Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    ErmWhatsWrongWithMyPC.exe
  • Size 25.2MB
  • SHA256 c2e9fbca414575d5c080d97f378024a4d131d6e1262112aebaa96eafa3592381
  • MD5 cc1de237b93bcbae465f9d3bf4df075a
  • SHA1 72967f94fed66473027c9b36a17bb61cf8e22540
  • SHA512 adc805afbbda05794159d8c03ede6aa011f1301ffdecabd5bd36eed637b53f5799f3479fd9c35a253548b6119a90cf00d8b3dcd745d2b9ea4b0675b152123925
  • SSDEEP 393216:NVn+SLSF5pdHn2AXUCITkkkkkrkkkkkkkkkkkk6lX0wfGtbYTZb08MQUCITkkkks:PduvnNG0shAQ31qnMb5OM9Tth
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  aspackv2backdoor158fdd2a4f5abb978509580715e5353f987654321cheatdefense_evasiondiscoveryexecutionchaoscobaltstrikedcratdiscordratdragonforcegcleanergh0stratlockbitmodiloaderonlyloggerredlinerokratsectopratumbralvidarimpactinfostealerloaderpersistenceransomwareratrootkitstealertrojanades_stealerjlockermassloggervipkeyloggerxoristxwormkeyloggerrevoked_codesignspyware

  • AdesStealer

    AdesStealer is a modular stealer written in C#.

    stealerades_stealer

  • Ades_stealer family

    ades_stealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Chaos family

    chaos

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Cobaltstrike family

    cobaltstrike

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Detect Rokrat payload

  • Detect Vidar Stealer

    stealer

  • Detect Xworm Payload

  • Detected Xorist Ransomware

  • Detects AdesStealer

  • Detects JLocker ransomware.

  • Detects Umbral payload

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • DragonForce

    Ransomware family based on Lockbit that was first observed in November 2023.

    ransomwaredragonforce

  • Dragonforce family

    dragonforce

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • JLocker

    JLocker, also known as JRansomware, is a new Rust based ransomware.

    ransomwarejlocker

  • Jlocker family

    jlocker

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Lockbit family

    lockbit

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Rokrat

    Rokrat is a remote access trojan written in c++.

    ratrokrat

  • Rokrat family

    rokrat

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Vipkeylogger family

    vipkeylogger

  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist

  • Xorist family

    xorist

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • DCRat payload

    rat

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • ModiLoader Second Stage

  • OnlyLogger payload

  • Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1behavioral2