Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zGeneral
- Target 260110-31cgjshz9e_pw_infected.zip
- Size 43.9MB
- Sample260117-vbc3sagy6d
- SHA256 540fe31359f7aa858f49e84097eef0b399e492a35e57b93265868fbc57b7110a
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
cobaltstrike
-
1359593325
-
http://120.79.181.138:443/pixel
-
access_type
512
-
beacon_type
2048
-
host
120.79.181.138,/pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5q7MB/tbUnzXSL7Zy+R/NrXBsv04yMfdAg46oqaulvNUOMYgsS/FPmKLLTw6knGLWSaH9+NVc0VkhsAjKhzjWIlVJqCoTZYIVu8CKnF/rDxYpmYjmqqd8EBIIxq3QuVWd6z7xYx7AZh1RDlecuKLPtX3fn6p9Wud81SEPl0wlyQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)
-
watermark
1359593325
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
91.151.95.112:1604
-
QSR_MUTEX_L8AWYFSXAaJziO1ajz
-
encryption_key
G2WUHJaRgAk0FybAFvFu
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
metasploit
-
metasploit_stager
-
43.134.163.224:4444
-
103.165.81.230:8848
Extracted
-
stealc
-
crypt
-
http://196.251.107.23
-
url_path
/7ffc7a279c17c091.php
Extracted
-
xworm
-
196.251.107.104:1177
-
196.251.107.23:1177
-
Install_directory
%Userprofile%
-
install_file
synhost.exe
Extracted
-
asyncrat
-
0.5.8
-
Default
-
196.251.107.104:6606
-
196.251.107.104:7707
-
196.251.107.104:8808
-
kqNlEor85bqX
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
-
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Extracted
-
amadey
-
5.55
-
fbf543
-
http://94.154.35.25
-
install_dir
96a319e745
-
install_file
Srxelqcif.exe
-
strings_key
f8bfac017914b836f3106c5bcd0878fe
-
url_paths
/di9ku38f/index.php
Extracted
-
vidar
-
15.6
-
fc155c5bf8a148a93a2ba17de68393f0n
-
rif0lm
-
https://telegram.me/rif0lm
-
https://steamcommunity.com/profiles/76561198783900411
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Extracted
-
xworm
-
5.0
-
185.208.156.243:7099
-
paltalkroom.ddns.net:65236
-
G08T4qvnb13kYZnR
-
install_file
USB.exe
Extracted
-
mylobot
-
pqrqtaz.ru:9879
-
pickcas.ru:6464
-
quwkbin.ru:3496
-
rkbupij.ru:6653
-
pcqmayq.ru:3629
-
mmuliwe.ru:3541
-
stoizji.ru:5189
-
sfdfrhh.ru:3511
-
ynciazz.ru:4127
-
mkglhnw.ru:1946
-
njeeili.ru:9987
-
dldzeoo.ru:7525
-
tkbiqjq.ru:5145
-
uenosbl.ru:2935
-
faayshc.ru:9865
-
nttfazc.ru:6761
-
nfwsyog.ru:7172
-
uyfusxm.ru:7372
-
hxkclwx.ru:1294
-
zgoysam.ru:2338
Extracted
-
svcstealer
-
http://158.94.208.102/diamo/data.php
-
http://196.251.107.61/diamo/data.php
-
http://196.251.107.23/diamo/data.php
-
http://178.16.53.7/diamo/data.php
-
bot_urls
http://213.226.113.54/bin/bot.dll
-
build_id
16/11/2025
-
srv_delay
1
-
srv_retry
1
Extracted
-
njrat
-
0.7d
-
HacKed
-
hakim32.ddns.net:2000
-
exchange-reasonably.gl.at.ply.gg:30620
-
f41ac0c2ea25f3f8b0a75a7371d6b015
-
reg_key
f41ac0c2ea25f3f8b0a75a7371d6b015
-
splitter
|'|'|
Extracted
-
xworm
-
XWorm V5.6
-
147.185.221.25:63795
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
-
bdaejec
-
ddos.dnsnb8.net
Extracted
-
discordrat
-
discord_token
MTE1ODQ5NzkyODQ2MjIwNTExOQ.GRJ0l6.7SpFGKSu5G_J8dWAJje9hfCtSecIS6RuVXIE_E
-
server_id
1153564868197236846
Extracted
-
quasar
-
1.4.1
-
DDNS
-
193.161.193.99:32471
-
807f3187-d087-4fff-beff-e73293a32af8
-
encryption_key
81A0C14D4C705B3C678E573C849DE7F6A3671A8B
-
install_name
jusched.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
CachedLogs
-
reconnect_delay
3000
-
startup_key
Java Update Scheduler
-
subdirectory
Java
Extracted
-
gurcu
-
https://api.telegram.org/bot7617703274:AAFEXxgPRP1fZGT5UCjcRV4hUZdtNFxyusQ/sendMessage?chat_id=-4568449403
-
http://209.38.221.184:8080
-
http://46.235.26.83:8080
-
http://147.28.185.29:80
-
http://206.166.251.4:8080
-
http://51.159.4.50:8080
-
http://167.235.70.96:8080
-
http://194.164.198.113:8080
-
http://132.145.17.167:9090
-
https://5.196.181.135:443
-
http://116.202.101.219:8080
-
https://185.217.98.121:443
-
http://185.217.98.121:8080
-
http://159.203.174.113:8090
-
http://107.161.20.142:8080
-
https://192.99.196.191:443
-
http://65.49.205.24:8080
-
https://154.9.207.142:443
-
http://67.230.176.97:8080
-
http://8.222.143.111:8080
Extracted
-
redline
-
LiveTraffoc
-
4.185.56.82:42687
Extracted
-
blackmatter
-
25.239
Extracted
-
quasar
-
encryption_key
E679E56ABD1A0F53D68F323812B24E67488502F6
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
redline
-
cheat
-
154.91.34.165:64951
Extracted
-
vidar
-
13.6
-
158fdd2a4f5abb978509580715e5353f
-
https://t.me/m00f3r
-
https://steamcommunity.com/profiles/76561199851454339
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
-
gh0strat
-
192.168.1.221
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er
Extracted
-
cobaltstrike
-
987654321
-
http://103.171.35.26:9443/dot.gif
-
access_type
512
-
beacon_type
2048
-
host
103.171.35.26,/dot.gif
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
9443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYwABfVZCivHbnjZUO+BO81zPgD/iC2oPyKTKg/ktH1Zbz3KyDsPWnMof9juyAfTGI73mxgqkNUk3MwtLRfIqw+cleDaWzp4gE2tnKy9qy4dqKpTA6yNxxtvSYH3EW3YQb7BsYeNZclmAmezp4zgRUwqydV21a6CYhEsjH2IeQ7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
-
watermark
987654321
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-06-14
-
host_password
DhakaHome2024
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.dhakahome.com
-
ssl_slate
True
Extracted
-
vipkeylogger
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Targets
-
- Target 2to1ep.bin
- Size 13.1MB
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Detect Xworm Payload
-
Detects SvcStealer Payload
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Svcstealer family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Async RAT payload
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target 4363463463464363463463463.exe.bin
- Size 10KB
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score10/10-
Detect Xworm Payload
-
Detects DonutLoader
-
DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Donutloader family
-
Modifies WinLogon for persistence
-
Mylobot
Botnet which first appeared in 2017 written in C++.
-
Mylobot family
-
Njrat family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Svcstealer family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Synaptics.exe.bin
- Size 764KB
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Bdaejec
Bdaejec is a backdoor written in C++.
-
Bdaejec family
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Blackmatter family
-
DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
-
Deerstealer family
-
Detect Neshta payload
-
Detect SalatStealer payload
-
Detect Xworm Payload
-
Detects Bdaejec Backdoor.
Bdaejec is backdoor written in C++.
-
Detects DeerStealer
-
Detects MaskGramStealer payload
-
Detects Mimilove part of Mimikatz
-
Detects SvcStealer Payload
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Gurcu family
-
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
MaskGramStealer
MaskGramStealer is an information stealer.
-
Maskgram_stealer family
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
Mylobot
Botnet which first appeared in 2017 written in C++.
-
Mylobot family
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Salatstealer family
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Svcstealer family
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
mimikatz is an open source tool to dump credentials on Windows
-
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Async RAT payload
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
ModiLoader Second Stage
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target TsarBomba.exe
- Size 25.2MB
- SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
Score10/10-
AdesStealer
AdesStealer is a modular stealer written in C#.
-
Ades_stealer family
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware
-
Chaos family
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Detect Rokrat payload
-
Detect Vidar Stealer
-
Detect Xworm Payload
-
Detected Xorist Ransomware
-
Detects AdesStealer
-
Detects JLocker ransomware.
-
Detects Umbral payload
-
Detects ValleyRAT payload
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
JLocker
JLocker, also known as JRansomware, is a new Rust based ransomware.
-
Jlocker family
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Masslogger family
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Rokrat
Rokrat is a remote access trojan written in c++.
-
Rokrat family
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Sectoprat family
-
Umbral
Umbral stealer is an open-source modular stealer written in C#.
-
Umbral family
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
ValleyRat
ValleyRat stage2 is a backdoor written in C++.
-
Valleyrat_s2 family
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
Vipkeylogger family
-
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Xorist family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
DCRat payload
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
ModiLoader Second Stage
-
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
- Target cobaltstrike_shellcode.bin
- Size 219KB
- SHA256 b9321c27be4295c15d7f92fafc20d7ccac5f21204b79ebc2fed583dda0197cf9
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Drops file in System32 directory
-
- Target ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
- Size 3.4MB
- SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Score10/10-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Sets desktop wallpaper using registry
-
- Target random.exe.bin
- Size 6.8MB
- SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
-
Detects Amadey x86-bit Payload
-
Detects Vidar Stealer
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Disables service(s)
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Stops running service(s)
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
3Change Default File Association
1Installer Packages
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
3Change Default File Association
1Installer Packages
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
2File/Path Exclusions
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
9Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
10Remote System Discovery
1System Information Discovery
9System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2