Extracted

Extracted

Extracted

• • Target
    0EznZvf.exe
  • Size 4.8MB
  • SHA256 5b9f13a92a778876650781c21ae46bac51f5df203d13a1a958b7c68dd50b7d26
  • MD5 c034d05b0a2251cccc0f933b019c7d58
  • SHA1 55ca34b941507a02dfc195b8043688ca3f7e630f
  • SHA512 137dc68891d4194be99fcf6286f44257a79ad7bd211f2a8d301453dd606132c42a9e75da7acf7946e084615c9b2c43655e2dfbebecf22f4925cf6eff30310547
  • SSDEEP 49152:22Tp0Z1UvelS4n8umJoVTraSGj6sP/IUVBQu3YAKC0OXeWUiHfzXuzjG6EG/FEW4:26kGG1DwwTr3Mz2226ruztPHY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  defense_evasiondiscoveryransomwarespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    2f34b5X.exe
  • Size 2.3MB
  • SHA256 2dd15d74151531c7156a20297429cd371a603b458326d7972b2a95fed0e37ad4
  • MD5 17bd4081b31d476755b7768cd4d732a3
  • SHA1 92f40cea85051da8032040ceb6a0a44c81efeb7e
  • SHA512 cb391645f09e1889aed76f1512f8ea50edd7a27161277db04c9edc7dac941257aa1b4cd9ed90ac9c33ba30ea308711c6d7b2283b7c8064b076d934613a785ac2
  • SSDEEP 49152:387Ccat21HcKVhXze73RyQMHjiFp2+TlfxMQnTcoyW8dRX34aZ:6bZBzqsjiFp2+TVxM2Tt94RX3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tr1pernndefense_evasiondiscoverystealcspywarestealerthemidatrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral3behavioral4
• • Target
    EioNXAE.msi
  • Size 14.7MB
  • SHA256 ddc99d20bd11e08d73f5ce056ee868a46194c7bcada8654045740dbfa943934f
  • MD5 6e2a3c6f0afacd6e4d91bd86b8d2fb38
  • SHA1 411a25814e0c98a816619fdcb4d2196655845498
  • SHA512 d2c24648b4d2a4aa8488dd76dd4980a18f5b1d39c9a4d71d6e6e7cfa0029191e37233c071385135e265cb8a1e35493e57c21e8a7becd039409b8c2e60fdb29d5
  • SSDEEP 393216:KmkEdQ03NldhmkEdEmkEdmmkEdfmkEdfmkEdFmkEd:WE2cxbEWEsEzEnEZE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  backdoordiscoverypersistenceprivilege_escalationransomwareratrevoked_codesign

  • Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Sets service image path in registry

    persistence

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral5behavioral6
• • Target
    O6rSznO.exe
  • Size 9.2MB
  • SHA256 a34839575f5c229fc83227e0f48fc0eda198a8a17aea8a46d63fa75971d6af2c
  • MD5 4204fd41af3dfb7cff54464ea8a4e7e4
  • SHA1 16d8d3a532c37e755ddf9700e68ac5e8c094dd09
  • SHA512 114beebaa94eb43325ad91e18880442d7874aa81e6bd43cf1391a1792ecabc6762556254dc4b61116884592bd380e5b900ba7c526003cd20f85bcd4d20553d50
  • SSDEEP 196608:228xNY5CNVUFTIIvQYnwQsL8tSRAw21Vqi3SRv4bNiMpj:uxNY5ouNI8ML3ZsV3SRQ9J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bestworker7666184463defense_evasiondiscoverystealcspywarestealerthemidatrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral7behavioral8
• • Target
    OGm4PbD.exe
  • Size 8.6MB
  • SHA256 d3e31c5dfea816f01a4cd5cb415ac2223bd1f18bea2178861162387d1b6efb10
  • MD5 53e0943978d1606268efce672412aee7
  • SHA1 cadfd71eb86028212734a7a97705e45b5fb05bc6
  • SHA512 5cf6519c50f6ad5bf03b5e80001381f4d90219ec24d80d4a4fd3f0214ea227e6660429d1e77cf2ce255a1e72313fa9bb1269ed53165c1a523b791e469116889b
  • SSDEEP 196608:n/dGwsdWWPEgf8SjAblkhhJZT+pXjuyJTK:nFTWPxf8SsKJEBE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Deletes itself

  behavioral10behavioral9
• • Target
    QoxOWld.exe
  • Size 426KB
  • SHA256 84053411fb0297305b893d8786ea90d828a648608bfe6c827fde518f2e67c7f5
  • MD5 ad08de15741bbcda5ac1b3dc0ee135f1
  • SHA1 cd0d60525254f43cf6effc882e089e708b50e5cc
  • SHA512 6b34fca1364db84b47ab108a60b4edaebd6633b4b5dff20952c61a5616a22400e48e98396cac0013f6378bc0e12fc60321297ea79109b01b5f9cefb40df4acd0
  • SSDEEP 6144:/raxDt86AF82Noe7ex4VyoEsQNackstjsKr4jWMhp8UeplsZ3DtBq+0:yDt81F16eSackEsimC3pW1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11behavioral12
• • Target
    clp1.exe
  • Size 285KB
  • SHA256 07bbff7609b94e8853575e3a6803f33435e8d3ede7d96edd83237b583b76b716
  • MD5 d9160a72105c9d6cb90640bca60aa426
  • SHA1 9d9a05370565419710e8dcc869af231e95f6fa08
  • SHA512 244e8e1b596e08d3dced74cd962faa76c0e3292ccc04d363ca5373907bcb79e68e6c67df49fc2acf58b605de19d8a08409817e9c656c5b91801cb46bff04cdc2
  • SSDEEP 6144:e08PTg5OfhLPzDnHfCeQKIwOYTQBMrvSq+8+ck/aZ:e0O3uKJOq+8+r/a
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral13behavioral14
• • Target
    clp2.exe
  • Size 2.5MB
  • SHA256 1cb6e45260ceb3e87ed70186e68a76387c87f02fafdb1ea1a643ac396f4ebeb6
  • MD5 1ccf1a899a976e837ebd6ea25ab9ed2d
  • SHA1 adeaa80c9762c42ccf43c4bae9dca4feb63d9561
  • SHA512 7ffe75a76f41c03afe1491bef5f0fb011ecdcc45d93ace45dc1ddbcdfa90ed1d91b3d2563f40f47529572533d6d34fac1ee06a848afd4a0a3af28e226ae3ee4d
  • SSDEEP 24576:r4gqDgxMEMLb0BcepQ+VhTHO9VkQbX6v1MDZ88Z8yYRK/WQib24/+UbPE/pF7t7K:r4LMmEB5O9RMyhSb1I/pFRK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral15behavioral16
• • Target
    clp3.exe
  • Size 219KB
  • SHA256 d5028ec38afef94feba1e756701f684e5163c833b706d636c78db0869546a0b4
  • MD5 e6e10a62d3a63acad5ab7d34e614b03b
  • SHA1 f6ba076545d51d7943200a0b4d2bc26e49346e73
  • SHA512 6b8b8a9fe851ae6a564f88c9b246de2e01d2e61c1adf4a4b31fbcbf2b9699fd4b2a7a2603ada26f99ffcfb1127ff82407d4f65622c46ffb2d9d1833305653ffe
  • SSDEEP 3072:u5j76SvHoc773/Oyf054mxIOjAjyM3KZj5lJGvVQSzr0T1u0nOWLLa92bB2M870x:cBH+54m2OCy/JGv/zYJOQATxFe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral17behavioral18
• • Target
    random.exe
  • Size 2.1MB
  • SHA256 02fa7b3938307308295d97e268427d7f9e303157c55b9ad5186944687f9361ab
  • MD5 315bd7da1fcc900d1271b312eb91d09d
  • SHA1 40e81d42da142d02db54a4c17d0fca9346e23a2a
  • SHA512 d253bdf78ddb0b90eb1ad4da6858ca7b8dc08ad6cb4aa06710762a92336dad7da5ac1c4f91ec9efabd1c603cbffdc86cfb748db00f83e10b74137ef0183f677e
  • SSDEEP 49152:IBJpTpc8iYMg+rINgOmgHGPBUlZ7eHupDPl4:yvTFMkiDBU77eHuc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistence

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Enumerates processes with tasklist

    discovery
  behavioral19behavioral20
• • Target
    vkGsO6Q.exe
  • Size 2.4MB
  • SHA256 da14768bd291ad71f8c10c39c71d3c869e488aeca2bb382d9d393fd0597641d6
  • MD5 d41807076538827c81a4a11e5947206c
  • SHA1 f542a3c6bc24f2ef7fd87e0503a682f2e0f7ad47
  • SHA512 9413f49633978681bd489ce34fbc9753de883645cd3ee61b4ecff39a1fa14c412eee520d5eaaaae3fde617b39392212d20c35f63811e00052e6498ed96e724cf
  • SSDEEP 49152:zyq1pQ0SNj9Ofs4dQWcp5WJv15CC8YfVwV/lKlaa:z9pQ98s4CWwWT5CV+2LK1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoverytrojan

  • Windows security bypass

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral21behavioral22
• • Target
    wpnAjnT.exe
  • Size 1.5MB
  • SHA256 f19e395f6af72b7882f8f6c1603e6d762b9c7dfa088759410b0fbc18c458854b
  • MD5 335c9a9b811b79bb2da5dcee26b34502
  • SHA1 c9c0ce60617a348e951c0fb742de037b86635a82
  • SHA512 a0ed0c8959bb30d893114c355a59130a3d5e035769602af861cf897e4cbe500062099044720cc63d7d8f60922d4eefce70de5e20bb777a6b3b3c3ab9a9507242
  • SSDEEP 24576:fHuK+rT7nCRR8q/aHzu5f4xUshxkPKamOSzio/q8dAQvaY6mfdmQp8WvM02l:4AnaHzukUsh8KDLWoCkAFLmfRnM02l
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discovery

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral23behavioral24
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
  • MD5 08e9796ca20c5fc5076e3ac05fb5709a
  • SHA1 07971d52dcbaa1054060073571ced046347177f7
  • SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
  • SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral25behavioral26
• • Target
    zx.exe
  • Size 5.6MB
  • SHA256 4bbfdd9676fecb9b771efa9d6edd7756e6fa88e45b8e73258a52b760c43cd95a
  • MD5 b1afd38d3dc427e0b39c85add64ad1b9
  • SHA1 a637be3178a9c205023ae44f534b3a388475708d
  • SHA512 2d2186a407ddadbed054da9aaf218f71792fc4bbcc89a221d1ccdaa331d44f7db2a25f5aee45503b607c9e7891650fbf7bc8387d6aecd1f2334f0dc82d15e3ee
  • SSDEEP 98304:QeEq2B/JWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAx06btVUJFae583qIb:Qf0HiouWJysVYvsOaoyMxxvjDDAx0ai
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  • Loads dropped DLL

  behavioral27behavioral28