bazarbackdoor

Target
250620-zfp1csgr51_pw_infected.zip
Size 132.7MB
Sample260110-te14caev5f
SHA256 11feda943a94b282ac17c6baad22d80a71e8018909ad267e6b7970d035d995dd
MD5 7233c07d2fdc9a3e89f037454e0922bb
SHA1 9ff57533ec7cafc37b91438704cfead7679ab0e1
SHA512 838408825813ea693756a623f429241abad348ce61a2f82569676658d57309266df1e2b6f1b7fcaabc88f8a76186b3d1304ba220fbdb78e93212eacb74d77dc9
SSDEEP 3145728:klzp78kyCuzMORp3t9MH/yRoGH+Y38Ree332FvV2YYdL625JGS:Wzp7aCWT3tJRoFY3k7grwLzoS
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

http://47.91.237.42:8443/__utm.gif

Attributes

access_type
512
beacon_type
2048
host
47.91.237.42,/__utm.gif
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
8443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS7zRQv7EhhTkbgDrCNBsNay7lzQFmcC/GWwjOq93nKwPSszjIKgtW8nwhtoRhr6MFZx4DSYFdeuJDrtJNcTZz2C/LgZzhSQJmhiEqCkVqPPCfK1C6S4PzDrzy9L794rPLOuoewlGAXgiH5/Ae2aC5k2wedRNfes3DJZDDCaJJYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)
watermark
305419896

Extracted

Family

zloader

Botnet

main

Campaign

26.02.2020

https://airnaa.org/sound.php
https://banog.org/sound.php
https://rayonch.org/sound.php

Attributes

build_id
19

rc4.plain

Extracted

Family

revengerat

Botnet

XDSDDD

84.91.119.105:333

Mutex

RV_MUTEX-wtZlNApdygPh

Extracted

Family

revengerat

Botnet

Victime

cocohack.dtdns.net:84

Mutex

RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family

zloader

Botnet

25/03

https://wgyvjbse.pw/milagrecf.php
https://botiq.xyz/milagrecf.php

Attributes

build_id
103

rc4.plain

Extracted

Family

revengerat

Botnet

samay

shnf-47787.portmap.io:47787

Mutex

RV_MUTEX

Extracted

Family

zloader

Botnet

09/04

https://eoieowo.casa/wp-config.php
https://dcgljuzrb.pw/wp-config.php

Attributes

build_id
140

rc4.plain

Extracted

Family

zloader

Botnet

07/04

https://xyajbocpggsr.site/wp-config.php
https://ooygvpxrb.pw/wp-config.php

Attributes

build_id
131

rc4.plain

Extracted

Family

revengerat

Botnet

INSERT-COIN

3.tcp.ngrok.io:24041

Mutex

RV_MUTEX

Extracted

Family

revengerat

Botnet

yukselofficial.duckdns.org:5552

Mutex

RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family

revengerat

Botnet

system

yj233.e1.luyouxia.net:20645

Mutex

RV_MUTEX-GeVqDyMpzZJHO

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

srpmx.ddns.net:5552

Mutex

c6c84eeabbf10b049aa4efdb90558a88

Attributes

reg_key
c6c84eeabbf10b049aa4efdb90558a88
splitter
|'|'|

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

njrat

Version

0.7d

Botnet

HACK

43.229.151.64:5552

Mutex

6825da1e045502b22d4b02d4028214ab

Attributes

reg_key
6825da1e045502b22d4b02d4028214ab
splitter
Y262SUCZ4UJJ

Extracted

Family

djvu

http://dell1.ug/hdfhgbdgbdbfgteerpenelop/cvnvbndtedfg/get.php

Attributes

extension
.gero
offline_id
CkRzIzWzRp3U1ooEeUkKN4owpKdqn4SHRoxPMtt1
payload_url
http://dell1.ug/files/penelop/updatewin1.exe

http://dell1.ug/files/penelop/updatewin2.exe

http://dell1.ug/files/penelop/updatewin.exe

http://dell1.ug/files/penelop/3.exe

http://dell1.ug/files/penelop/4.exe

http://dell1.ug/files/penelop/5.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-sTWdbjk1AY Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0156mJddLsdH

rsa_pubkey.plain

Extracted

Family

trickbot

Version

100001

Botnet

tar2

66.85.183.5:443
185.163.47.157:443
94.140.115.99:443
195.123.240.40:443
195.123.241.226:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
castor123@

Mutex

245f77ec-c812-48df-870b-886d22992db6

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:castor123@ _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:245f77ec-c812-48df-870b-886d22992db6 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Extracted

Family

emotet

Botnet

Epoch1

12.163.208.58:80
45.33.35.74:8080
87.106.253.248:8080
192.241.146.84:8080
190.115.18.139:8080
65.36.62.20:80
170.81.48.2:80
83.169.21.32:7080
185.232.182.218:80
190.2.31.172:80
77.106.157.34:8080
82.230.1.24:80
202.4.58.197:80
201.213.177.139:80
78.249.119.122:80
123.51.47.18:80
77.90.136.129:8080
60.93.23.51:80
152.169.22.67:80
190.117.79.209:80
60.108.144.104:443
213.197.182.158:8080
82.76.111.249:443
209.236.123.42:8080
190.24.243.186:80
177.74.228.34:80
191.182.6.118:80
96.245.123.149:80
61.197.92.216:80
1.226.84.243:8080
111.67.12.221:8080
216.47.196.104:80
185.94.252.27:443
70.116.143.84:80
187.162.248.237:80
217.13.106.14:8080
80.11.164.185:80
35.143.99.174:80
190.190.148.27:8080
219.92.13.25:80
70.32.115.157:8080
96.227.52.8:443
51.75.33.127:80
95.9.180.128:80
174.113.69.136:80
119.106.216.84:80
111.67.77.202:8080
91.105.94.200:80
178.250.54.208:8080
98.13.75.196:80
2.36.95.106:80
186.70.127.199:8090
116.202.23.3:8080
202.134.4.210:7080
50.28.51.143:8080
45.33.77.42:8080
67.247.242.247:80
137.74.106.111:7080
85.214.26.7:8080
181.30.61.163:443
77.238.212.227:80
185.215.227.107:443
186.103.141.250:443
50.121.220.50:80
74.136.144.133:80
104.131.41.185:8080
61.92.159.208:8080
104.131.103.37:8080
51.15.7.189:80
185.94.252.12:80
94.176.234.118:443
212.71.237.140:8080
5.196.35.138:7080
45.46.37.97:80
70.32.84.74:8080
199.203.62.165:80
38.88.126.202:8080
51.159.23.217:443
155.186.0.121:80
51.38.124.206:80
181.129.96.162:8080
64.201.88.132:80
92.24.50.153:80
189.2.177.210:443
45.16.226.117:443
76.168.54.203:80
185.178.10.77:80
220.109.145.69:80
192.81.38.31:80
68.183.170.114:8080
177.73.0.98:443
138.97.60.141:7080
192.241.143.52:8080
217.199.160.224:7080
185.183.16.47:80
177.129.17.170:443
5.189.178.202:8080
74.58.215.226:80
51.255.165.160:8080
12.162.84.2:8080
149.202.72.142:7080
87.106.46.107:8080
188.135.15.49:80
68.183.190.199:8080
172.104.169.32:8080
68.69.155.181:80
72.47.248.48:7080

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch3

71.57.180.213:80
185.86.148.68:443
168.235.82.183:8080
181.113.229.139:443
181.134.9.162:80
217.199.160.224:8080
105.209.235.113:8080
216.75.37.196:8080
97.104.107.190:80
203.153.216.182:7080
107.161.30.122:8080
41.106.96.12:80
202.5.47.71:80
201.235.10.215:80
105.213.67.88:80
115.79.195.246:80
179.5.118.12:80
212.112.113.235:80
139.59.12.63:8080
177.37.81.212:443
81.17.93.134:80
46.32.229.152:8080
66.61.94.36:80
172.96.190.154:8080
176.9.93.82:7080
5.79.70.250:8080
190.212.140.6:80
37.46.129.215:8080
115.165.3.213:80
201.213.177.139:80
187.64.128.197:80
92.24.51.238:80
185.208.226.142:8080
50.116.78.109:8080
46.105.131.68:8080
181.114.114.203:80
190.190.15.20:80
198.57.203.63:8080
188.251.213.180:443
185.142.236.163:443
182.176.95.147:80
143.95.101.72:8080
181.164.110.7:80
113.161.148.81:80
51.38.201.19:7080
31.146.61.34:80
75.139.38.211:80
157.7.164.178:8081
203.153.216.178:7080
212.156.133.218:80
81.214.253.80:443
87.106.231.60:8080
190.164.75.175:80
77.74.78.80:443
179.62.238.49:80
78.189.60.109:443
177.32.8.85:80
195.201.56.70:8080
190.53.144.120:80
75.127.14.170:8080
177.144.130.105:443
178.33.167.120:8080
192.210.217.94:8080
192.241.220.183:8080
188.0.135.237:80
74.208.173.91:8080
182.187.139.200:8080
172.105.78.244:8080
41.185.29.128:8080
197.83.232.19:80
87.252.100.28:80
115.78.11.155:80
192.163.221.191:8080
91.83.93.103:443
139.99.157.213:8080

rsa_pubkey.plain

Targets

- Target
  ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3
- Size 917KB
- SHA256 ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3
- MD5 d592e787314d1c327dbc2da117e1dc59
- SHA1 ba3a26eaa200d53129e304078309758bbb3c95f1
- SHA512 1e805105ab482c752bd24afa028daa3e7bd83f0258510a6fa2ea0c90eb44d1eec590c926982252dbf3a28bb070befbaea5e78c00d556bd9b380a3c79f1480cf7
- SSDEEP 24576:Hk5FAciH/EjiQXFPQ0NQaScQqYLQnasbbTq4cSJG:Hk5O/EjiuFP32CYL/wnqlUG
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery djvu persistence ransomware
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Djvu family
  djvu
- Renames multiple (159) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
- Size 920KB
- SHA256 efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4
- MD5 4339e3b6d6cf2603cc780e8e032e82f6
- SHA1 195c244a037815ec13d469e3b28e62a0e10bed56
- SHA512 a87c47c998f667eb8ac280f4e6dc3df182d721c44267c68ee042c17e8168115e38f2e1d59c6928ca595bb93b3bfd112cbd7bffb0ee6ff8ca81f469056f26ff87
- SSDEEP 12288:obIkK9q/oPvPrNAuPfZpAvJvqWTe57Zb8Pyfdyr4G8HdsNhAwpC:obDcnrNtPfZpYvqWTeDQIdyrb8HqhNpC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral3 behavioral4
- Target
  emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504._exe
- Size 505KB
- SHA256 ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f
- MD5 cbe9aa4dce4217491cf9bffae2c66537
- SHA1 2b7a15303157f8b9f1cce01e5e7a130628eb2c22
- SHA512 71e2736fafa1be308ef341a937a1c6d0dc5a311952bfb9bfbd492c2e16950508f1aea5e63a8e3614c9a35cdc6a684d3ff6e2dba38fe483af74508d3df41262a5
- SSDEEP 6144:DaRhOv5KaMqEZD+m6eewOmkGOYQ87wwzcCgZi3lzAOAWPcnLiG8Ztkq66ti9pdZx:wOKhDD6yUGOYQto3lzAOATStkfxeY
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

banker epoch1 discovery emotet trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
- Size 448KB
- SHA256 93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1
- MD5 6becbc70725f55f6e6dbe66f383f82bf
- SHA1 7ea5f70e20171e23ccec3c18da638b78dcadfc5c
- SHA512 e3d8815ea584ec745bc103494e123ca489bdc8b8599745548acab449b9630a7e4a8d47c63db752aee63d18d1fec10f961f2f9c4cdc2324c26460c80421e09957
- SSDEEP 12288:ZfzaBuiszJbE9mO4sl9kHAOyQkNvOzxrq:ZbMmO4sl9gR2Ot2
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

banker epoch3 discovery emotet trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet family
  emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  eupdate.exe
- Size 87KB
- SHA256 5d81fc6ab3e6c7bd353ee53297478fc10abfc7f851359f81a65dea74c70156ff
- MD5 ccfaeed043685c189ef498c3c6f675e7
- SHA1 6973b66e83db7f6d9ba957a6f9cca60a4983f0e8
- SHA512 ab8f2d33ec8300d87423f53243f45b720e27d59ab7839d7dcb9d37572c1f4e34536221bfda25dee939218475f44915cac2cf4e9270881af15f53d916bd9dc204
- SSDEEP 1536:ZzfLlsKsEJQgrsOCvojaWr2mACx9lRMgzIY/M0t4T5y5cum:Z7wngrsOCvov2mACDP/IY00eVyc
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery persistence spyware stealer upx
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
- Size 332KB
- SHA256 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f
- MD5 1e0ff1a8078820c5c10652e406d51bef
- SHA1 e191fdbe58b527301eb4bd244a2258ba1cad0182
- SHA512 eb1a011724b988362aa52bdcb69d2886b736dbbe72fe9e53fa3530eeec6bb4089519896a88af48df8e99c7010930fb84cd33599e57f8477e8748cf5259e428a0
- SSDEEP 6144:R+xWEy53Bhj8sW4y9wTeT10hFPascnojIXTvUv7ohqfp2:RSw53Bhj8sW4ya6T6hFPasco4cv7o7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

backdoor dropper bazarbackdoor bazarloader loader
- Bazar Loader
  Detected loader normally used to deploy BazarBackdoor malware.
  loader dropper bazarloader
- BazarBackdoor
  Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
  backdoor bazarbackdoor
- Bazarbackdoor family
  bazarbackdoor
- Bazarloader family
  bazarloader
- Tries to connect to .bazar domain
  Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral11 behavioral12
- Target
  fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
- Size 19KB
- SHA256 fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c
- MD5 6029c37a32d7e4951449e197d4850213
- SHA1 6ed7bb726b1e04d6858c084bc9bf475a13b77c95
- SHA512 bf3639710e259aa38d0cd028071408bdd41c01ee1bd0ea70a16ada78b848c63886854ed40407242e3a68fd9b5444fce2e6ddc050e0c8a2f578b00f43b6c52b6f
- SSDEEP 384:EB8JbJPKd1Bf3rNeD9k4NcKlb5sCSvyP5CtrCzYcHe+Z:EBCNPKd155ulNzxoUzYcHe+Z
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral13 behavioral14
- Target
  fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
- Size 660KB
- SHA256 fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d350
- MD5 b44c5540e020963aca89f3b9a96beb35
- SHA1 14a6e46be7863db3090d81a18d4e080ac005f437
- SHA512 63ffac732d6b6b469f6072efa0b4ad0ef224072418b18ed879fe914c3cb64b6714ca4948c5d1816218d611865a1f1747121e126a407acbcc038b4615f9b7fd31
- SSDEEP 12288:96zG7KjQ+oJLVaRwYdNKxRBUU8vg0whwRKCV50robF7z:9l7eoFsRjdN6BUUP01RKC8EbF/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

banker tar2 discovery trickbot trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot family
  trickbot
behavioral15 behavioral16
- Target
  file(1).exe
- Size 16KB
- SHA256 3ac39ece6e1953f03e88fdfb942bf9f0dcb8d1da643cbd9677032f2ac7861d03
- MD5 9ca9044bbac6aa39072da89d05cb3dcf
- SHA1 7cb6ec980704bf7eb109918a1cb037deed4341fe
- SHA512 5f6cfae5220c219455a180ee6a6fe094fe73475be6acdef24f33476a995097c355af0cf147fd6b986ca3bd84eee0b4928a6d08cabfab63f101259e05d037d9bd
- SSDEEP 384:9jmvn8X19vieB6gb9oDPlMNcLlb5sVKRye5Ct:9jmvni19TBDclMNEho
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  file.exe
- Size 101KB
- SHA256 275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06
- MD5 88dbffbc0062b913cbddfde8249ef2f3
- SHA1 e2534efda3080e7e5f3419c24ea663fe9d35b4cc
- SHA512 036f9f54b443b22dbbcb2ea92e466847ce513eac8b5c07bc8f993933468cc06a5ea220cc79bc089ce5bd997f80de6dd4c10d2615d815f8263e9c0b5a4480ccb4
- SSDEEP 1536:fkSJkZlpqwZoMoG5XoZnOZBX7D/3BINVRX3FjBqa8D3tSYS9h:MXlpqwZoMz5XoZncB/3BINZjy9SYS
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
behavioral19 behavioral20
- Target
  gjMEi6eG.exe
- Size 23KB
- SHA256 2027c43348230de4a40e7ec590d692f744f36cdb13eb65f599983158e920cdb9
- MD5 9ab1a677fb73e7c5a41d151c4c21f69e
- SHA1 10219ed34a3f76ca7fe30eb27a1a78d83c9ada37
- SHA512 0c9f2e1555c36a3742a2ec604faf9a89bfd856946024596912bc116ad7f4fd15ee67969704956d30d70e7b6cb3a626168c309add57469adb03d389df0596f3c5
- SSDEEP 384:nY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZtd:wL2s+tRyRpcnuQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral21 behavioral22
- Target
  good.exe
- Size 143KB
- SHA256 90d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
- MD5 b034e2a7cd76b757b7c62ce514b378b4
- SHA1 27d15f36cb5e3338a19a7f6441ece58439f830f2
- SHA512 1cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
- SSDEEP 3072:VMb/kbqjO/3FxV8l8wiEXHPV9r99rWhzAxH7wpjv4z:VMxo3Z8BvV9rL6h2H7wJ4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery phorphiex loader persistence trojan upx worm
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Phorphiex family
  phorphiex
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  defense_evasion trojan
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  hyundai steel-pipe- job 8010(1).exe
- Size 721KB
- SHA256 8a9bcb387cd155170986cd1938beb317ee1ee511bcb6175a6d292bd976cca15b
- MD5 0999a03694a1c97a43ac0de89cbf355e
- SHA1 0c8fdd4c3b40c4827662baa0c89b5b50d8f0cf1d
- SHA512 6515a13d561d2adb08fd53dba80ecd7ee264b66080848e0c845f63313eb9a828c6be8014d6db47f8ac910e24848dd74c57aae00a92ebe9b4efd97676e0365fe9
- SSDEEP 12288:wdnX6tet6u5CB6m6FQgsPQCjyEtbK7DSQDnwjAR7EOP9uSlcC3ro:QXUim6m6FyPJzcQjNSuYro
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- Hawkeye_reborn family
  hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nd3v_logger family
  m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral25 behavioral26
- Target
  hyundai steel-pipe- job 8010.exe
- Size 721KB
- SHA256 8a9bcb387cd155170986cd1938beb317ee1ee511bcb6175a6d292bd976cca15b
- MD5 0999a03694a1c97a43ac0de89cbf355e
- SHA1 0c8fdd4c3b40c4827662baa0c89b5b50d8f0cf1d
- SHA512 6515a13d561d2adb08fd53dba80ecd7ee264b66080848e0c845f63313eb9a828c6be8014d6db47f8ac910e24848dd74c57aae00a92ebe9b4efd97676e0365fe9
- SSDEEP 12288:wdnX6tet6u5CB6m6FQgsPQCjyEtbK7DSQDnwjAR7EOP9uSlcC3ro:QXUim6m6FyPJzcQjNSuYro
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- Hawkeye_reborn family
  hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nd3v_logger family
  m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral27 behavioral28
- Target
  infected dot net installer.exe
- Size 1.7MB
- SHA256 1371b24900cbd474a6bc2804f0e79dbd7b0429368be6190f276db912d73eb104
- MD5 6eb2b081d12ad12c2ce50da34438651d
- SHA1 2092c0733ec3a3c514568b6009ee53b9d2ad8dc4
- SHA512 881d14d87a7f254292f962181eee79137f612d13994ff4da0eb3d86b0217bcbac39e04778c66d1e4c3df8a5b934cbb6130b43c0d4f3915d5e8471e9314d82c1b
- SSDEEP 49152:znsHyjtk2MYC5GDbQ2cRQh9GexmCxBxVV56CmWQax:znsmtk2aj2cROGom6mGvx
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

backdoor discovery xred persistence
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral29 behavioral30
- Target
  inps_979.xls
- Size 228KB
- SHA256 59afe59cdbebf60434bd78270826ca9689c3765264dfcace312b89c606c0a962
- MD5 56fc044937a072471fdd8d63b874e04a
- SHA1 738552f8db33ac0271aa860775815f3d1b291980
- SHA512 dbaf2e36ec17d474c829d847705de796bea153b784c8e894d4ff7bebb3bfcdf01447d97f217d9303e0eed5aa9b39046b75b2581331be28771582af2ea48c960b
- SSDEEP 3072:bfMhNhd8o7Vym+BoOvuuUVZV/AHyhb3/7428JMPvjLJKHpEYC5ZNWehxleT0t:bfMhL70DBoOmf1FbAJMWEYC5Z3leA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32