Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zGeneral
- Target 260110-31cgjshz9e_pw_infected.zip
- Size 43.9MB
- Sample260211-leyn8aes8e
- SHA256 540fe31359f7aa858f49e84097eef0b399e492a35e57b93265868fbc57b7110a
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
cobaltstrike
-
1359593325
-
http://120.79.181.138:443/pixel
-
access_type
512
-
beacon_type
2048
-
host
120.79.181.138,/pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5q7MB/tbUnzXSL7Zy+R/NrXBsv04yMfdAg46oqaulvNUOMYgsS/FPmKLLTw6knGLWSaH9+NVc0VkhsAjKhzjWIlVJqCoTZYIVu8CKnF/rDxYpmYjmqqd8EBIIxq3QuVWd6z7xYx7AZh1RDlecuKLPtX3fn6p9Wud81SEPl0wlyQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)
-
watermark
1359593325
Extracted
-
mylobot
-
pqrqtaz.ru:9879
-
pickcas.ru:6464
-
quwkbin.ru:3496
-
rkbupij.ru:6653
-
pcqmayq.ru:3629
-
mmuliwe.ru:3541
-
stoizji.ru:5189
-
sfdfrhh.ru:3511
-
ynciazz.ru:4127
-
mkglhnw.ru:1946
-
njeeili.ru:9987
-
dldzeoo.ru:7525
-
tkbiqjq.ru:5145
-
uenosbl.ru:2935
-
faayshc.ru:9865
-
nttfazc.ru:6761
-
nfwsyog.ru:7172
-
uyfusxm.ru:7372
-
hxkclwx.ru:1294
-
zgoysam.ru:2338
Extracted
-
xworm
-
5.0
-
kitchen-english.gl.at.ply.gg:53578
-
police-turkish.gl.at.ply.gg:46359
-
paltalkroom.ddns.net:65236
-
Q9L5WEESFQ4M5VU2
-
install_file
USB.exe
Extracted
-
xworm
-
XWorm V5.6
-
147.185.221.25:63795
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
-
stealc
-
crypt
-
http://196.251.107.23
-
url_path
/7ffc7a279c17c091.php
Extracted
-
redline
-
ddwwnnll
-
196.251.107.104:1912
Extracted
-
quasar
-
1.4.1
-
DDNS
-
193.161.193.99:32471
-
807f3187-d087-4fff-beff-e73293a32af8
-
encryption_key
81A0C14D4C705B3C678E573C849DE7F6A3671A8B
-
install_name
jusched.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
CachedLogs
-
reconnect_delay
3000
-
startup_key
Java Update Scheduler
-
subdirectory
Java
Extracted
-
44caliber
-
https://discord.com/api/webhooks/1146486791835230260/bE9QI2eAT_dyqn0dm7VljbMDjUklfKOXxq3ua0HOtKeG6TIgizThvorpCYQf2NEkabwH
Extracted
-
quasar
-
1.4.1
-
RuntimeBroker
-
wisedreams-53895.portmap.io:53895
-
3660874b-db54-4220-a432-d5fe6599ee7f
-
encryption_key
2EEF46A138D721E58A3C90F6CE7CFC94A47B0492
-
install_name
updater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
SubDir
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
redline
-
cheat
-
154.91.34.165:64951
Extracted
-
vidar
-
13.6
-
158fdd2a4f5abb978509580715e5353f
-
https://t.me/m00f3r
-
https://steamcommunity.com/profiles/76561199851454339
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er
Extracted
-
gh0strat
-
192.168.1.221
Extracted
-
cobaltstrike
-
987654321
-
http://103.171.35.26:9443/dot.gif
-
access_type
512
-
beacon_type
2048
-
host
103.171.35.26,/dot.gif
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
9443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYwABfVZCivHbnjZUO+BO81zPgD/iC2oPyKTKg/ktH1Zbz3KyDsPWnMof9juyAfTGI73mxgqkNUk3MwtLRfIqw+cleDaWzp4gE2tnKy9qy4dqKpTA6yNxxtvSYH3EW3YQb7BsYeNZclmAmezp4zgRUwqydV21a6CYhEsjH2IeQ7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
-
watermark
987654321
Extracted
-
discordrat
-
discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
-
server_id
1350894549899411528
Extracted
-
gcleaner
-
gc-prtnrs.top
-
gcc-prtnrs.top
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-06-14
-
host_password
DhakaHome2024
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.dhakahome.com
-
ssl_slate
True
Extracted
-
vipkeylogger
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
vidar
-
15.6
-
fc155c5bf8a148a93a2ba17de68393f0n
-
rif0lm
-
https://telegram.me/rif0lm
-
https://steamcommunity.com/profiles/76561198783900411
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Extracted
-
amadey
-
5.55
-
fbf543
-
http://94.154.35.25
-
install_dir
96a319e745
-
install_file
Srxelqcif.exe
-
strings_key
f8bfac017914b836f3106c5bcd0878fe
-
url_paths
/di9ku38f/index.php
Extracted
-
ps1
-
ps1.dropper
https://blank-carrot.com:443
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.hhautoinvestment.co.tz
-
Port
21
-
Username
-
Password
fPAg$hB-*4RmYP(+
Extracted
-
quasar
-
91.92.243.78:5007;
-
21012026
-
https://pastebin.com/raw/3Gsg7PXu
-
cb3ef55a-65ab-46be-b469-ed80d478511e
-
encryption_key
E0CD22588C5EB33B575FD706A8CFB26A73302EAC
-
install_name
defender.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Defender
-
subdirectory
defender
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
194.62.55.143:1604
-
QSR_MUTEX_hwrNFd9858cc85nvHX
-
encryption_key
dAtg3ESwbBqj1M9PnYKV
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
xworm
-
196.251.107.104:1177
-
8FhK4zCLETjo4IXf
-
install_file
USB.exe
Extracted
-
vidar
-
15.4
-
7b15bae1e3912ef2376af2468b6b714dn
-
ty5r0t
-
https://telegram.me/nc1anasy
-
https://steamcommunity.com/profiles/76561198785836552
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Targets
-
- Target 260110-31cgjshz9e_pw_infected.zip
- Size 43.9MB
- SHA256 540fe31359f7aa858f49e84097eef0b399e492a35e57b93265868fbc57b7110a
Score1/10 -
- Target cone.exe.zip
- Size 43.9MB
- SHA256 4e5cebe1908e12e8a4ed1198fb01fb87871dbe54847855b11b3540dbc47bbe88
Score1/10 -
- Target 2to1ep.bin
- Size 13.1MB
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
-
Detect SalatStealer payload
-
Detects Amadey x86-bit Payload
-
Detects Vidar Stealer
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Salatstealer family
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Creates new service(s)
-
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target main.pyc
- Size 12KB
- SHA256 ef7220d8bc8a9cce0341a88026eef346facaed0f859525d55184caf4df18cb57
Score3/10 -
- Target 4363463463464363463463463.exe.bin
- Size 10KB
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score10/10-
Detect Xworm Payload
-
Detects DonutLoader
-
Detects Vidar Stealer
-
DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Donutloader family
-
Mylobot
Botnet which first appeared in 2017 written in C++.
-
Mylobot family
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Downloads MZ/PE file
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Detects GoToResolve remote administration tool
GoToResolve is a remote administration tool that can be used as a backdoor
-
Executes dropped EXE
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Synaptics.exe.bin
- Size 764KB
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Score10/10-
44Caliber
An open source infostealer written in C#.
-
44Caliber family
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Detects Rhadamanthys Payload
-
Detects SvcStealer Payload
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Modifies visibility of file extensions in Explorer
-
Mylobot
Botnet which first appeared in 2017 written in C++.
-
Mylobot family
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Svcstealer family
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Contacts a large (7152) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Suspicious Office macro
Office document equipped with macros.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Disables service(s)
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target TsarBomba.exe
- Size 25.2MB
- SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
Score10/10-
AdesStealer
AdesStealer is a modular stealer written in C#.
-
Ades_stealer family
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware
-
Chaos family
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Detect Rokrat payload
-
Detect Vidar Stealer
-
Detect Xworm Payload
-
Detected Xorist Ransomware
-
Detects AdesStealer
-
Detects JLocker ransomware.
-
Detects Umbral payload
-
Detects ValleyRAT payload
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
JLocker
JLocker, also known as JRansomware, is a new Rust based ransomware.
-
Jlocker family
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Masslogger family
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Rokrat
Rokrat is a remote access trojan written in c++.
-
Rokrat family
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Sectoprat family
-
Umbral
Umbral stealer is an open-source modular stealer written in C#.
-
Umbral family
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
ValleyRat
ValleyRat stage2 is a backdoor written in C++.
-
Valleyrat_s2 family
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
Vipkeylogger family
-
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Xorist family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
DCRat payload
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
ModiLoader Second Stage
-
OnlyLogger payload
-
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery
Attempt to gather information on host network.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target cobaltstrike_shellcode.bin
- Size 219KB
- SHA256 b9321c27be4295c15d7f92fafc20d7ccac5f21204b79ebc2fed583dda0197cf9
Score10/10-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
- Target ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
- Size 3.4MB
- SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Score10/10-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Sets desktop wallpaper using registry
-
- Target random.exe.bin
- Size 6.8MB
- SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
-
Detects Amadey x86-bit Payload
-
Detects Vidar Stealer
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
NirSoft NirCmd
NirCmd is a lightweight Windows command-line tool for automating system tasks
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Disables service(s)
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Modifies file permissions
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
6PowerShell
5Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Windows Management Instrumentation
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
5File/Path Exclusions
1Hidden Files and Directories
3Hidden Window
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
5Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Network Service Discovery
3Network Share Discovery
1Peripheral Device Discovery
2Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
14Remote System Discovery
1System Information Discovery
12System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
6