Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    hi.exe
  • Size 95.3MB
  • SHA256 fd3cae068143ba3da7b7f107fee522e8a0d11ded2981b90178e76f3a88d8bfca
  • MD5 a9caaef3005dfd44fe439961e3097048
  • SHA1 61218bf295c830e23a246f5d4ab59956b2217a4b
  • SHA512 54fac1afec1b833c112fb3e4c060a41d0ac5bac4bc74cb710a4400baf1f38412de31a314dd0f0f80eb16dcac92f50638ccb2be1d6f2b3196525a65baf4d14377
  • SSDEEP 393216:NVn+SLSF5pdHn2AXUCITkkkkkrkkkkkkkkkkkk6lX0wfGtbYTZb08MQUCITkkkk8:PduvnNG0shAQ31qnMb5OM9TtR
  • TLSH
    T19528598DE620805EC9B264617CFE898005387959CAEF51EDB7CFF636AC5C4E7C406A36
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareaspackv2backdoor158fdd2a4f5abb978509580715e5353f987654321cheatcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionades_stealerchaoscobaltstrikedcratdiscordratdragonforcegcleanergh0stratjlockerlockbitmassloggermodiloadernanocorenjratonlyloggerraworldredlinerokratsectopratumbralvalleyrat_s2vidarvipkeyloggerwarzoneratxoristxwormimpactinfostealerinstallerkeyloggerloaderpersistenceprivilege_escalationransomwareratrevoked_codesignrootkitspywarestealertrojanbootkitspamneshtarevengeratrhadamanthys

  • AdesStealer

    AdesStealer is a modular stealer written in C#.

    stealerades_stealer

  • Ades_stealer family

    ades_stealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Chaos family

    chaos

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Cobaltstrike family

    cobaltstrike

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Detect Rokrat payload

  • Detect Vidar Stealer

    stealer

  • Detect Xworm Payload

  • Detected Xorist Ransomware

  • Detects AdesStealer

  • Detects JLocker ransomware.

  • Detects Rhadamanthys Payload

  • Detects Umbral payload

  • Detects ValleyRAT payload

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • DragonForce

    Ransomware family based on Lockbit that was first observed in November 2023.

    ransomwaredragonforce

  • Dragonforce family

    dragonforce

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • JLocker

    JLocker, also known as JRansomware, is a new Rust based ransomware.

    ransomwarejlocker

  • Jlocker family

    jlocker

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Lockbit family

    lockbit

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modiloader family

    modiloader

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Njrat family

    njrat

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RA World

    RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.

    ransomwareraworld

  • Raworld family

    raworld

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Rokrat

    Rokrat is a remote access trojan written in c++.

    ratrokrat

  • Rokrat family

    rokrat

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Vipkeylogger family

    vipkeylogger

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist

  • Xorist family

    xorist

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • DCRat payload

    rat

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • ModiLoader Second Stage

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • OnlyLogger payload

  • Renames multiple (169) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Windows security modification

    defense_evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3