Extracted

Extracted

Extracted

• • Target
    xceb51c487e986e71ba3694fe9b62370de246fa9345c7bf13c74ccef3c938af5e.exe
  • Size 3.2MB
  • SHA256 ceb51c487e986e71ba3694fe9b62370de246fa9345c7bf13c74ccef3c938af5e
  • MD5 2e97cf7877fb29b7a289e47d7418d9a1
  • SHA1 f52dff27ce33a9fa089498bb5b5e55531c21bb7e
  • SHA512 60a4800cc6a72c868fa12a75adc6afa792596549aba2843e5bb72faaf7f6fd58d7e6310b57a9905eba8c122cd75e0fd2a6a3a8c91f859be9706bcc58509dca24
  • SSDEEP 98304:dIReiycbF+jfELmx+bxKH+fT5rtdckJjP:dI64msL4+fdrQkJr
  • TLSH
    T175F5330E7B69B8E7D6329EB0E4642B9646B12863B4144F3F06C4211D8E3B5F54E3BF24
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral1behavioral2
• • Target
    setup_installer.exe
  • Size 3.1MB
  • SHA256 789dede072a31cd600d58149ae5322ba09af0f2d29a2d3bee58bb7702e715918
  • MD5 6910e29ed0dec7c357416d77ec5b6cee
  • SHA1 0ed5cbbf02e3b6aabfa840f4ef0dd52a8e476f52
  • SHA512 7db5c0d7bb3737b453c9a21adfe4a20a6c3df770764be5806b085a94b648f0dc2766416ed53b5c0869e86802f1d85020ee5678cf7c2d7adbfbf0a696c53ecee8
  • SSDEEP 98304:x1SMIG3+UL2f1bY7onuqntEIT1hQgx4yc2CvLUBsKqjb:x1TuULIdY7onHBT1+eHc/LUCKqjb
  • TLSH
    T129E5331176E2C4F2E990497564987BB6A4FEDFAC07305D9B73A1580F8E3C7A0872F858
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordomani2defense_evasiondiscoverydropperevasionfabookienullmixerredlinesectopratsmokeloadervidarinfostealerpersistenceratspywarestealertrojanupxprivateloaderloader

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Fabookie family

    fabookie

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Nullmixer family

    nullmixer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Privateloader family

    privateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft EdgeCookiesView

    Password recovery tool for Microsoft Edge browser

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4