Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged.7z
  • Size 328.4MB
  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 0c22c97e5f0c0cd86a1daeff10d51581
  • SHA1 9f760e31fc9f4763cc04716e669d6ddd547f9fd3
  • SHA512 e31ee3466d4be1b660c73917fbc3ad288974316f4d8e92f8d2e8520c4c805ceb3b545bc1fda47a67563301aa4f2d12c8685818653e95d28fd5a8387154d9c833
  • SSDEEP 6291456:m3tJGUA4R5hz4EQLvSkRNLF9lD7C2GabF9sV0c3V+5ZcqAgZDFvVCG9KrGpUQXKz:cIqmSkRL7D7CBabqhGsuF9C3rGUQXKz
  • TLSH
    T1FCF833E898E71050F222D1A80DEAEA021F4D98D4B66DC4D32E652FFB5CEC2FF85B5055
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Red-Flaged/ChileLocker_d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe
  • Size 69KB
  • SHA256 d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8
  • MD5 a99e3627afb443440686fcb10491d954
  • SHA1 ff14a3919c9e4bd0dd4e1b964017de64a0298318
  • SHA512 cc6a659f79184bc4def96d9e2723726a9e604ed361820a5f1df90ce51532770d875a228f4774346ec80f0b71ae7349a4f769c0e16e6ce75db4cb7c77956d899f
  • SSDEEP 1536:1kLPmzHTE+IpmdeGUtoQimYKmP+h/dgLAnpypJjmxxN6AG4+gT0QX2nouy8:qb8HTE+qmdDUUmR/dg8py/jmHxb/2out
  • TLSH
    T1D06302B3F2A31C23CF29263904FDF45BE2C8869C471503DA665D520A48B2B191FA43EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutioncloakimpactpersistenceprivilege_escalationransomwareupxcredential_accessspywarestealer

  • Family: Cloak

    Cloak is a ransomware that has been active since 2022.

    ransomwarecloak

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (255) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4
• • Target
    Red-Flaged/CoronaVirus.exe
  • Size 1.0MB
  • SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
  • MD5 055d1462f66a350d9886542d4d79bc2b
  • SHA1 f1086d2f667d807dbb1aa362a7a809ea119f2565
  • SHA512 2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
  • SSDEEP 24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
  • TLSH
    T18F357D22E6A390F1C0652170BD6EB7FF99273C544F1889E7A3D4361C6AB01D10DFBA96
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondharmaimpactpersistenceransomwarespywarestealer

  • Family: Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (867) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral5behavioral6
• • Target
    Red-Flaged/CryptoLocker.exe
  • Size 338KB
  • SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
  • MD5 04fb36199787f2e3e2135611a38321eb
  • SHA1 65559245709fe98052eb284577f1fd61c01ad20d
  • SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
  • SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
  • TLSH
    T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverycryptolockerpersistenceransomware

  • Family: CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral7behavioral8
• • Target
    Red-Flaged/DanaBot.exe
  • Size 2.7MB
  • SHA256 db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1
  • MD5 48d8f7bbb500af66baa765279ce58045
  • SHA1 2cdb5fdeee4e9c7bd2e5f744150521963487eb71
  • SHA512 aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd
  • SSDEEP 49152:bbevayZlMTWkygVy0nQZfVY2BtZzpPL4PuQ65+6Dv7m0KXTn:bbexZlMQcEVY2BtZzpPL4WQI9U
  • TLSH
    T1EDD5330273E04936EAB307706AB54B752EFFF970DF745AAB2316194E89301E29633752
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverybankerbotnetdanabottrojan

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  behavioral10behavioral9
• • Target
    Red-Flaged/DiscordTimerEditor2.1.exe
  • Size 71.5MB
  • SHA256 6546d219e24d0f380e812202a7d39961809338704b5661488d20cf59323119bb
  • MD5 cb595e0eea08817bc199f110c83d7993
  • SHA1 f3613ac03792a3fa7c7b13f6c06d441ddec3210d
  • SHA512 604b1d87317d35bd83f0231dd83606f0c8ff30d27f36b52561b14d1cb5ba51dcae38e691bbfc02f0f69d486a4d26d792c7ae8dcffa873f3f4df4ad92bdd7a060
  • SSDEEP 1572864:+9zrmhlJZKEWAW/kUb9jETHPQmMpnx9luHY7otnq/2mbsoeORnLrR:+9WFUEWA8jcvPOn366xear
  • TLSH
    T120F7338537444C48EE1C533152769A5D2DC9F61D82CE484AFBFDB9282C8E3EDAEBD940
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  upx

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral11behavioral12
• • Target
    Red-Flaged/JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe
  • Size 938KB
  • SHA256 08c29dfa0ccb747751c5ff3ccde88f7f8a5a87152121f75f60a886b14e86bf00
  • MD5 2363f93331fc792ae9cb5750043bdc89
  • SHA1 2fc0b7b4106a28ffe7f63f36ff64fe045e8f7daa
  • SHA512 a4a47c39e03c22844725b51ffd56f3ae01e9095733e8442eaba1fcf0e3a0e1edb127a6bf4b5ab8063614829db27919dea5a0e62f9e7d320e625fc498a603ad3e
  • SSDEEP 24576:PYrNtws0/BP9qDVgk7YIPo0NJ+ISzFKs:PM7YBlqDVbNNJNS0s
  • TLSH
    T10015CF0021796FA2F93C97F52649621883F9369F08EEE7740CE5B0E711B9F875A50AC7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionmatiexkeyloggerpersistencespywarestealer

  • Family: Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral13behavioral14
• • Target
    Red-Flaged/JaffaCakes118_30f515392358142b507a486d7ab379d2.exe
  • Size 70KB
  • SHA256 c36f30481ce328712716ed35515c79075b411ac492164996e9078a540f89f4e2
  • MD5 30f515392358142b507a486d7ab379d2
  • SHA1 d1b8436f0d752e965dae8cc2459cedd5647d00ea
  • SHA512 208773ac0578e1099a3e4f47c50d6dcb938748182922fc73105179e66f9386225b6f3c65689fa6d23a620303e9ee8f1e7f8e16251f7aa2f3f47a4b4ee52d1c48
  • SSDEEP 1536:oT+dIkJg6exZOWCYsPlFAFbDNkgRO5JylSp4mlG6hK4UZygM:oBkMxsYylFAFDWgIyIGIK4UZygM
  • TLSH
    T1616312A4FBBE1DEFD4FF0533022E90121166E431109185979EF4BC9C7C24BB9D88867A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  blackwoodaptbackdoordiscoveryprojectwoodupx

  • Detects ProjectWood Payload

    backdooraptblackwood

  • Family: ProjectWood

    ProjectWood is a backdoor attributed to BlackWood APT group.

    backdoorprojectwood

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral15behavioral16
• • Target
    Red-Flaged/JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe
  • Size 625KB
  • SHA256 293d7e82688a0af531aca5d3197c2671d4c7be759463d71d1415438d91333aae
  • MD5 337dd03f1d287dcdb6471704d14aa3b6
  • SHA1 a13f40e7fadd226795a6a57bd5e5bd8b8fce568d
  • SHA512 7224d57da3b108ae2b28f380c50045cf7307a805c8a7c1ab5f9933074596172e2c52f5c74af8e219aee0f0ea95a2552dd6a6048acf5742171d6d0c63d54b4bea
  • SSDEEP 12288:96Hz52J2DT1mWK5u0MH/reKpvN7fxBLaAsNWGqgmeBWDroj43V:QHl2J21mWK5ufHiKpvNzPLaAsNWGqijQ
  • TLSH
    T164D44B76E60389F5DE7705F1054BFBBBA620DA0984328C5FD788CE90AFF6C22145D626
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerepoch2discoveryemotettrojan

  • Family: Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Drops file in System32 directory

  behavioral17behavioral18
• • Target
    Red-Flaged/Jigsaw.exe
  • Size 283KB
  • SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
  • MD5 2773e3dc59472296cb0024ba7715a64e
  • SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
  • SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
  • SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
  • TLSH
    T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jigsawpersistenceransomwarespywarestealer

  • Family: Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Renames multiple (3937) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral19behavioral20
• • Target
    Red-Flaged/Locky.exe
  • Size 180KB
  • SHA256 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
  • MD5 b06d9dd17c69ed2ae75d9e40b2631b42
  • SHA1 b606aaa402bfe4a15ef80165e964d384f25564e4
  • SHA512 8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
  • SSDEEP 3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
  • TLSH
    T19404D0BB715D8806FF75947640CC2A23DDE3E8B091ADDE23A68346E78C852DC58C9727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylockyransomware

  • Family: Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky

  • Checks for any installed AV software in registry

  behavioral21behavioral22
• • Target
    Red-Flaged/MuckModLoaderSetup2.1.1.exe
  • Size 84.7MB
  • SHA256 ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317
  • MD5 8f43e321dec9dd12d638776a36ee194e
  • SHA1 9a36263e9e95812c8d756f6ac16c00e229483927
  • SHA512 35d3e59c1326d76623981dcfadf670de64bd978f8720285b3818de50732d7cd89bcf6f5d46422739fdcd5e151d17f9ec65c508e6d18d029c5fd18b2455c273cb
  • SSDEEP 1572864:jA+BWMFDe45kntGZ6hDRVOy1menoUu9Ma7vWZsYez153UubP7/5:jRBFle45yxhDRV7nohfvgo53UkPN
  • TLSH
    T11E18331C38E0CB5AC86EF97BE0731F1216A4704A2FC5775BB937AD8A64A8F51D730252
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiongenesis_stealerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: GenesisStealer

    GenesisStealer is an infostealer based on Electron.

    stealergenesis_stealer

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral23behavioral24
• • Target
    Red-Flaged/MyDoom.A.exe
  • Size 22KB
  • SHA256 fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
  • MD5 53df39092394741514bc050f3d6a06a9
  • SHA1 f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
  • SHA512 9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0
  • SSDEEP 384:96ZQHXcE7hUHwT56cC9Kg65JdwGADkHw/Rjxtuu7VIGGwQWEqpD6:CavuHAUcW/ojwG6kHw/lxqbW
  • TLSH
    T134A2E14996B41DFBC08707728AB3761197551538E0F99387E73C4F9FA0762A8F74E902
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymydoomupxworm

  • Detects MyDoom family

  • Family: MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral25behavioral26
• • Target
    Red-Flaged/N-W0rm.exe
  • Size 16KB
  • SHA256 fffe3c68f5caeea568830803b982c3e58ad3e101e0241614bf5e87d2c07e7ab4
  • MD5 9301efdf355b6379aef4ba98dab78718
  • SHA1 308ac5df7bf6fe34115522d685814a49778c5539
  • SHA512 6cb47cb290330ad694cd8224c518ad063db61ed530a41b3eca1f3bf5b425e7a03141e8a55f1568884fc1c7e4a2df63f82d16587ad81928bbd17081bfdba6e8f1
  • SSDEEP 384:c71T+Rh/1xo+/6KPN/FYdQ8bDKgJRaqcJl74CoBU:c7sxroXKxFgXbmVL4CoW
  • TLSH
    T1F672FA0067F98625E2FE0BB85CB3431052F5E6535A32D7DBACC850EE6863FD48602BE5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  downloadernwormworm

  • Family: NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  behavioral27behavioral28
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral29behavioral30
• • Target
    Red-Flaged/Product Sample pdf.exe
  • Size 612KB
  • SHA256 7765f79c31ac9fb10bc37a24b769738c61d2f562b0758c3a0a4ebe176ae0d7de
  • MD5 22e87999f93e9368b2272cdd49cf49d7
  • SHA1 68addbfad46359c58eb68dad524db6294838e02a
  • SHA512 4fff863181463b78b11523eda50ef67b80ae0964996fe4660db31fafa22f5a203551dbd15836534c3c426d2351ca6038a0d1eaeb1833b03c2ca9eefaff00e3e6
  • SSDEEP 12288:TMF/qkQz5Vj+OMR8HnTgLJuAliyJ5/wd8ln4R0tW1cPOVk:IFvS68HnTgL4yD/wzR0uc
  • TLSH
    T165D423636330C524D6FC48749CDBCB921661BAE38863634BABB4ED442DFA1D0F1A1F95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryhawkeyekeyloggerpersistencespywarestealertrojan

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral31behavioral32