6232eae52467d29cf1c1dacb8a7aeab90
  • SHA512 a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a
  • SSDEEP 6144:/85Z+Y97t0Kc0Nd5bHzvvj/R87Z3BxonZ:/8vd2KxNPjs3gZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral16
• • Target
    Toxic/FreeYoutubeDownloader.exe
  • Size 396KB
  • SHA256 cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
  • MD5 13f4b868603cf0dd6c32702d1bd858c9
  • SHA1 a595ab75e134f5616679be5f11deefdfaae1de15
  • SHA512 e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
  • SSDEEP 12288:jANwRo+mv8QD4+0V16nkFkkk2kyW9EArjaccoH0qzh4:jAT8QE+kHW9EAr+fr4i
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral17
• • Target
    Toxic/GREEN.EXE
  • Size 75KB
  • SHA256 87aaec18d56d29fc14fd7fca96dc672bcbf49239a329de255e0e21c692db1dae
  • MD5 12414bea0b18e87c9888063a74f19664
  • SHA1 5fd763a0f470884232f32f6f707f9fc2cff4d366
  • SHA512 54f90a6b3f6f77947ea53f0d466c9355f8a3a687f369fee5124d948cc88ab009705c3626f638a3c171e23fb2064d5d2616d17e2dec518bee97b8bc255b357dd1
  • SSDEEP 1536:00z2CN7tjWVs1oFL89FQO69LVX2JKfRZ6xmr+p6F4pT4UjFw:00zLJjWVaeEFQzmJQIor+p6Fu4iFw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral18
• • Target
    Toxic/GoldenEye.exe
  • Size 254KB
  • SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
  • MD5 e3b7d39be5e821b59636d0fe7c2944cc
  • SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
  • SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5
  • SSDEEP 3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoorbootkitdiscoverypersistencetrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral19
• • Target
    Toxic/HDSetup.exe
  • Size 416KB
  • SHA256 337ee64e0817a7740dc82483257dd2021a4190a1337d35a84009173678d33ff4
  • MD5 6e6fcfb0e9d4f95add875b894ca164c7
  • SHA1 18f251a4606b284d0c55fd5ddf217bf39df978a6
  • SHA512 b0d67565215830460ccd3fb8baf309d64f88e8328de850d8a5418653d759db971dd449d5d8f4879cdae5ae012e0e92ba34fefeb290cac898c8759b3fbeedb454
  • SSDEEP 3072:Xn6gH+oU7pfJCmokSBmXtXwKLzZZwljHtnkUrGpDXb17ftv7YjUJnlXtLKWQ9NtW:XndO1hY1IhPiLFu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  discovery

  • Drops file in Drivers directory

  behavioral20
• • Target
    Toxic/HappyAntivirus.exe
  • Size 1.9MB
  • SHA256 64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32
  • MD5 cb02c0438f3f4ddabce36f8a26b0b961
  • SHA1 48c4fcb17e93b74030415996c0ec5c57b830ea53
  • SHA512 373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3
  • SSDEEP 49152:p/VoMTzwF77l0VqmuTefhLTtk31XyXb9:ptoMTzwVmq3ettk31ob9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral21
• • Target
    Toxic/HawkEye.exe
  • Size 232KB
  • SHA256 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838
  • MD5 60fabd1a2509b59831876d5e2aa71a6b
  • SHA1 8b91f3c4f721cb04cc4974fc91056f397ae78faa
  • SHA512 3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a
  • SSDEEP 3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  chimeradiscoveryransomwarespywarestealer

  • Chimera

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera

  • Chimera Ransomware Loader DLL

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware

  • Chimera family

    chimera

  • Renames multiple (3253) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral22
• • Target
    Toxic/L0Lz.bat
  • Size 6KB
  • SHA256 fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae
  • MD5 74f8a282848b8a26ceafe1f438e358e0
  • SHA1 007b350c49b71b47dfc8dff003980d5f8da32b3a
  • SHA512 3f73c734432b7999116452e673d734aa3f5fe9005efa7285c76d28a98b4c5d2620e772f421e030401ad223abbb07c6d0e79b91aa97b7464cb21e3dc0b49c5a81
  • SSDEEP 192:tlYUT1jLPD5mZkRr3TfLQ4/zus8joPRJRqU1jXEmo:tlY85XW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Modifies Windows Firewall

    defense_evasion

  • Drops startup file

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral23
• • Target
    Toxic/MrsMajor3.0.exe
  • Size 381KB
  • SHA256 4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69
  • MD5 35a27d088cd5be278629fae37d464182
  • SHA1 d5a291fadead1f2a0cf35082012fe6f4bf22a3ab
  • SHA512 eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5
  • SSDEEP 6144:Th3idhONY259BH1DzJ5PzVNtGgc+F9TBd096cTKAsLEbqqbd+VWM8AHiKn9SlXNA:Th3iXPw9Tc6kVXMHHLEf8l7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agilenetdefense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  behavioral24
• • Target
    Toxic/PowerPoint.exe
  • Size 136KB
  • SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
  • MD5 70108103a53123201ceb2e921fcfe83c
  • SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
  • SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
  • SSDEEP 1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  bootkitdiscoverypersistence

  • Deletes itself

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral25
• • Target
    Toxic/Ransom.Xdata.exe
  • Size 251KB
  • SHA256 f0103528b96533db9d76df0f760b4d0ffc1a142b0070e3a70e6f9a724d726fbd
  • MD5 254b7d11098dc01e5194e841d887c322
  • SHA1 858d03b626ae5b8737dcbd22a39182e9673c1b96
  • SHA512 f9838d75066626d249d03cb5cf51222aeffc135278ac234690e0bee2fc82bb609959bfe6917ca75dbaf5a72d458ef701493d447d2dcad2c635ed42739bfeb2be
  • SSDEEP 6144:DRkQY6cBEqap781fgKqjHATTgV0RqUFcigEvJ8cwTwbICJpATtpS1:DRYhBEqap781fgKqjHATTgV0RqUFcVcj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  credential_accessdiscoveryransomwarespywarestealer

  • Renames multiple (8035) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral26
• • Target
    Toxic/Sample1.exe
  • Size 91KB
  • SHA256 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
  • MD5 be60e389a0108b2871dff12dfbb542ac
  • SHA1 14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
  • SHA512 6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
  • SSDEEP 1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral27
• • Target
    Toxic/SmartDefragmenter.exe
  • Size 438KB
  • SHA256 61a9e3278b6bcc29a2a0405b06fb2a3bbcb1751c3dd564a8f94cc89ea957ec35
  • MD5 03baeba6b4224371cca7fa6f95ae61c0
  • SHA1 8731202d2f954421a37b5c9e01d971131bd515f1
  • SHA512 386643b0a52b6b1a53e81a8500d040b6415e532ebaffd1be8d1afd4ccb10f6c0342cf734b688ec803b960339284c8d9669e638b1648d9cc734cf7367659c7fd0
  • SSDEEP 6144:hBGrTx2fgEViq+JoQ9tpecSXFADhKXPEKJRlETLV+PwoVUqwhlKq6yem8lhg:6rLEyptwnX+gXrRlESwKKhlP6yxGh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  defense_evasiondiscoverypersistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral28
• • Target
    Toxic/agent.exe
  • Size 113KB
  • SHA256 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2
  • MD5 f5f8160fe8468a77b6a495155c3dacea
  • SHA1 20d61c337653392ea472352931820dc60c37b2bc
  • SHA512 c65b86d579f7c0defba655ce440a20f1bb5447e058861540e92d80968131d40cc9fa42defb2c613d92de323f42301f59eacc6cfce5f34ca2c2170f0692919db8
  • SSDEEP 3072:VKMMWFhWGRGhZIzPic5RbQ9b4R1DcMxaiJe:AMZh1kUPiMMKR1DTJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral29
• • Target
    Toxic/gchrome.exe
  • Size 2.8MB
  • SHA256 d23b4a30f6b1f083ce86ef9d8ff434056865f6973f12cb075647d013906f51a2
  • MD5 49fd4020bf4d7bd23956ea892e6860e9
  • SHA1 c5d8f155209badd278437d0e534648f8d5c35aae
  • SHA512 b532f3e0451759727eba1e1559ba20131d1900ef958d1cd3c2dc4e65cfafbce5cadfe52d867048751815e0c8b7afcd0679725c937fe7b1aecd21699773627817
  • SSDEEP 49152:sVic4rcPjPlzIWJDn8Ss2y44enoerL/TrRCxREX4x+va:42etHsFenjvT9/X44
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral30
• • Target
    Toxic/malware_1.exe
  • Size 68KB
  • SHA256 c0d41a8f96e44d676546e4f58d9b2c5bb10cd91db15dbf55756f87042e784c34
  • MD5 fdafb3a14338b2b612c4e5c4f94b3677
  • SHA1 5432f12fed74038cdfba4eaa08e62944a1e5a501
  • SHA512 448d668c0d8fc21768b90e64e3473b0ea6fcda07cab824d7bc3ce9221a2d4016be48379caab2f6456c14f8bd3726e92de893a8024d87091f0bebfd707b518647
  • SSDEEP 1536:2Ng5geDWlE8LLo6ABo1JcoaYOJ5NsdXnX+jKH+cxFy:2NyqlEWYBwabX8OQTFy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral31
• • Target
    Toxic/soy.exe
  • Size 64KB
  • SHA256 17cc26eb17b5562423dd47ddf6c3bbda34e69c0c65027fe659a9c0becf8438ef
  • MD5 c04236b5678af08c8b70a7aa696f87d5
  • SHA1 4b713963f7f7032dda431d8042344febac017cf2
  • SHA512 dde09ff630e070eea28a5fef0852df8591827d867a8f536616da750292859661c53b4865d68a8c08f36661ab29596b9193618c44bf345476c1f94eb500e309da
  • SSDEEP 1536:wYFJsIiHyVaM2frJe31Uod74Fru71mTUscFDoRZe6m/fqhuFOnto7:wcWIiHmM8lkFyJmTvcBoze6m3qT2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral32