Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    dbcb9a8ddb3e15bf280cfc33aadc3a86a30fa8dbf459c3c15c02a481de775914.bin
  • Size 470KB
  • SHA256 dbcb9a8ddb3e15bf280cfc33aadc3a86a30fa8dbf459c3c15c02a481de775914
  • MD5 d508e4aa10a8c71ff3f4700f661e2b25
  • SHA1 5db629474b910ad774145556e4fcba112ea8016a
  • SHA512 bdc8a045f43b9d791717f632a41638dc2748a3aa92980378066f1d3fe5b2fe3cfb158afb1488cfcc261514fec902e39d7f8ade155aa6934c4af5390843abbd76
  • SSDEEP 6144:UNHZaj6MEUDW6Tf7097NijEQ3irmHH+VE:m5aj3a677097NiIQ3irmn+VE
  • TLSH
    T1DEA4704EEB4721FAE7FD9878810142BFD36236554B209ED77124BA43E613A8F8C7D681
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  55a681fde07d111b452f99b23fe3761fa93ec7551f3af6e42cc58fbd67f14197fa9b0a3c9346612f723473de8ca875f1privatedefense_evasiondiscoveryexecutionstealcvidarinstallerprivilege_escalationspywarestealerupx5f5708fd8894f71fb7ffc9cd10f0b801fuerytrojan

  • Detects Stealc stealer Version 2

  • Detects Vidar Stealer

    stealer

  • Fuery

    Fuery is a trojan written in Delphi.

    trojanfuery

  • Fuery family

    fuery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2