Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    260521-wt38csgz71_pw_infected.zip
  • Size 43.9MB
  • SHA256 cc6ab1e3c2fef2d756cbca2d2c8812c93dfa9c7e7843332e84bfb6863631be26
  • MD5 dff6c19b15e41570800c6973503ff1af
  • SHA1 7bbaadc4c2a4e1408e85b8aa4dff40459a68dabc
  • SHA512 ef6198fa1ba44af33637bd0aab98838755954a795f8b51b5b061af670bf5644eb370ef33eb8315f9d2a786628c307515a7bb0452dd18b1368422fe8550a55508
  • SSDEEP 786432:sCtvECmwtKEjfuagF/YOl5IrEfIGV8mdQDaVJm337PsvQb+AaujXgAetmA1d:sWs2Ybagj5qEAGqm1JoAvQ6AaujXvA1d
  • TLSH
    T1B7A73352358C989CCA11AE2C376CE4F9A40585EC7217536EE0864BFAD963078FB79F1C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral1
• • Target
    260110-31cgjshz9e_pw_infected.zip
  • Size 43.9MB
  • SHA256 540fe31359f7aa858f49e84097eef0b399e492a35e57b93265868fbc57b7110a
  • MD5 f416ea2ac337fe70e42e546533bba142
  • SHA1 c65a4c375c03eab35f789b47d2aecf09a4173917
  • SHA512 5c23269a8e96eb7a89168bba28c08edc79e47b65f3f0687891bff2dd3f3480f4a42e1fa0f459acdcae21dd40084a7e1a8f659a0aaa26f8b76f5ee8b6eae15a69
  • SSDEEP 786432:psdNJ99hqe6FaG21SrpFf6y8bAU3pwfbV+7KsWBm6K8JXJ:iJ23KEpFfgAU3aTyKs7p8hJ
  • TLSH
    T157A7335B23AD4AA66C087BD4F7DFB99A58E53193508BCB1E7050D43E1B8F0844CEBE58
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral2
• • Target
    cone.exe.zip
  • Size 43.9MB
  • SHA256 4e5cebe1908e12e8a4ed1198fb01fb87871dbe54847855b11b3540dbc47bbe88
  • MD5 5e4a348e89afb91e6ae698f3104f7b47
  • SHA1 1ea7e4faa29e2803f50165f63815003fe22b8cbd
  • SHA512 a4282f90cff85a5802c551c770b2e849ef745bbde8c707d6878c841102d98bdcfe86c014df2acf34fb4471713d990265d0eaaf129dd560898785b8e7ebc53666
  • SSDEEP 786432:aGUqxoNIwFhSVPEgA5PjIXom0Fk/JK2a8Zq9HdQFaybEdhPm3dutgEXzu94Pa2SJ:aDySIOSVA7IJQk/JK2amQkTwdhPt1S2e
  • TLSH
    T1E8A733667F1BF7D8F0499FA93C60C196559BC6C9834B0C28CFA3C720EDA78E66641478
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3
• • Target
    2to1ep.bin
  • Size 13.1MB
  • SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
  • MD5 7d1a85e807ff9b48edc2e08a01b35e07
  • SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
  • SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
  • SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
  • TLSH
    T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoor100000000runtimebrokerdefense_evasiondiscoveryexecutioncobaltstrikedonutloaderkoiloadermetasploitmythicapolloquasarsalatstealerxworminstallerloaderminerpersistenceprivilege_escalationratrevoked_codesignspywarestealerthemidatrojanupx

  • Detect SalatStealer payload

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Detects KoiLoader payload

    loader

  • Detects MythicApollo

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Family: MythicApollo

    Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.

    backdoormythicapollo

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral4
• • Target
    main.pyc
  • Size 12KB
  • SHA256 ef7220d8bc8a9cce0341a88026eef346facaed0f859525d55184caf4df18cb57
  • MD5 0ee8963c24b008f9a96fa492c89e69ef
  • SHA1 5628d9974ea0d4d4c3c5c1a77370ef664d0a8aba
  • SHA512 bc0f7569892dbe8c426997c35fe5439a79be8f753a0c0c2801c8529d29bf5b3982092eaff16bdace479e68efa248b1c38ac7b26ede4a214299fb62475fb4dbe3
  • SSDEEP 384:itYLLo88lQu1DnZnmQ3+9KCAbwgYVJrQkn:22LoHVDnVckb4SG
  • TLSH
    T1C342CF261C44D5B7CBB888B3DD6EC55E7ACE350A04B286FF56049990D57DAC801F9DC3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral5
• • Target
    4363463463464363463463463.exe.bin
  • Size 10KB
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 2a94f3960c58c6e70826495f76d00b85
  • SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
  • SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
  • SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
  • TLSH
    T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discovery

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral6
• • Target
    Synaptics.exe.bin
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • TLSH
    T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbeyonddefense_evasiondiscoveryexecutionasyncratlummaxredpersistenceratstealer

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral7
• • Target
    TsarBomba.exe
  • Size 25.2MB
  • SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
  • MD5 91025d6f02e542f2e37ffce7d0ce8b51
  • SHA1 e2d80ef6075556cd23ce0445473c061f200b5dd4
  • SHA512 09c6d7f8b64c75e963d63ad1478a81f567182a948d652346f1c68d233efead615703aadb4ce9cd5e5fd7235089f2439e9153231ea3e1a2c677ae84aec29afc89
  • SSDEEP 393216:NVn+SLSF5pdHn2AXUCITkkkkkrkkkkkkkkkkkk6lX0wfGtbYTZb08MQUCITkkkkS:PduvnNG0shAQ31qnMb5OM9Tt
  • TLSH
    T13547C0863B60C192CDF278719473DAC016387E6DCF3255A6DBCB4A0ABC518B7051BE7A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoor158fdd2a4f5abb978509580715e5353f987654321cheatdefense_evasiondiscoveryexecutionades_stealerchaoscobaltstrikedcratdiscordratdragonforcegh0strathiddentearjlockerlockbitmassloggermodiloaderredlinerokratsectopratumbralvalleyrat_s2vidarvipkeyloggerxoristxwormimpactinfostealerinstallerkeyloggerpersistenceransomwareratrevoked_codesignrootkitspywarestealertrojan

  • Chaos Ransomware

  • DCRat payload

    rat

  • Detect Rokrat payload

  • Detect Vidar Stealer

    stealer

  • Detect Xworm Payload

  • Detected Xorist Ransomware

  • Detects AdesStealer

  • Detects HiddenTear Ransomware

  • Detects JLocker ransomware.

  • Detects Umbral payload

  • Detects ValleyRAT payload

  • Family: AdesStealer

    AdesStealer is a modular stealer written in C#.

    stealerades_stealer

  • Family: Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Family: DragonForce

    Ransomware family based on Lockbit that was first observed in November 2023.

    ransomwaredragonforce

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: HiddenTear, Cryptear

    HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.

    ransomwarehiddentear

  • Family: JLocker

    JLocker, also known as JRansomware, is a new Rust based ransomware.

    ransomwarejlocker

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Family: ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Rokrat

    Rokrat is a remote access trojan written in c++.

    ratrokrat

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Family: Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Gh0st RAT payload

  • ModiLoader Second Stage

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine payload

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • SectopRAT payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral8
• • Target
    cobaltstrike_shellcode.bin
  • Size 219KB
  • SHA256 b9321c27be4295c15d7f92fafc20d7ccac5f21204b79ebc2fed583dda0197cf9
  • MD5 24d99ba5654cdf31141c66fd9417b7e0
  • SHA1 0e06aedf5b25cf248131c9eff5a331f4bb1fcb67
  • SHA512 351e8c078595d1c829385d0bfbeb2560dd62fa063645e40593ba63af8862fc90bbd24438aebb0fb952cb78bf80b91ea35dbabdc91d760fd69c7f188e45075872
  • SSDEEP 6144:c8X2sNEFy+HVJbny+lgzgeFgUQI9aiGynMOyX:T3NEFy8VJO+GTFgUzaL6MO+
  • TLSH
    T16624CE7F6272415DCD82933955C180BE8C9B9C835FD0A324DDC0A0E47F65E7AA68EBC6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoor1359593325discoverycobaltstriketrojan

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  behavioral9
• • Target
    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
  • Size 3.4MB
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 84c82835a5d21bbcf75a61706d8ab549
  • SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
  • SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
  • SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
  • TLSH
    T173F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral10
• • Target
    random.exe.bin
  • Size 6.8MB
  • SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
  • MD5 001e8ad1e0d0800e75b1fa32b07d2a46
  • SHA1 4c4fd4adfbcb8a2c3831f0f9605fcf65b44e9db7
  • SHA512 f0dde843f8b83c74ec05e7dbfa311f6943f5707c5ea641c7adfeab3e8cb2561c77c4ef0b74916fe90267a5c7093df98dd506ca89f1b24c6d5cc86f09539625f6
  • SSDEEP 196608:N0Dyo+Ougx9JW8e0e3/tELtyuT8IziZdG3fz:N0OfKWPKLtVQIeCz
  • TLSH
    T18F7633D43BD9A7A8E08B5BF9AEE180FA90A2C3F87CA8743C4D5E5141FC64A39B401D55
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fbf543fc155c5bf8a148a93a2ba17de68393f0nrif0lmdefense_evasiondiscoveryexecutionamadeyvidarpersistencestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects Vidar Stealer

    stealer

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Creates new service(s)

    persistenceexecution

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral11