Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    abf60d26f7062fa3ed554d4ed437c8f9.exe
  • Size 13.8MB
  • SHA256 48267b826fa7ec0cea8be878f979a967d0a091cccea9f226ad8d87b29dc94800
  • MD5 abf60d26f7062fa3ed554d4ed437c8f9
  • SHA1 7751ce911e1b45f925f214fe1fb6b96e5fd9204d
  • SHA512 62295d1d36da974e746883f5cbcca6069dd31822b26e9c4be946f6b000a40fe5c8ecdf02fe376180a1b00b658d3dbbbf33fe7e551a6045b59a75b4c9c5a3da76
  • SSDEEP 393216:xkY58Sudkv7xjt2H69ZahHIqLWiMtrLeYqWia3Je:66EdkvRsNPLWiuLiXt
  • TLSH
    T192E633793AF096A3D90244B1DFA9E2DBB23F54A14A447187D310B1F86F38596F64BE0C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoor915a9912f1030c80831a4857ec7cb54b69653332c85v1userdefense_evasiondiscoverydropperexecutionfabookienullmixerraccoonredlinesmokeloadersocelarsvidarinfostealerinstallerpersistencespywarestealertrojanvmprotect

  • Detect Fabookie payload

  • Family: Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Family: NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Family: Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Family: Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Raccoon Stealer V1 payload

  • RedLine payload

  • Socelars payload

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Vidar Stealer

    stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1