Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Cone.exe.zip
  • Size 23.6MB
  • SHA256 bfdc255d45686026ca45851aa64bfeb62534df501f6d8b1aa00d98989a37ce82
  • MD5 41c5a955df05c1ecd014b6e5ea600394
  • SHA1 90d22ae293d5b683a628cbc3da7f4ab45843d09b
  • SHA512 9620839fd449b89a0e27447498f7d51de5f23a2f98abd86d8274d69f52638eec46ac3fd09e900cee13b4376accb09ffdb4543c0980ef3b99103d8f8199f075f9
  • SSDEEP 393216:17NoyfKeaAZrInIDuKZy9/GT5Lx1u37m65XjMo66P/xnanisGCRpp4X9:paIKedWI/Zg/c5Lx1u3775jMorP/gi0M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1
• • Target
    2to1ep.bin
  • Size 13.1MB
  • SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
  • MD5 7d1a85e807ff9b48edc2e08a01b35e07
  • SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
  • SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
  • SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdooroffice04defense_evasiondiscoverydownloaderexecutionmetasploitquasarsvcstealerxwormpersistenceprivilege_escalationratspywarestealerthemidatrojanupx

  • Detect Xworm Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Svcstealer family

    svcstealer

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral2
• • Target
    main.pyc
  • Size 12KB
  • SHA256 ef7220d8bc8a9cce0341a88026eef346facaed0f859525d55184caf4df18cb57
  • MD5 0ee8963c24b008f9a96fa492c89e69ef
  • SHA1 5628d9974ea0d4d4c3c5c1a77370ef664d0a8aba
  • SHA512 bc0f7569892dbe8c426997c35fe5439a79be8f753a0c0c2801c8529d29bf5b3982092eaff16bdace479e68efa248b1c38ac7b26ede4a214299fb62475fb4dbe3
  • SSDEEP 384:itYLLo88lQu1DnZnmQ3+9KCAbwgYVJrQkn:22LoHVDnVckb4SG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3
• • Target
    4363463463464363463463463.exe.bin
  • Size 10KB
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 2a94f3960c58c6e70826495f76d00b85
  • SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
  • SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
  • SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  8989c668d82d9bbaf27f5a308ae1e16cnmainoffice04svhost1anasycollectiondefense_evasiondiscoveryevasionexecutionblankgrabberlockbitquasarvidarpersistencepyinstallerransomwarespywarestealertrojanupx

  • A stealer written in Python and packaged with Pyinstaller

  • Blankgrabber family

    blankgrabber

  • Detects Vidar Stealer

    stealer

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Lockbit family

    lockbit

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • UAC bypass

    defense_evasiontrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber

  • Renames multiple (733) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral4
• • Target
    Synaptics.exe.bin
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoorddnsoffice04systemdefense_evasiondiscoveryexecutionexploitdeerstealerhijackloaderquasarstealcvipkeyloggerxredxwormkeyloggerloadermacropersistencepyinstallerratspywarestealertrojanupx

  • DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Deerstealer family

    deerstealer

  • Detect Xworm Payload

  • Detects DeerStealer

    stealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Possible privilege escalation attempt

    exploit

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5
• • Target
    cobaltstrike_shellcode.bin
  • Size 219KB
  • SHA256 b9321c27be4295c15d7f92fafc20d7ccac5f21204b79ebc2fed583dda0197cf9
  • MD5 24d99ba5654cdf31141c66fd9417b7e0
  • SHA1 0e06aedf5b25cf248131c9eff5a331f4bb1fcb67
  • SHA512 351e8c078595d1c829385d0bfbeb2560dd62fa063645e40593ba63af8862fc90bbd24438aebb0fb952cb78bf80b91ea35dbabdc91d760fd69c7f188e45075872
  • SSDEEP 6144:c8X2sNEFy+HVJbny+lgzgeFgUQI9aiGynMOyX:T3NEFy8VJO+GTFgUzaL6MO+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoor1359593325discoverycobaltstriketrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Cobaltstrike family

    cobaltstrike
  behavioral6
• • Target
    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
  • Size 3.4MB
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 84c82835a5d21bbcf75a61706d8ab549
  • SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
  • SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
  • SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7
• • Target
    random.exe.bin
  • Size 6.8MB
  • SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
  • MD5 001e8ad1e0d0800e75b1fa32b07d2a46
  • SHA1 4c4fd4adfbcb8a2c3831f0f9605fcf65b44e9db7
  • SHA512 f0dde843f8b83c74ec05e7dbfa311f6943f5707c5ea641c7adfeab3e8cb2561c77c4ef0b74916fe90267a5c7093df98dd506ca89f1b24c6d5cc86f09539625f6
  • SSDEEP 196608:N0Dyo+Ougx9JW8e0e3/tELtyuT8IziZdG3fz:N0OfKWPKLtVQIeCz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  fbf543fc155c5bf8a148a93a2ba17de68393f0nrif0lmdefense_evasiondiscoveryexecutionamadeydeerstealervidarpersistencespywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Deerstealer family

    deerstealer

  • Detects Amadey x86-bit Payload

  • Detects DeerStealer

    stealer

  • Detects Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral8