Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged/JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe
  • Size 938KB
  • SHA256 08c29dfa0ccb747751c5ff3ccde88f7f8a5a87152121f75f60a886b14e86bf00
  • MD5 2363f93331fc792ae9cb5750043bdc89
  • SHA1 2fc0b7b4106a28ffe7f63f36ff64fe045e8f7daa
  • SHA512 a4a47c39e03c22844725b51ffd56f3ae01e9095733e8442eaba1fcf0e3a0e1edb127a6bf4b5ab8063614829db27919dea5a0e62f9e7d320e625fc498a603ad3e
  • SSDEEP 24576:PYrNtws0/BP9qDVgk7YIPo0NJ+ISzFKs:PM7YBlqDVbNNJNS0s
  • TLSH
    T10015CF0021796FA2F93C97F52649621883F9369F08EEE7740CE5B0E711B9F875A50AC7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionmatiexkeyloggerpersistencespywarestealer

  • Family: Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1
• • Target
    Red-Flaged/JaffaCakes118_30f515392358142b507a486d7ab379d2.exe
  • Size 70KB
  • SHA256 c36f30481ce328712716ed35515c79075b411ac492164996e9078a540f89f4e2
  • MD5 30f515392358142b507a486d7ab379d2
  • SHA1 d1b8436f0d752e965dae8cc2459cedd5647d00ea
  • SHA512 208773ac0578e1099a3e4f47c50d6dcb938748182922fc73105179e66f9386225b6f3c65689fa6d23a620303e9ee8f1e7f8e16251f7aa2f3f47a4b4ee52d1c48
  • SSDEEP 1536:oT+dIkJg6exZOWCYsPlFAFbDNkgRO5JylSp4mlG6hK4UZygM:oBkMxsYylFAFDWgIyIGIK4UZygM
  • TLSH
    T1616312A4FBBE1DEFD4FF0533022E90121166E431109185979EF4BC9C7C24BB9D88867A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  blackwoodaptbackdoordiscoveryprojectwoodupx

  • Detects ProjectWood Payload

    backdooraptblackwood

  • Family: ProjectWood

    ProjectWood is a backdoor attributed to BlackWood APT group.

    backdoorprojectwood

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral2
• • Target
    Red-Flaged/JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe
  • Size 625KB
  • SHA256 293d7e82688a0af531aca5d3197c2671d4c7be759463d71d1415438d91333aae
  • MD5 337dd03f1d287dcdb6471704d14aa3b6
  • SHA1 a13f40e7fadd226795a6a57bd5e5bd8b8fce568d
  • SHA512 7224d57da3b108ae2b28f380c50045cf7307a805c8a7c1ab5f9933074596172e2c52f5c74af8e219aee0f0ea95a2552dd6a6048acf5742171d6d0c63d54b4bea
  • SSDEEP 12288:96Hz52J2DT1mWK5u0MH/reKpvN7fxBLaAsNWGqgmeBWDroj43V:QHl2J21mWK5ufHiKpvNzPLaAsNWGqijQ
  • TLSH
    T164D44B76E60389F5DE7705F1054BFBBBA620DA0984328C5FD788CE90AFF6C22145D626
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerepoch2discoveryemotettrojan

  • Family: Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Drops file in System32 directory

  behavioral3
• • Target
    Red-Flaged/Jigsaw.exe
  • Size 283KB
  • SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
  • MD5 2773e3dc59472296cb0024ba7715a64e
  • SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
  • SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
  • SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
  • TLSH
    T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jigsawpersistenceransomwarespywarestealer

  • Family: Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Renames multiple (1629) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral4
• • Target
    Red-Flaged/Locky.exe
  • Size 180KB
  • SHA256 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
  • MD5 b06d9dd17c69ed2ae75d9e40b2631b42
  • SHA1 b606aaa402bfe4a15ef80165e964d384f25564e4
  • SHA512 8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
  • SSDEEP 3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
  • TLSH
    T19404D0BB715D8806FF75947640CC2A23DDE3E8B091ADDE23A68346E78C852DC58C9727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylockyransomware

  • Family: Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky

  • Checks for any installed AV software in registry

  behavioral5
• • Target
    Red-Flaged/MuckModLoaderSetup2.1.1.exe
  • Size 84.7MB
  • SHA256 ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317
  • MD5 8f43e321dec9dd12d638776a36ee194e
  • SHA1 9a36263e9e95812c8d756f6ac16c00e229483927
  • SHA512 35d3e59c1326d76623981dcfadf670de64bd978f8720285b3818de50732d7cd89bcf6f5d46422739fdcd5e151d17f9ec65c508e6d18d029c5fd18b2455c273cb
  • SSDEEP 1572864:jA+BWMFDe45kntGZ6hDRVOy1menoUu9Ma7vWZsYez153UubP7/5:jRBFle45yxhDRV7nohfvgo53UkPN
  • TLSH
    T11E18331C38E0CB5AC86EF97BE0731F1216A4704A2FC5775BB937AD8A64A8F51D730252
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiongenesis_stealerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: GenesisStealer

    GenesisStealer is an infostealer based on Electron.

    stealergenesis_stealer

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral6
• • Target
    Red-Flaged/MyDoom.A.exe
  • Size 22KB
  • SHA256 fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
  • MD5 53df39092394741514bc050f3d6a06a9
  • SHA1 f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
  • SHA512 9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0
  • SSDEEP 384:96ZQHXcE7hUHwT56cC9Kg65JdwGADkHw/Rjxtuu7VIGGwQWEqpD6:CavuHAUcW/ojwG6kHw/lxqbW
  • TLSH
    T134A2E14996B41DFBC08707728AB3761197551538E0F99387E73C4F9FA0762A8F74E902
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymydoomupxworm

  • Detects MyDoom family

  • Family: MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral7
• • Target
    Red-Flaged/N-W0rm.exe
  • Size 16KB
  • SHA256 fffe3c68f5caeea568830803b982c3e58ad3e101e0241614bf5e87d2c07e7ab4
  • MD5 9301efdf355b6379aef4ba98dab78718
  • SHA1 308ac5df7bf6fe34115522d685814a49778c5539
  • SHA512 6cb47cb290330ad694cd8224c518ad063db61ed530a41b3eca1f3bf5b425e7a03141e8a55f1568884fc1c7e4a2df63f82d16587ad81928bbd17081bfdba6e8f1
  • SSDEEP 384:c71T+Rh/1xo+/6KPN/FYdQ8bDKgJRaqcJl74CoBU:c7sxroXKxFgXbmVL4CoW
  • TLSH
    T1F672FA0067F98625E2FE0BB85CB3431052F5E6535A32D7DBACC850EE6863FD48602BE5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  downloadernwormworm

  • Family: NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  behavioral8
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral9
• • Target
    Red-Flaged/Product Sample pdf.exe
  • Size 612KB
  • SHA256 7765f79c31ac9fb10bc37a24b769738c61d2f562b0758c3a0a4ebe176ae0d7de
  • MD5 22e87999f93e9368b2272cdd49cf49d7
  • SHA1 68addbfad46359c58eb68dad524db6294838e02a
  • SHA512 4fff863181463b78b11523eda50ef67b80ae0964996fe4660db31fafa22f5a203551dbd15836534c3c426d2351ca6038a0d1eaeb1833b03c2ca9eefaff00e3e6
  • SSDEEP 12288:TMF/qkQz5Vj+OMR8HnTgLJuAliyJ5/wd8ln4R0tW1cPOVk:IFvS68HnTgL4yD/wzR0uc
  • TLSH
    T165D423636330C524D6FC48749CDBCB921661BAE38863634BABB4ED442DFA1D0F1A1F95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryhawkeyekeyloggerpersistencespywarestealertrojan

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral10
• • Target
    Red-Flaged/Remcos.exe
  • Size 92KB
  • SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
  • MD5 fb598b93c04baafe98683dc210e779c9
  • SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
  • SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f
  • SSDEEP 1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6brM:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+7
  • TLSH
    T12F93C713FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA419D79892D416EBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hostdefense_evasiondiscoveryremcospersistencerattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral11
• • Target
    Red-Flaged/Rensenware.exe
  • Size 96KB
  • SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
  • MD5 60335edf459643a87168da8ed74c2b60
  • SHA1 61f3e01174a6557f9c0bfc89ae682d37a7e91e2e
  • SHA512 b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb
  • SSDEEP 3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx
  • TLSH
    T118A3E0417AE1AE3BC67A6EBA197546410BB677386030E7DD0C8250CE29E3F044A91FDB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral12
• • Target
    Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe
  • Size 1.2MB
  • SHA256 b6968bc63433009553101e5303b880d403e2a2a0c6521694ddb122e25336ad82
  • MD5 342fe7a48d34f0eb772e4cc606fb71b0
  • SHA1 4579992d607dda5ab61c9b5ff92e10499826c40f
  • SHA512 b1d4a6afb0c51de519227a25ee7fe5f34bf02790d61c9d70a9edb42f6003e091c49a1148bed100bb2ba2d75d1e48edc26b1de61ccf2430069cfe65ba8a7538c3
  • SSDEEP 24576:tVxWxeVzdyMxGn3etxHGWIxMN7BOPlQbX8mS8jmEXp7RMuiMGZ1OkV95jbbeQEUz:PxWxSdyMxGn3dM9BOIFrLpvfK1B7Eeg
  • TLSH
    T1FF451254B2A0C827C9B946F20E31FA7107F91EDE6411D3C88DD4ADEF79EAF045A41A63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral13
• • Target
    Red-Flaged/Synaptics.exe
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • TLSH
    T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorddnscredential_accessdefense_evasiondiscoveryexecutionasyncratblankgrabberdonutloaderjigsawmimikatzquasarredlinerustmewannacryxredxwormimpactinfostealerinstallerkeyloggerloaderminerpersistencepyinstallerransomwareratrevoked_codesignspywarestealersuricatathemidatrojanupxworm

  • A stealer written in Python and packaged with Pyinstaller

  • Async RAT payload

    rat

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Detects RustMe Keylogger

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: RustMe Keylogger

    RustMe is a keylogger written in C++.

    keyloggerrustme

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber

  • Quasar payload

  • RedLine payload

  • mimikatz is an open source tool to dump credentials on Windows

  • Contacts a large (4669) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Renames multiple (1012) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Creates new service(s)

    persistenceexecution

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Sets desktop wallpaper using registry

    ransomware

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral14
• • Target
    Red-Flaged/Uniformitarian.exe
  • Size 357KB
  • SHA256 b0e8491d0558fe31d0e2f591e7c09beb20321b5551b008dec47da8c1b14c28ca
  • MD5 c01c24af72defeeed00f9dd92f17d088
  • SHA1 4b62292bee5e31480ff76ef731252a2ac4a2507a
  • SHA512 ce7ebba8b1c34db6da527ea83781002eaf12a8a48b3886df2227c80d3dc57c7885f66765bfdfffb7f8d79d54271866808d6354d1c4fa7ef9375e6f67d8cee96e
  • SSDEEP 6144:dMm4CCsD9RbmZGgnCroDxzSc+WIG01nv50tf45xAyI/bDli5uTwFOCxlteEq3D1y:dMwpD9tQ3DIc+WI7Fqtf45zI/vliIpCz
  • TLSH
    T1027401407264D40AECA047710DBAE9F21761BEA2BEB2C20F3314BB6E7F727C5551A761
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloader

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral15
• • Target
    Red-Flaged/VerifierImGui.exe
  • Size 4.5MB
  • SHA256 966437012d3312230a38ec8b025140a6f55932a60b012e5d0fe649c8a6b71b17
  • MD5 07a189f58bee10ea63188b80f35ee141
  • SHA1 f866b03f473ac2fb064af333c6e4049274af75ad
  • SHA512 6a99481b528e44c4cec756c6afbf62c918cfbbbce8728a70dbe1446110c6e6d01fbb006480535b7ae20269e59b6c73942146ce31c4e3aa5a012afd528b1bfda0
  • SSDEEP 98304:lGjW4HRD7eWKnxG/oM7CzWTEoYsQr4oPkInb0XTYafLGZ/eA:l0D5N/7GzWvYcoDmF6Z/eA
  • TLSH
    T1A9263355AC54F592E2E52FF4E8FBC8D3B5133E1214AADB4D82037AC2D6A2D5A181D333
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnetsupportrat

  • Family: NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral16
• • Target
    Red-Flaged/WannaCrypt0r.exe
  • Size 3.4MB
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 84c82835a5d21bbcf75a61706d8ab549
  • SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
  • SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
  • SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
  • TLSH
    T173F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealersuricataworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral17
• • Target
    Red-Flaged/WarzoneRAT.exe
  • Size 321KB
  • SHA256 61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2
  • MD5 600e0dbaefc03f7bf50abb0def3fb465
  • SHA1 1b5f0ac48e06edc4ed8243be61d71077f770f2b4
  • SHA512 151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9
  • SSDEEP 6144:62GhN2db088fTdUuNU0we+HPps1zcJLVPzGKfwQ7PHC3NJTyhtPB1m:62iNG088fTWsU0wJBsGJPf4Q7PHC3NJ8
  • TLSH
    T12E6429AA71CD71EEC41BC0718D58BE6CBA202C26560B4D075C53B19D993CA839FB35BE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionwarzoneratinfostealerpersistenceratrezer0

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral18
• • Target
    Red-Flaged/Xeno.exe
  • Size 482KB
  • SHA256 ddc3190dab77cfc8d440a86493c63a18b11b09fcaad75e5473ecca50271fb662
  • MD5 948bcc43d72208af81d8cc6c2eb79e31
  • SHA1 a508a6e50019607c56ce0763e262cbd6af521999
  • SHA512 1065fe1b284d9644f50f714f3af749e83cee4cd762437ccfaa5009122b7362981fa1161354bfe079b5f7733b38abfa40738aa0d2a1f3d989a44784cca41fb06f
  • SSDEEP 12288:FtGZhOVnihkVNoZtL+EP8nbJRiAfbouxUyzzqMNMC:FtxbVbI8bJRiAfbouxUyzzqMNb
  • TLSH
    T138A48D0537B8812AE16F9BB8C9A1154BD772BD43DB12F3CF0A8469E91D32B80DD29753
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionumbralxwormpersistenceratstealertrojan

  • Detect Xworm Payload

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral19
• • Target
    Red-Flaged/XenoUI.exe
  • Size 183KB
  • SHA256 98d095613f420203d445efeca9e371f280b31f3045a206994d8b7269b2992be8
  • MD5 698aaef134cace60b8aa39d3d814e58a
  • SHA1 8a8b4aa6477b35d70bdf6b0f3bf4e89d918042ed
  • SHA512 a6ed50d35df4ab8a18299650137db85da06ff490b0cbde50bd2dcbf333437bc9ce2831d102afad18d1aa79dbec395c412713664aa1f88ee6121dcbd7b49ccb24
  • SSDEEP 3072:DmAoHczqCQgVuq0ENQtVEtGO/L1rVItIl1fkgcufu/6MW9DQ9bavWiV:yAo+QgMLENQwkYL/cyfkUfu250b2Wi
  • TLSH
    T1E304E0807786AAB5E7BE06F854F1936C8275C39B1102DB1A0CCB55ED1631BD9E213CEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bulkaexecutionsheetratpersistenceprivilege_escalationtrojan

  • Detects Sheetrat Obfuscated Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral20
• • Target
    Red-Flaged/YnGOp-loader.exe
  • Size 229KB
  • SHA256 b95ce1b5a24ca3598a0f3e2669f961c37304e79be6193dee6287483cca4d5319
  • MD5 c4f9feea68b5c6ec3b4d879ce1df6c84
  • SHA1 5e9e98e9189bfe4ad09ecbc4de7b4d01f294057b
  • SHA512 2f173eba5f257a9991ae2aaf2c6b5b945eed523579330675bf561fd6a27d5a95892c2dd007bd6cb4c48a0ebe8bca609d56fc3500cc9a11841b74029aded52905
  • SSDEEP 6144:lloZM+rIkd8g+EtXHkv/iD47dcxhv0IHl2PxM4dTnb8e1m6i:noZtL+EP87dcxhv0IHl2PxM4dnA
  • TLSH
    T134346C5933B8CB17E25F8BBDD5B1148F87B1F143E90AF7CE0C8899E82412742E949A57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  umbralstealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral21
• • Target
    Red-Flaged/_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe
  • Size 12.4MB
  • SHA256 13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7
  • MD5 4be1ae298b7174f13c9ef8dce3b7d800
  • SHA1 1eabc2abf54e6905480d7abd9c5b7314259293fb
  • SHA512 eca339079d768701ca68524149885ee8436ffc48601dc49eb3e0f42dbedd1c353821de2bed8172d3a3517b5376df49b35f2fec13892c2c8795d3f4dc9e355d0c
  • SSDEEP 98304:3RkyhrOHMsfh0V28cni6KsjtO0QVgIX0y4GvwSTe19FMyZ8dQI:3nhr/spCTcxteuddGvwSTex
  • TLSH
    T18FD65B6B76618568C35DC13BC0A38F05E83371B91733C6E783A402686F5A9F45EBE678
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  tag_150aptcastleratpersistencespywarestealertrojan

  • Detects C variant of CastleRAT.

    trojanapttag_150

  • Family: CastleRAT

    CastleRAT is a trojan available in both Python and C variants.

    trojancastlerat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral22
• • Target
    Red-Flaged/_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe
  • Size 17.0MB
  • SHA256 1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e
  • MD5 2e5e97bd2d075d8e42c2d95c421c3213
  • SHA1 8f50be4682f83f201551b668d8aa18410fdb9ade
  • SHA512 b8e7dafd52fbe7d55ec17ef5877ba457dac6b5142f8e31b1eaf9a6f6481b342ce19236297c0cd4727fe992326e84a2d0a023cfc8f06bf067aed10252e740bb78
  • SSDEEP 196608:S8jdgKJ3c9rqUqE/bJQhahFmzVANKptHHQXDU5P1wbHXqbzwejuVDch5ly22RmoY:bMD1xw/tQXDU5P1w+wVDcvz2Rmow6Szn
  • TLSH
    T1A207333BF364A03ED4AA0B3244B396604937BE255A0A4C9F07EC394DDF765611E3BA47
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverycastleloaderinstallerloadersuricatathemidavmprotect

  • Family: CastleLoader

    CastleLoader is a loader first observed in early 2025.

    loadercastleloader

  • Suricata alert: CastleLoader Malware Outbound Checkin

    Network activity triggered a Suricata alert

    suricatacastleloader

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  behavioral23
• • Target
    Red-Flaged/_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe
  • Size 772KB
  • SHA256 529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474
  • MD5 d946c183fd128b4acf88d83ee89d79d3
  • SHA1 6f35da72f339c7101e93a7adada27d24902db598
  • SHA512 793727b08b92df108144308a7ac798e55ba35742308db18466cce6caa564b6c1cb5b0fece2850511450f69e497df1dba49a9cb3a0ff17b4f9cc27e05ef2fcd62
  • SSDEEP 12288:B9uox8a9XqSYVr9N4VT0sFHOox8a9XqSYVr9N4VT9y2kLrGrEPHnHr0sFCFlXz2t:B9ws50MT0yQs50MT979oPnr01sFo2P
  • TLSH
    T1DAF401246EBA4672F1564A706BE192D853BD2D73B741E81FFB4C2E1C57B2A040648FB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  5f3e2ed386ddeccffbb4e34c56fc2efddefaultdiscoverymarsstealerraccoonstealer

  • Family: Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Family: Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral24
• • Target
    Red-Flaged/_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe
  • Size 16KB
  • SHA256 69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a
  • MD5 04d2f1e3547f5021957bd869cb0db968
  • SHA1 47c226518cf55ed3008b86282dd7a958c0374f9a
  • SHA512 42f32a26a95208720a3d33d85f61ba9e07ab3d239489e032c2798b28ba29f69c0a31d9e1f1501e2d622acfda44bfe40f4f3ad16aa94633c569f1592e87d02950
  • SSDEEP 24:eFGStrJ9u0/6f32AQWc/qlKZquzeNDMSeXixpmB9:is0YmAYClUzSD9eS2B9
  • TLSH
    T15F72521323150DF7E83C11BC4AA3F85B3168CA283B7B523A4E14022B217037069A5D45
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoormetasploittrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  behavioral25
• • Target
    Red-Flaged/_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe
  • Size 102KB
  • SHA256 aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080
  • MD5 09be3197dedd045fdde5d5e82f0be0f4
  • SHA1 a8dedbdd9e46701f6989e7003d3db94e5c9ea258
  • SHA512 b00a4c9d9c686ac6222cfe424f4d7f3df9d640514e5f9ce967e4848a1024bfcc166cbfed407c5697c305893b30e3ebd074656bf9c1b05026fceb02f763fb0644
  • SSDEEP 1536:MYxlY23kGwgMBUQGum2U8aVCguHEvQEbFeDVC3woFRKpTdm6L:DlY23kg3sguGDFaXmQ
  • TLSH
    T14AA3E1387E862133C67EC1F1A9E6768AABA9212F3191DDCE4C97028518F2F155EC1D1F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  neufdefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral26
• • Target
    Red-Flaged/_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe
  • Size 68KB
  • SHA256 efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7
  • MD5 8f697f00d086e3ad89565ec7ade0539d
  • SHA1 3fbdd78172ffa0b55d504561dbd205fd9cee235a
  • SHA512 4da6eb4000f75bed5f8d23358830583d32e1444e5c2cb44c34f3b5a23f7c97ae0170e430e41b6cfca7ed34e2c711795b0c25da364149ac995e3d76643580f826
  • SSDEEP 384:rGILRi9TWasvRPJnMIrOi+pDOO5MrsVKApyjsvstn4VcN0:rGIcTWdr+9OxciCY4mN
  • TLSH
    T16A636076B3A79222C1BD167D082150991F70BD5BDF01CA5B35E0F7EF77722E06A40AA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  revengeratstealertrojan

  • Family: RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Drops startup file

  • Executes dropped EXE

  behavioral27
• • Target
    Red-Flaged/a0630e2a81775e8334ea9f8cac73cebf1b9a70507ea3347c0c2eba82c80219a6.exe
  • Size 1.8MB
  • SHA256 a0630e2a81775e8334ea9f8cac73cebf1b9a70507ea3347c0c2eba82c80219a6
  • MD5 be207d89eacda1d222a953991a2ce3b2
  • SHA1 ebf63e7a27c91f96d84b66d7ba435ddc3a153b71
  • SHA512 b32c61d6ca34d3866a22fdb258c5f47c182ec4219808d147f5230203ba80d79dc71ffd2691019e18046a1b25f5d40f4169c6fb64641b36a23128d60c8c65d779
  • SSDEEP 24576:c8y472h6K/iT9o5Lh/NpxjiVGfl8XIxQKn/+6+uInV60iH5q:OhETyXVxQKn2tr
  • TLSH
    T1EA853A7F76A4D26EC15EC13FC1A68F00E433B0750B77C9EB169402A5AE469D48E7E3A0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryblacknevashunters_internationalransomwarespywarestealer

  • Detects Windows variant of BlackNevas ransomware

  • Family: BlackNevas

    BlackNevas is a cross-platform ransomware related to the Trigona family.

    ransomwareblacknevas

  • Family: HuntersInternational, Water Ouroboros

    HuntersInternational aka Water Ouroboros is a ransomware that operates under a Ransomware-as-a-Service model.

    ransomwarehunters_international

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral28
• • Target
    Red-Flaged/a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
  • Size 139KB
  • SHA256 a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea
  • MD5 7f3656e2687f0ccc6f777aac639748f5
  • SHA1 e4f934d18cae5c0e0e93516d089184201bd37b11
  • SHA512 ab9cd8128c2d0a436239a58b5985af37f15f4bcd2e39ced569c3ad88c6e6088cea012302b02a4f359490fa7a8cc921d8e2c7561224c520659701e7e69a955ed7
  • SSDEEP 3072:VktRlIu3zyqqoShIpLvnCfcFtv42pbTAn0WtsbM5H:etAu42pLztyEM5H
  • TLSH
    T127D39D11B5C1C472E4B7093119BADAB19D3EF9300B518DEBA3D4066A0F351D1BE3AE6B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverycubaransomware

  • Family: Cuba, COLDDRAW

    Cuba aka COLDDRAW is a ransomware first seen in 2019.

    ransomwarecuba
  behavioral29
• • Target
    Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
  • Size 782KB
  • SHA256 a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b
  • MD5 0307ec61fb90b7281da0ffbd4def0e80
  • SHA1 259a485ba24dbc243a0e7f8f8f60c890ac87a161
  • SHA512 a25b3b8f86f22fd93976fa50e6fae13b4076ae4b3895dd96a694cb667c39908c0a628b7765e50ba819249143386d7406d7ec44f0bd397c9a6eed9f5d0a847ae1
  • SSDEEP 12288:VvYIWGASYfVsFlEIU+iQanWcR79bVqIhf9aNZzZi+kzcnUEJ:VlWOpxiQSW22BZi+5xJ
  • TLSH
    T12B05BE00B2788F0AE5BA4BF80166D63097F55E5D747DE7098DDABCEB7A60B011B84B13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverymassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral30
• • Target
    Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
  • Size 689KB
  • SHA256 ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a
  • MD5 1ca786b1741e68cec2ce1c13bad8a45f
  • SHA1 ec590c27e631ad238b1e736efc77d5c41fbeb15a
  • SHA512 107d0984ef5ea10d2e6d270d788594394f0121d9d62f6713f8e452bfdfa88edd5ed865baa7ac0a20df56146eaafb693afb2f117286ebd19cc9af0cf7cf04eb6c
  • SSDEEP 6144:GeJ286NdbQ3c/jOTKEPojJ0hAWlUDt9O3PItF0GvNpBCTwdFvqg9hgWImSepTPbV:uljOTKEzht8t9O/K64NpkTL4jIm5Pd
  • TLSH
    T1EEE45B4137E88A27D26F13B9D4F1051657F1E48AB6A6DB8F5AD4D2DC1C83B806E043EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryduplexspyratrat

  • Detects DuplexSpyRAT

  • Family: DuplexSpyRAT

    DuplexSpyRAT is an open-source Remote Access Tool written in C#.

    ratduplexspyrat
  behavioral31
• • Target
    Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe
  • Size 147KB
  • SHA256 aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb
  • MD5 6241f16b5c466a46f925c0415ef38214
  • SHA1 3aaf9ac50fe04ba4b4535e89c056170ba74b8ebb
  • SHA512 0f2c6477f245299f186676d10c198d95b2acb4362a36d7247019cb269a759ae50570acd27330164091a88f4bf1f8bf5867dd3f1793cd8b78eb3ce38857d2c46c
  • SSDEEP 3072:y6glyuxE4GsUPnliByocWepSaEYLUTcVWH0XUQx4b:y6gDBGpvEByocWeOYLULUXUQ
  • TLSH
    T15FE36D21F212E073C87718F53B36B572F39A4D6C19996847DAE80F5DBCA48232F14A97
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydragonforceransomwarespywarestealer

  • Family: DragonForce

    Ransomware family based on Lockbit that was first observed in November 2023.

    ransomwaredragonforce

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral32