bazarbackdoor

Target
250617-3d7n6sfr3w.bin
Size 132.7MB
Sample250620-zfp1csgr51
SHA256 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66
MD5 136b5aad00be845ec166ae8f6343b335
SHA1 e51860dfb734c9715b6c9b74d9c582abe03ca90c
SHA512 ed56b1afa85e304d6973d69e289631f15955d1619c6943a376d7d319018057d1a6fa0aa340ea6d43037ee17014f13e74e5ebddaf3aec62bf8e2da6b20b14ce42
SSDEEP 3145728:m2t5SZQXkJuAwd3u5d5VO4Z9WSXL5qgP47khuJWCvcICllCCrE/z:m6ClwdeyqWSXVqeU5J7CvCCrgz
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

26.02.2020

https://airnaa.org/sound.php
https://banog.org/sound.php
https://rayonch.org/sound.php

Attributes

build_id
19

rc4.plain

Extracted

Family

revengerat

Botnet

XDSDDD

84.91.119.105:333

Mutex

RV_MUTEX-wtZlNApdygPh

Extracted

Family

revengerat

Botnet

Victime

cocohack.dtdns.net:84

Mutex

RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family

zloader

Botnet

25/03

https://wgyvjbse.pw/milagrecf.php
https://botiq.xyz/milagrecf.php

Attributes

build_id
103

rc4.plain

Extracted

Family

revengerat

Botnet

samay

shnf-47787.portmap.io:47787

Mutex

RV_MUTEX

Extracted

Family

zloader

Botnet

09/04

https://eoieowo.casa/wp-config.php
https://dcgljuzrb.pw/wp-config.php

Attributes

build_id
140

rc4.plain

Extracted

Family

zloader

Botnet

07/04

https://xyajbocpggsr.site/wp-config.php
https://ooygvpxrb.pw/wp-config.php

Attributes

build_id
131

rc4.plain

Extracted

Family

cobaltstrike

Botnet

305419896

http://47.91.237.42:8443/__utm.gif

Attributes

access_type
512
beacon_type
2048
host
47.91.237.42,/__utm.gif
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
8443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS7zRQv7EhhTkbgDrCNBsNay7lzQFmcC/GWwjOq93nKwPSszjIKgtW8nwhtoRhr6MFZx4DSYFdeuJDrtJNcTZz2C/LgZzhSQJmhiEqCkVqPPCfK1C6S4PzDrzy9L794rPLOuoewlGAXgiH5/Ae2aC5k2wedRNfes3DJZDDCaJJYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)
watermark
305419896

Extracted

Family

revengerat

Botnet

INSERT-COIN

3.tcp.ngrok.io:24041

Mutex

RV_MUTEX

Extracted

Family

revengerat

Botnet

yukselofficial.duckdns.org:5552

Mutex

RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family

revengerat

Botnet

system

yj233.e1.luyouxia.net:20645

Mutex

RV_MUTEX-GeVqDyMpzZJHO

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

srpmx.ddns.net:5552

Mutex

c6c84eeabbf10b049aa4efdb90558a88

Attributes

reg_key
c6c84eeabbf10b049aa4efdb90558a88
splitter
|'|'|

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

njrat

Version

0.7d

Botnet

HACK

43.229.151.64:5552

Mutex

6825da1e045502b22d4b02d4028214ab

Attributes

reg_key
6825da1e045502b22d4b02d4028214ab
splitter
Y262SUCZ4UJJ

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
castor123@

Mutex

245f77ec-c812-48df-870b-886d22992db6

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:castor123@ _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:245f77ec-c812-48df-870b-886d22992db6 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Extracted

Family

zloader

Botnet

June08

Campaign

June

http://snnmnkxdhflwgthqismb.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php

Attributes

build_id
149

rc4.plain

rsa_pubkey.plain

Extracted

Family

zloader

Botnet

spx139

Campaign

spx139

https://xeemoquo.top/treusparq.php
https://leeephee.top/treusparq.php
https://withifceale.top/treusparq.php
https://wpsnoum.pw/treusparq.php
https://wsaexdig.pw/treusparq.php

Attributes

build_id
11

rc4.plain

rsa_pubkey.plain

Extracted

Family

zloader

Botnet

bot5

Campaign

bot5

https://militanttra.at/owg.php

Attributes

build_id
15

rc4.plain

rsa_pubkey.plain

Extracted

Family

zloader

Botnet

bot7

Campaign

bot7

https://militanttra.at/owg.php

Attributes

build_id
18

rc4.plain

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch1

12.163.208.58:80
45.33.35.74:8080
87.106.253.248:8080
192.241.146.84:8080
190.115.18.139:8080
65.36.62.20:80
170.81.48.2:80
83.169.21.32:7080
185.232.182.218:80
190.2.31.172:80
77.106.157.34:8080
82.230.1.24:80
202.4.58.197:80
201.213.177.139:80
78.249.119.122:80
123.51.47.18:80
77.90.136.129:8080
60.93.23.51:80
152.169.22.67:80
190.117.79.209:80
60.108.144.104:443
213.197.182.158:8080
82.76.111.249:443
209.236.123.42:8080
190.24.243.186:80
177.74.228.34:80
191.182.6.118:80
96.245.123.149:80
61.197.92.216:80
1.226.84.243:8080
111.67.12.221:8080
216.47.196.104:80
185.94.252.27:443
70.116.143.84:80
187.162.248.237:80
217.13.106.14:8080
80.11.164.185:80
35.143.99.174:80
190.190.148.27:8080
219.92.13.25:80
70.32.115.157:8080
96.227.52.8:443
51.75.33.127:80
95.9.180.128:80
174.113.69.136:80
119.106.216.84:80
111.67.77.202:8080
91.105.94.200:80
178.250.54.208:8080
98.13.75.196:80
2.36.95.106:80
186.70.127.199:8090
116.202.23.3:8080
202.134.4.210:7080
50.28.51.143:8080
45.33.77.42:8080
67.247.242.247:80
137.74.106.111:7080
85.214.26.7:8080
181.30.61.163:443
77.238.212.227:80
185.215.227.107:443
186.103.141.250:443
50.121.220.50:80
74.136.144.133:80
104.131.41.185:8080
61.92.159.208:8080
104.131.103.37:8080
51.15.7.189:80
185.94.252.12:80
94.176.234.118:443
212.71.237.140:8080
5.196.35.138:7080
45.46.37.97:80
70.32.84.74:8080
199.203.62.165:80
38.88.126.202:8080
51.159.23.217:443
155.186.0.121:80
51.38.124.206:80
181.129.96.162:8080
64.201.88.132:80
92.24.50.153:80
189.2.177.210:443
45.16.226.117:443
76.168.54.203:80
185.178.10.77:80
220.109.145.69:80
192.81.38.31:80
68.183.170.114:8080
177.73.0.98:443
138.97.60.141:7080
192.241.143.52:8080
217.199.160.224:7080
185.183.16.47:80
177.129.17.170:443
5.189.178.202:8080
74.58.215.226:80
51.255.165.160:8080
12.162.84.2:8080
149.202.72.142:7080
87.106.46.107:8080
188.135.15.49:80
68.183.190.199:8080
172.104.169.32:8080
68.69.155.181:80
72.47.248.48:7080

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch3

71.57.180.213:80
185.86.148.68:443
168.235.82.183:8080
181.113.229.139:443
181.134.9.162:80
217.199.160.224:8080
105.209.235.113:8080
216.75.37.196:8080
97.104.107.190:80
203.153.216.182:7080
107.161.30.122:8080
41.106.96.12:80
202.5.47.71:80
201.235.10.215:80
105.213.67.88:80
115.79.195.246:80
179.5.118.12:80
212.112.113.235:80
139.59.12.63:8080
177.37.81.212:443
81.17.93.134:80
46.32.229.152:8080
66.61.94.36:80
172.96.190.154:8080
176.9.93.82:7080
5.79.70.250:8080
190.212.140.6:80
37.46.129.215:8080
115.165.3.213:80
201.213.177.139:80
187.64.128.197:80
92.24.51.238:80
185.208.226.142:8080
50.116.78.109:8080
46.105.131.68:8080
181.114.114.203:80
190.190.15.20:80
198.57.203.63:8080
188.251.213.180:443
185.142.236.163:443
182.176.95.147:80
143.95.101.72:8080
181.164.110.7:80
113.161.148.81:80
51.38.201.19:7080
31.146.61.34:80
75.139.38.211:80
157.7.164.178:8081
203.153.216.178:7080
212.156.133.218:80
81.214.253.80:443
87.106.231.60:8080
190.164.75.175:80
77.74.78.80:443
179.62.238.49:80
78.189.60.109:443
177.32.8.85:80
195.201.56.70:8080
190.53.144.120:80
75.127.14.170:8080
177.144.130.105:443
178.33.167.120:8080
192.210.217.94:8080
192.241.220.183:8080
188.0.135.237:80
74.208.173.91:8080
182.187.139.200:8080
172.105.78.244:8080
41.185.29.128:8080
197.83.232.19:80
87.252.100.28:80
115.78.11.155:80
192.163.221.191:8080
91.83.93.103:443
139.99.157.213:8080

rsa_pubkey.plain

Extracted

Family

trickbot

Version

100001

Botnet

tar2

66.85.183.5:443
185.163.47.157:443
94.140.115.99:443
195.123.240.40:443
195.123.241.226:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3
- Size 917KB
- SHA256 ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3
- MD5 d592e787314d1c327dbc2da117e1dc59
- SHA1 ba3a26eaa200d53129e304078309758bbb3c95f1
- SHA512 1e805105ab482c752bd24afa028daa3e7bd83f0258510a6fa2ea0c90eb44d1eec590c926982252dbf3a28bb070befbaea5e78c00d556bd9b380a3c79f1480cf7
- SSDEEP 24576:Hk5FAciH/EjiQXFPQ0NQaScQqYLQnasbbTq4cSJG:Hk5O/EjiuFP32CYL/wnqlUG
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu discovery ransomware
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Djvu family
  djvu
behavioral1
- Target
  efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
- Size 920KB
- SHA256 efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4
- MD5 4339e3b6d6cf2603cc780e8e032e82f6
- SHA1 195c244a037815ec13d469e3b28e62a0e10bed56
- SHA512 a87c47c998f667eb8ac280f4e6dc3df182d721c44267c68ee042c17e8168115e38f2e1d59c6928ca595bb93b3bfd112cbd7bffb0ee6ff8ca81f469056f26ff87
- SSDEEP 12288:obIkK9q/oPvPrNAuPfZpAvJvqWTe57Zb8Pyfdyr4G8HdsNhAwpC:obDcnrNtPfZpYvqWTeDQIdyrb8HqhNpC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral2
- Target
  emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504._exe
- Size 505KB
- SHA256 ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f
- MD5 cbe9aa4dce4217491cf9bffae2c66537
- SHA1 2b7a15303157f8b9f1cce01e5e7a130628eb2c22
- SHA512 71e2736fafa1be308ef341a937a1c6d0dc5a311952bfb9bfbd492c2e16950508f1aea5e63a8e3614c9a35cdc6a684d3ff6e2dba38fe483af74508d3df41262a5
- SSDEEP 6144:DaRhOv5KaMqEZD+m6eewOmkGOYQ87wwzcCgZi3lzAOAWPcnLiG8Ztkq66ti9pdZx:wOKhDD6yUGOYQto3lzAOATStkfxeY
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

emotet epoch1 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral3
- Target
  emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
- Size 448KB
- SHA256 93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1
- MD5 6becbc70725f55f6e6dbe66f383f82bf
- SHA1 7ea5f70e20171e23ccec3c18da638b78dcadfc5c
- SHA512 e3d8815ea584ec745bc103494e123ca489bdc8b8599745548acab449b9630a7e4a8d47c63db752aee63d18d1fec10f961f2f9c4cdc2324c26460c80421e09957
- SSDEEP 12288:ZfzaBuiszJbE9mO4sl9kHAOyQkNvOzxrq:ZbMmO4sl9gR2Ot2
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

emotet epoch3 banker discovery trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral4
- Target
  eupdate.exe
- Size 87KB
- SHA256 5d81fc6ab3e6c7bd353ee53297478fc10abfc7f851359f81a65dea74c70156ff
- MD5 ccfaeed043685c189ef498c3c6f675e7
- SHA1 6973b66e83db7f6d9ba957a6f9cca60a4983f0e8
- SHA512 ab8f2d33ec8300d87423f53243f45b720e27d59ab7839d7dcb9d37572c1f4e34536221bfda25dee939218475f44915cac2cf4e9270881af15f53d916bd9dc204
- SSDEEP 1536:ZzfLlsKsEJQgrsOCvojaWr2mACx9lRMgzIY/M0t4T5y5cum:Z7wngrsOCvov2mACDP/IY00eVyc
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence spyware stealer upx
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
- Size 332KB
- SHA256 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f
- MD5 1e0ff1a8078820c5c10652e406d51bef
- SHA1 e191fdbe58b527301eb4bd244a2258ba1cad0182
- SHA512 eb1a011724b988362aa52bdcb69d2886b736dbbe72fe9e53fa3530eeec6bb4089519896a88af48df8e99c7010930fb84cd33599e57f8477e8748cf5259e428a0
- SSDEEP 6144:R+xWEy53Bhj8sW4y9wTeT10hFPascnojIXTvUv7ohqfp2:RSw53Bhj8sW4ya6T6hFPasco4cv7o7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

bazarbackdoor backdoor
- BazarBackdoor
  Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
  backdoor bazarbackdoor
- Bazarbackdoor family
  bazarbackdoor
- Tries to connect to .bazar domain
  Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral6
- Target
  fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
- Size 19KB
- SHA256 fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c
- MD5 6029c37a32d7e4951449e197d4850213
- SHA1 6ed7bb726b1e04d6858c084bc9bf475a13b77c95
- SHA512 bf3639710e259aa38d0cd028071408bdd41c01ee1bd0ea70a16ada78b848c63886854ed40407242e3a68fd9b5444fce2e6ddc050e0c8a2f578b00f43b6c52b6f
- SSDEEP 384:EB8JbJPKd1Bf3rNeD9k4NcKlb5sCSvyP5CtrCzYcHe+Z:EBCNPKd155ulNzxoUzYcHe+Z
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral7
- Target
  fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
- Size 660KB
- SHA256 fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d350
- MD5 b44c5540e020963aca89f3b9a96beb35
- SHA1 14a6e46be7863db3090d81a18d4e080ac005f437
- SHA512 63ffac732d6b6b469f6072efa0b4ad0ef224072418b18ed879fe914c3cb64b6714ca4948c5d1816218d611865a1f1747121e126a407acbcc038b4615f9b7fd31
- SSDEEP 12288:96zG7KjQ+oJLVaRwYdNKxRBUU8vg0whwRKCV50robF7z:9l7eoFsRjdN6BUUP01RKC8EbF/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

trickbot tar2 banker discovery trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot family
  trickbot
behavioral8
- Target
  file(1).exe
- Size 16KB
- SHA256 3ac39ece6e1953f03e88fdfb942bf9f0dcb8d1da643cbd9677032f2ac7861d03
- MD5 9ca9044bbac6aa39072da89d05cb3dcf
- SHA1 7cb6ec980704bf7eb109918a1cb037deed4341fe
- SHA512 5f6cfae5220c219455a180ee6a6fe094fe73475be6acdef24f33476a995097c355af0cf147fd6b986ca3bd84eee0b4928a6d08cabfab63f101259e05d037d9bd
- SSDEEP 384:9jmvn8X19vieB6gb9oDPlMNcLlb5sVKRye5Ct:9jmvni19TBDclMNEho
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  file.exe
- Size 101KB
- SHA256 275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06
- MD5 88dbffbc0062b913cbddfde8249ef2f3
- SHA1 e2534efda3080e7e5f3419c24ea663fe9d35b4cc
- SHA512 036f9f54b443b22dbbcb2ea92e466847ce513eac8b5c07bc8f993933468cc06a5ea220cc79bc089ce5bd997f80de6dd4c10d2615d815f8263e9c0b5a4480ccb4
- SSDEEP 1536:fkSJkZlpqwZoMoG5XoZnOZBX7D/3BINVRX3FjBqa8D3tSYS9h:MXlpqwZoMz5XoZncB/3BINZjy9SYS
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
behavioral10
- Target
  gjMEi6eG.exe
- Size 23KB
- SHA256 2027c43348230de4a40e7ec590d692f744f36cdb13eb65f599983158e920cdb9
- MD5 9ab1a677fb73e7c5a41d151c4c21f69e
- SHA1 10219ed34a3f76ca7fe30eb27a1a78d83c9ada37
- SHA512 0c9f2e1555c36a3742a2ec604faf9a89bfd856946024596912bc116ad7f4fd15ee67969704956d30d70e7b6cb3a626168c309add57469adb03d389df0596f3c5
- SSDEEP 384:nY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZtd:wL2s+tRyRpcnuQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral11
- Target
  good.exe
- Size 143KB
- SHA256 90d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
- MD5 b034e2a7cd76b757b7c62ce514b378b4
- SHA1 27d15f36cb5e3338a19a7f6441ece58439f830f2
- SHA512 1cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
- SSDEEP 3072:VMb/kbqjO/3FxV8l8wiEXHPV9r99rWhzAxH7wpjv4z:VMxo3Z8BvV9rL6h2H7wJ4
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral12
- Target
  hyundai steel-pipe- job 8010(1).exe
- Size 721KB
- SHA256 8a9bcb387cd155170986cd1938beb317ee1ee511bcb6175a6d292bd976cca15b
- MD5 0999a03694a1c97a43ac0de89cbf355e
- SHA1 0c8fdd4c3b40c4827662baa0c89b5b50d8f0cf1d
- SHA512 6515a13d561d2adb08fd53dba80ecd7ee264b66080848e0c845f63313eb9a828c6be8014d6db47f8ac910e24848dd74c57aae00a92ebe9b4efd97676e0365fe9
- SSDEEP 12288:wdnX6tet6u5CB6m6FQgsPQCjyEtbK7DSQDnwjAR7EOP9uSlcC3ro:QXUim6m6FyPJzcQjNSuYro
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

hawkeye_reborn m00nd3v_logger collection discovery infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- Hawkeye_reborn family
  hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nd3v_logger family
  m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral13
- Target
  hyundai steel-pipe- job 8010.exe
- Size 721KB
- SHA256 8a9bcb387cd155170986cd1938beb317ee1ee511bcb6175a6d292bd976cca15b
- MD5 0999a03694a1c97a43ac0de89cbf355e
- SHA1 0c8fdd4c3b40c4827662baa0c89b5b50d8f0cf1d
- SHA512 6515a13d561d2adb08fd53dba80ecd7ee264b66080848e0c845f63313eb9a828c6be8014d6db47f8ac910e24848dd74c57aae00a92ebe9b4efd97676e0365fe9
- SSDEEP 12288:wdnX6tet6u5CB6m6FQgsPQCjyEtbK7DSQDnwjAR7EOP9uSlcC3ro:QXUim6m6FyPJzcQjNSuYro
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

hawkeye_reborn m00nd3v_logger collection discovery infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- Hawkeye_reborn family
  hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nd3v_logger family
  m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral14
- Target
  infected dot net installer.exe
- Size 1.7MB
- SHA256 1371b24900cbd474a6bc2804f0e79dbd7b0429368be6190f276db912d73eb104
- MD5 6eb2b081d12ad12c2ce50da34438651d
- SHA1 2092c0733ec3a3c514568b6009ee53b9d2ad8dc4
- SHA512 881d14d87a7f254292f962181eee79137f612d13994ff4da0eb3d86b0217bcbac39e04778c66d1e4c3df8a5b934cbb6130b43c0d4f3915d5e8471e9314d82c1b
- SSDEEP 49152:znsHyjtk2MYC5GDbQ2cRQh9GexmCxBxVV56CmWQax:znsmtk2aj2cROGom6mGvx
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xred backdoor discovery persistence
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral15
- Target
  inps_979.xls
- Size 228KB
- SHA256 59afe59cdbebf60434bd78270826ca9689c3765264dfcace312b89c606c0a962
- MD5 56fc044937a072471fdd8d63b874e04a
- SHA1 738552f8db33ac0271aa860775815f3d1b291980
- SHA512 dbaf2e36ec17d474c829d847705de796bea153b784c8e894d4ff7bebb3bfcdf01447d97f217d9303e0eed5aa9b39046b75b2581331be28771582af2ea48c960b
- SSDEEP 3072:bfMhNhd8o7Vym+BoOvuuUVZV/AHyhb3/7428JMPvjLJKHpEYC5ZNWehxleT0t:bfMhL70DBoOmf1FbAJMWEYC5Z3leA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  jar.jar
- Size 81KB
- SHA256 f2fb2d0c469abc0add346ef809ad86e0194400d391a2e5429b8cbeea2711bbad
- MD5 9e8b6710fdd55ad0675295c2c3960732
- SHA1 aed08772376bde9f848f335e77e2e3c3c230234d
- SHA512 26f94b0b9766e9c244297cbe4af78f1b09087fbe471f099b5a77f5ca76fd5c905ee4d36188af67dbd6dc2c7f8402c882d0d2503a288af277840a1025562eac96
- SSDEEP 1536:0GZABd/SAZR5RzfFMAjP/jg6X4bUdv/mIgQnXOunxgCfj:jZ0d//JfyAz/XIbCvOIgQemWCfj
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

qnodeservice trojan
- QNodeService
  Trojan/stealer written in NodeJS and spread via Java downloader.
  trojan qnodeservice
- Qnodeservice family
  qnodeservice
- Executes dropped EXE
behavioral17
- Target
  june9.dll
- Size 491KB
- SHA256 c653365657fbf65429ad845d0a0d93106e972aca929739560ff4b4796bd2be08
- MD5 f8a7273ef763776e5612ac1f47f6d405
- SHA1 c51f2a884c024e442c1ae0d9bf9511c96a1fa02c
- SHA512 5ea060662350237d38d2c6a3c1da5fd7aeec6c05e71cdbb2725fcac47ad8e5c9568adc937329397108ab0cecdf29e9a811ab7e183884dd3044d7c5a6089f88aa
- SSDEEP 12288:uDKxKMk8ChMNo+e8kGOK9ab4ozUWdBENcYcj6D9r6W3FaOi:uDjMk8IMNYnGOSSjgW41QEv1aO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

zloader june08 june botnet discovery trojan
- Zloader family
  zloader
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Suspicious use of SetThreadContext
behavioral18
- Target
  mouse_2.exe
- Size 984KB
- SHA256 03968a3a5a7a880feefca31686fcfbed445080a0c06eda2b6d623757179b782c
- MD5 af8ab92992ccc4cc6a637953836edf93
- SHA1 ac17c77cae31fdfeb618b0083285ba869baf29fc
- SHA512 9dc3bdfe45f9333d62ef3b0aaf3860a9ef1e94ced02ed0437d3ac2f96b3b9aacf6e621703f13d62f356bd50dec84cc3a3dc787a8a14c9ce0ceeed9ff63c45ad2
- SSDEEP 24576:iNg+tKkEYA7Gmvv/HGsvPw9vz/DrELE7VUH:0g4K7YA7vvRMbcLa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

masslogger collection discovery rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main payload
- Masslogger family
  masslogger
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral19
- Target
  oof.exe
- Size 662KB
- SHA256 8f9067f2bd4a374539a40fddb8915600c9fd6ba3e5db20cbddcb3c5f22d9da44
- MD5 0760d43d4adebe20fa0b5e5a7bca1714
- SHA1 a0a9dae5e9be39bca31021dd9cf565fcdefb8474
- SHA512 7e60c2726711bb8e822375f93cfb9ced7d172f3f0ae07041cbeea8c4cdb45488d1de90ee77dfef52aa86722a5dcbe521d1affeace3aec8811e851f693d74ef77
- SSDEEP 12288:9TEUsvsVEcwaFNaxr7IwFnm1p7BmC10sHo0AhHL:9oBvRcxuxrksqRNI0i
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

betabot backdoor botnet defense_evasion discovery persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Betabot family
  betabot
- Modifies firewall policy service
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral20
- Target
  openme.exe
- Size 756KB
- SHA256 4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
- MD5 d6408ae6bf86b97eadfb3f15bbfd7933
- SHA1 dd877b59c9acd80535ad22bdc07525d536a41139
- SHA512 f97da566db808c31ef9813124a7555ce35d3ead23238911935aa85845374dead962587cb252b7fda05c94c9b54b4555ec953e2d31316d2495c73aab148e88dec
- SSDEEP 12288:Gh6IrzSS5jAVxdzI/YraGvkDbjjiraX2u:66IHS0ePk/oaDSaX
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

trickbot banker discovery trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot family
  trickbot
behavioral21
- Target
  ou55sg33s_1.exe
- Size 609KB
- SHA256 a9963808a1a358d6ee26ab88bdab4add50512de1a863aa79937815444ee64da8
- MD5 347d7700eb4a4537df6bb7492ca21702
- SHA1 983189dab4b523e19f8efd35eee4d7d43d84aca2
- SHA512 5efb1bce5b5fe74c886126c7bf3627628842a73d31550aee61b71e462b0cc4256b07ae2dc8c207917c5e134c15b8b1d5f3bbbd76724a9b12188f32ba48c25ac9
- SSDEEP 12288:Y71ezsKspcx7aSekHeX/BoVrWyrl/XYUx58wT7tRw:IYzsDyAS/HeyWql/XYUz8wTDw
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

betabot modiloader backdoor botnet defense_evasion discovery persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Betabot family
  betabot
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  defense_evasion
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral22
- Target
  senate.m4a
- Size 575KB
- SHA256 3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec
- MD5 8bdb30d9f3c697d3f12aea9dd3d83a60
- SHA1 f89fc63457ce4914b5e41ed0b17af0a9e1ac6119
- SHA512 bc7f688736b607baea107ea20d1e6686aed9619b7f10b81b95a74ac652c09696a83160f603c5b106498643c10c8eb60572ffbdcd23db6c12e68c15d9dec5f905
- SSDEEP 3072:1YkPy807G4DQRGSiZ+LwbUcsNTJiFJwjjeh2ULOgKNIfvqoaAUk/vQExVxynJf0m:FPyH7l+4sdJeJoW4gO6q2vfLxyZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

zloader spx139 spx139 botnet discovery trojan
- Zloader family
  zloader
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
behavioral23
- Target
  starticon3.exe
- Size 725KB
- SHA256 7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd
- MD5 e8bbb6d921b79101aea7d906a1798f3d
- SHA1 4fd59822cdedd1b194d27d2c01a9cde6222de1bb
- SHA512 c525e07c65c7be43aa90568f98253b397919cd0f597b1ba446fed51a578ca1aae4c93fa59e1345b20e3216a676ba35c89c67d6ced6bea68da44a53989fa4d656
- SSDEEP 12288:O7q+wuEST6sxwGCwuwn5vE2nyrJppqrNSP9kdrzA9PpXtuRt2BoivOnJztu3vdyB:CqrFvGjF5iZqrQag1t7+nJztuHi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu discovery ransomware
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Djvu family
  djvu
behavioral24
- Target
  str.dll
- Size 536KB
- SHA256 467ea1ab80fb43e2d59cdf16480ed80d0edd43a3a0baa4748300be7024d2b92e
- MD5 bfd5e43617896f082948b3fcbc4839f8
- SHA1 0304d3a521a791359b16813df513feb891167e5a
- SHA512 ec7392577b8f67f6e248b81b6d8d1333d7a15c9b7b957862b4b7c39e59e7b2849ad026850b78fd629f31a5e2287702a0a1486335d7f7f3dc356861cdf5056ab1
- SSDEEP 12288:0bLgn0PC6NT4OhLPkjXhgECrfobaQsdqO76Qa+OCQkkkkkksk0vk2kkvBrZupk9J:0bNqCTrIzhb0omQsqO7mSuZBk
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

zloader bot5 bot5 botnet discovery persistence trojan
- Zloader family
  zloader
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral25
- Target
  svchost.exe
- Size 31KB
- SHA256 02883009e7e310bf670bff6336cb6c05c5ecfe0b40274a99b769e8fbfae19ad3
- MD5 49b8f905867aded45f1f5b3c9bd84209
- SHA1 0a87788428778dba567623ccc9be6825eba4b7c7
- SHA512 1c9d2b7bb3948ad8f3cae541602575b9eacc2a212ab0a6e7c148a24a72e36986e4c46d646244837dc3ea7c71f3db90629f7ee68ef18565d67f93d1f801308361
- SSDEEP 768:cLQBlGFnf6zxV+NKPkvJfbv6/QmIDUu0ti7NAj:dIqsb8QVkzj
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral26
- Target
  update.exe
- Size 12.0MB
- SHA256 3e32145dca0843c6d5258129821afaaeb653ddef7982912fe85ad4b326807402
- MD5 c5c8d4f5d9f26bac32d43854af721fb3
- SHA1 e4119a28baa102a28ff9b681f6bbb0275c9627c7
- SHA512 09f39bccb210f96788193d597463c75d3213afd21ed93ac8c843f150d7cb8630f941f54cd8737cc88177dadeb479e8181b40a7f5219e40c948ff18d1955b4828
- SSDEEP 196608:/CKcbhJ7Th2zINlZGI4KXt8ioZR4KVl8e/BGZfsKu97K1RdF4N/55H+oHVdxv:6f/xG+ifj4KVBZGZfKMP4X5eGXxv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rms xmrig aspackv2 defense_evasion discovery execution lateral_movement miner persistence privilege_escalation rat trojan upx
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies visiblity of hidden/system files in Explorer
  defense_evasion
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- Rms family
  rms
- Windows security bypass
  defense_evasion trojan
- XMRig Miner payload
  miner
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Remote Service Session Hijacking: RDP Hijacking
  Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
  lateral_movement
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Server Software Component: Terminal Services DLL
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Stops running service(s)
  defense_evasion execution
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon
  persistence
- Password Policy Discovery
  Attempt to access detailed information about the password policy used within an enterprise network.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Hide Artifacts: Hidden Users
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral27
- Target
  vir1.xls
- Size 303KB
- SHA256 7a5d5f4ceb3c815d6fb882777d0859b9757e27edd5a95eb1c2b88dc438d09c92
- MD5 f5ec41ec42ebdec9404692dde8fb9d15
- SHA1 39f10e1ea5153fa70be025a2d392dcf62966412e
- SHA512 359fddc66f069137e030d2a039ddcfc76ab0e22769ff58f3a0571bae81fb94f87aed23c995eeab545c578e065339f3c1ea2b0623d33835f44054672f717f9952
- SSDEEP 6144:4ZOljkO5kq4v/+4K+B0H4SJQ7CAW/H/E1P3zTscM:4ZOWOP4OB+B0YyozTscM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28
- Target
  wwf[1].exe
- Size 2.3MB
- SHA256 0263c76856472535f8441f582dac011dbf52f965086f9e59a6930c00b2106073
- MD5 f18334d87221ecb0fb12405814c21912
- SHA1 2875140558c0c17a259ff2d731e5e4a0a823108a
- SHA512 fa96425f2402803b7c34ea27211c33257224f65966cb42c651fa688bc131bbae6dbf7fc743eb055398fc2e4a0841a17ff31097346c4666ba39607e974c22ae2d
- SSDEEP 49152:jUEJpE+TT7TDGBcuHsi7Ly2Cr2SRtgbR9iTp1woifnUWtMbuIJ0y:jBnE+TT/DGTHs8yVr2n99iTpiXfnUWtS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

zloader bot7 bot7 botnet discovery persistence trojan
- Zloader family
  zloader
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral29
- Target
  xNet.dll
- Size 99KB
- SHA256 5d9c2b1822bcaa71ddeaa5426d4312d8e174766ae8864c7add29d7f44cea87f2
- MD5 bf1f76644bddd20339548ebacf7a48eb
- SHA1 38114702114105eb3df3f74bf4c68ef7db436f47
- SHA512 76132c9e29a0a3054cd41c56d5184951d392a2abd1995e14b34c40f14b154914a6990c107e7fcf4139344759ae6048e9ecf0bdaf0447c1cd589dfacbf901b7c5
- SSDEEP 3072:sCMhzHWHfyqxjqCgRGAQIO7ScwpY3wisz0YsXhqnV+xnEd4:sCM52n4RSVPwIhqnV+xnEd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30
- Target
  전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
- Size 545KB
- SHA256 291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2
- MD5 54bef758433c98353b61bf1e2aecefb2
- SHA1 06feb43c6d58eab893396f63aa2e1d0e4542f7d1
- SHA512 3bfb51f9bee7033ebde0f418b88327b7c7a322b3e0572d92ad4cdf37c9fbed22d518c9ce2d8d5638381542bef83077d8054184b9f613b815df6906a99fd4526f
- SSDEEP 12288:fPT9h+l+ofoa/sHoNFU9Zd1jWOYE9QjmJl/2hgDMjhP:fPT9hifJKZd1jWOY2emPOuDMd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

vidar discovery stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar family
  vidar
- Vidar Stealer
  stealer
behavioral31
- Target
  전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
- Size 228KB
- SHA256 aaf7bb9ad358726ca367f1827686dc15fea925f26ab1e201a2768c67472e8890
- MD5 8399865e44e7d6a193f8c8acf547eb31
- SHA1 17e3bee5debada69dadec0b748256925a1a8b1ac
- SHA512 bf9ceb3a36ca874dceb9ccfec8e7635f5f11f83f04226ceb4e2b4b2548dbcecf2618fe5063bec068b1571867984d0beece6b5f9be0747a13ddb53f9a09aa4d61
- SSDEEP 3072:tPTcPP3LvQjfIY9Spek01stm+XIm1EWaVw3ItNVFZUyfUNjhb+P0I1fcj:tPTcPfL43SW1stDXaXw3ItNVTUVjhGy
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral32