Extracted

Extracted

Extracted

Extracted

• • Target
    VatalityUpdated(1).7z
  • Size 2.9MB
  • SHA256 68d3e1aa3b45e32bd3f0e6b429ee074cb43b0c28f5eb9789b2f75b82c18aeb6a
  • MD5 a0d9edd9e45309cddb3c5355b28ab208
  • SHA1 ee9f542df2026ba0908ef29457ce3d6e4b08642a
  • SHA512 4cf55134ed10b380aa838e042783a918f4897f623a6e1572a739da976ac0368653efe40c3b61b54af2bc943234a000d5802cb1279075bbc5355d133802c0d420
  • SSDEEP 49152:0bemMA503LucDudS4OzeuNajPkRS/KCDK2mm3mj8fBHT91yjdysJjzFKWAfdZdbG:06mL5+u4u5sa7kRStoapJ1yBxjzQ9dZw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutionphantomstealerquasarumbralxwormpersistenceprivilege_escalationratspywarestealertrojangooglephishing

  • Detect Xworm Payload

  • Detects Umbral payload

  • Modifies WinLogon for persistence

    persistence

  • Phantomstealer family

    phantomstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detected potential entity reuse from brand GOOGLE.

    phishinggoogle

  • Suspicious use of SetThreadContext

  behavioral1behavioral2