Extracted

Extracted

Extracted

• • Target
    241127-xqsswsslej_pw_infected.zip
  • Size 12KB
  • SHA256 cf99eaaa334a9c8ffc2fe0e1068ffcc02dda1dd8b2b0eab2821182c5d2c1f51d
  • MD5 79fd058f7d06cc022de1786507eb26e3
  • SHA1 86590ec8ed73fd2951587561dff5387e9e0e18e6
  • SHA512 8316ac3782c05a3ebea4ca0868e33512e5ef29b251498f3af5ab261cd2010dec6b0eca8a57adcadb0d70653be2e22c0c2c137c7a38ec7b3d5ebbdd02e09c0227
  • SSDEEP 384:sBfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWT:wfACW6Dr8HWTHWT
  • TLSH
    T1BC428E567506F363C263CAFA29A45F5CC8C572268865B2C3CC91A8EC25D44F19B07AE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    241127-xqsswsslej_pw_infected/Downloaders.zip
  • Size 12KB
  • SHA256 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
  • MD5 94fe78dc42e3403d06477f995770733c
  • SHA1 ea6ba4a14bab2a976d62ea7ddd4940ec90560586
  • SHA512 add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
  • SSDEEP 384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB
  • TLSH
    T14D428E566546F363C363CAFA39A46F5CC8C572268875F283CC82A8EC25944F197076E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    4363463463464363463463463.zip
  • Size 4KB
  • SHA256 45930e1ff487557dd242214c1e7d07294dbedfa7bc2cf712fae46d8d6b61de76
  • MD5 202786d1d9b71c375e6f940e6dd4828a
  • SHA1 7cad95faa33e92aceee3bcc809cd687bda650d74
  • SHA512 de81012a38c1933a82cb39f1ac5261e7af8df80c8478ed540111fe84a6f150f0595889b0e087889894187559f61e1142d7e4971d05bceb737ed06f13726e7eae
  • SSDEEP 96:XBf1inGx9SfZ+VCv3wlTDMQ1kyKXyyJNOBIKkNvL5qK+7zHf6MlYOQVPGmcEw:XBfwncSf8Cv3w9DZjKXjmBIKEvLs97D3
  • TLSH
    T187A17DA63A41F757C37289B511902B5ED889B6BCD52C9742C703E43E39AA0C21B0DAA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    4363463463464363463463463.exe
  • Size 10KB
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 2a94f3960c58c6e70826495f76d00b85
  • SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
  • SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
  • SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
  • TLSH
    T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoorpaydaytrycredential_accessdefense_evasiondiscoveryexecutionmetasploitneshtaremcosxworminstallerpersistenceprivilege_escalationpyinstallerratspywarestealertrojanupx

  • Detect Neshta payload

  • Detect Xworm Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Adds policy Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral7behavioral8
• • Target
    New Text Document mod.exse.zip
  • Size 7KB
  • SHA256 82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9
  • MD5 a7b1b22096cf2b8b9a0156216871768a
  • SHA1 48acafe87df586a0434459b068d9323d20f904cb
  • SHA512 35b3c89b18135e3aca482b376f5013557db636a332a18c4b43d34d3983e5d070a926c95e40966fafea1d54569b9e3c4ab483eaca81b015724d42db24b5f3805f
  • SSDEEP 192:R5ghioVh+82eei8mXvdTghioVh+82eei8mXvK1B:jHWTHWW
  • TLSH
    T13CF16D568166A3328362DAFE7EADDF4CC9D2720748A2F1D39C8168EC01948B1D7076E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    New Text Document mod.exe
  • Size 8KB
  • SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
  • MD5 69994ff2f00eeca9335ccd502198e05b
  • SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
  • SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
  • SSDEEP 96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
  • TLSH
    T13EF10901DBD0C7BAC6B703B50C63A6408A79E3091A679FAF28CD41A7AD5639C02D3772
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral11behavioral12
• • Target
    New Text Document mod.exse
  • Size 8KB
  • SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
  • MD5 69994ff2f00eeca9335ccd502198e05b
  • SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
  • SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
  • SSDEEP 96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
  • TLSH
    T13EF10901DBD0C7BAC6B703B50C63A6408A79E3091A679FAF28CD41A7AD5639C02D3772
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral13behavioral14