Extracted

Extracted

• • Target
    2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer
  • Size 86.8MB
  • SHA256 bbdfa2ddefb09f82e5c69f48d274228ef77ad84f61ae78b500ba71d525afaaff
  • MD5 9ddfb7cf08a3ac6848d7b8328a22d251
  • SHA1 080eac6d972c2582a411d34bd207bc43b086cb40
  • SHA512 dd5ea59fd0578fbd6fe75f1199b0380166d8069552493b19e7d6481a48703381b5bb5ee0760c6c042df0218d5274ba1ee559e689e477c1a897659a0353f649a4
  • SSDEEP 1572864:0EyQbuBJqUeSLAstlQd8eo0OKMhBGUhuGn0fXt8wrmjWVhEZWxQehNExbF:Dy8u6Y3tlQCoOLhEUhv0fXtwqhN+ePAF
  • TLSH
    T1F3182202BA4A2A69C05AC8B0D2474A934F3130DB123BE5BF51E941743F9E7F49B3E795
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  7e83a51c839b3d4fcfc0473890b46cdadefense_evasiondiscoveryexecutionmaskgram_stealervidarpersistenceprivilege_escalationpyinstallerspywarestealerbackdoorghostsocks

  • Detects MaskGramStealer payload

  • Detects Vidar Stealer

    stealer

  • GhostSocks

    GhostSocks is a proxy malware written in Golang.

    backdoorghostsocks

  • Ghostsocks family

    ghostsocks

  • MaskGramStealer

    MaskGramStealer is an information stealer.

    stealermaskgram_stealer

  • Maskgram_stealer family

    maskgram_stealer

  • Modifies WinLogon for persistence

    persistence

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar
  • Custom signature

    Detects executables (downlaoders) containing URLs to raw contents of a paste

  • Custom signature

    Detects executables referencing combination of virtualization drivers

  • Custom signature

    Detects executables referencing many IR and analysis tools

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VirtualBox drivers on disk

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Looks for VMWare drivers on disk

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2