Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged/Jigsaw.exe
  • Size 283KB
  • SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
  • MD5 2773e3dc59472296cb0024ba7715a64e
  • SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
  • SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
  • SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
  • TLSH
    T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jigsawpersistenceransomwarespywarestealer

  • Family: Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Renames multiple (4030) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1behavioral2
• • Target
    Red-Flaged/Locky.exe
  • Size 180KB
  • SHA256 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
  • MD5 b06d9dd17c69ed2ae75d9e40b2631b42
  • SHA1 b606aaa402bfe4a15ef80165e964d384f25564e4
  • SHA512 8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
  • SSDEEP 3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
  • TLSH
    T19404D0BB715D8806FF75947640CC2A23DDE3E8B091ADDE23A68346E78C852DC58C9727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylockyransomware

  • Family: Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky

  • Checks for any installed AV software in registry

  behavioral3behavioral4
• • Target
    Red-Flaged/MuckModLoaderSetup2.1.1.exe
  • Size 84.7MB
  • SHA256 ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317
  • MD5 8f43e321dec9dd12d638776a36ee194e
  • SHA1 9a36263e9e95812c8d756f6ac16c00e229483927
  • SHA512 35d3e59c1326d76623981dcfadf670de64bd978f8720285b3818de50732d7cd89bcf6f5d46422739fdcd5e151d17f9ec65c508e6d18d029c5fd18b2455c273cb
  • SSDEEP 1572864:jA+BWMFDe45kntGZ6hDRVOy1menoUu9Ma7vWZsYez153UubP7/5:jRBFle45yxhDRV7nohfvgo53UkPN
  • TLSH
    T11E18331C38E0CB5AC86EF97BE0731F1216A4704A2FC5775BB937AD8A64A8F51D730252
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiongenesis_stealerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: GenesisStealer

    GenesisStealer is an infostealer based on Electron.

    stealergenesis_stealer

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral5behavioral6
• • Target
    Red-Flaged/MyDoom.A.exe
  • Size 22KB
  • SHA256 fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
  • MD5 53df39092394741514bc050f3d6a06a9
  • SHA1 f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
  • SHA512 9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0
  • SSDEEP 384:96ZQHXcE7hUHwT56cC9Kg65JdwGADkHw/Rjxtuu7VIGGwQWEqpD6:CavuHAUcW/ojwG6kHw/lxqbW
  • TLSH
    T134A2E14996B41DFBC08707728AB3761197551538E0F99387E73C4F9FA0762A8F74E902
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymydoomupxworm

  • Detects MyDoom family

  • Family: MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral7behavioral8
• • Target
    Red-Flaged/N-W0rm.exe
  • Size 16KB
  • SHA256 fffe3c68f5caeea568830803b982c3e58ad3e101e0241614bf5e87d2c07e7ab4
  • MD5 9301efdf355b6379aef4ba98dab78718
  • SHA1 308ac5df7bf6fe34115522d685814a49778c5539
  • SHA512 6cb47cb290330ad694cd8224c518ad063db61ed530a41b3eca1f3bf5b425e7a03141e8a55f1568884fc1c7e4a2df63f82d16587ad81928bbd17081bfdba6e8f1
  • SSDEEP 384:c71T+Rh/1xo+/6KPN/FYdQ8bDKgJRaqcJl74CoBU:c7sxroXKxFgXbmVL4CoW
  • TLSH
    T1F672FA0067F98625E2FE0BB85CB3431052F5E6535A32D7DBACC850EE6863FD48602BE5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  downloadernwormworm

  • Family: NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  behavioral10behavioral9
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral11behavioral12
• • Target
    Red-Flaged/Product Sample pdf.exe
  • Size 612KB
  • SHA256 7765f79c31ac9fb10bc37a24b769738c61d2f562b0758c3a0a4ebe176ae0d7de
  • MD5 22e87999f93e9368b2272cdd49cf49d7
  • SHA1 68addbfad46359c58eb68dad524db6294838e02a
  • SHA512 4fff863181463b78b11523eda50ef67b80ae0964996fe4660db31fafa22f5a203551dbd15836534c3c426d2351ca6038a0d1eaeb1833b03c2ca9eefaff00e3e6
  • SSDEEP 12288:TMF/qkQz5Vj+OMR8HnTgLJuAliyJ5/wd8ln4R0tW1cPOVk:IFvS68HnTgL4yD/wzR0uc
  • TLSH
    T165D423636330C524D6FC48749CDBCB921661BAE38863634BABB4ED442DFA1D0F1A1F95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryhawkeyekeyloggerpersistencespywarestealertrojan

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral13behavioral14
• • Target
    Red-Flaged/Remcos.exe
  • Size 92KB
  • SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
  • MD5 fb598b93c04baafe98683dc210e779c9
  • SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
  • SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f
  • SSDEEP 1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6brM:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+7
  • TLSH
    T12F93C713FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA419D79892D416EBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hostdefense_evasiondiscoveryremcospersistencerattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral15behavioral16
• • Target
    Red-Flaged/Rensenware.exe
  • Size 96KB
  • SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
  • MD5 60335edf459643a87168da8ed74c2b60
  • SHA1 61f3e01174a6557f9c0bfc89ae682d37a7e91e2e
  • SHA512 b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb
  • SSDEEP 3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx
  • TLSH
    T118A3E0417AE1AE3BC67A6EBA197546410BB677386030E7DD0C8250CE29E3F044A91FDB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral17behavioral18
• • Target
    Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe
  • Size 1.2MB
  • SHA256 b6968bc63433009553101e5303b880d403e2a2a0c6521694ddb122e25336ad82
  • MD5 342fe7a48d34f0eb772e4cc606fb71b0
  • SHA1 4579992d607dda5ab61c9b5ff92e10499826c40f
  • SHA512 b1d4a6afb0c51de519227a25ee7fe5f34bf02790d61c9d70a9edb42f6003e091c49a1148bed100bb2ba2d75d1e48edc26b1de61ccf2430069cfe65ba8a7538c3
  • SSDEEP 24576:tVxWxeVzdyMxGn3etxHGWIxMN7BOPlQbX8mS8jmEXp7RMuiMGZ1OkV95jbbeQEUz:PxWxSdyMxGn3dM9BOIFrLpvfK1B7Eeg
  • TLSH
    T1FF451254B2A0C827C9B946F20E31FA7107F91EDE6411D3C88DD4ADEF79EAF045A41A63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral19behavioral20
• • Target
    Red-Flaged/Synaptics.exe
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • TLSH
    T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitbotnetcredential_accessdefense_evasiondiscoveryexecutionquasarsheetratxmrigxredxwormminerpersistenceratspywarestealertrojanbankerddnsnanocoreramnitriseproinstallerkeyloggerrevoked_codesignupxworm

  • Detect Xworm Payload

  • Detects Sheetrat Obfuscated Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Family: RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Quasar payload

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral21behavioral22
• • Target
    Red-Flaged/Uniformitarian.exe
  • Size 357KB
  • SHA256 b0e8491d0558fe31d0e2f591e7c09beb20321b5551b008dec47da8c1b14c28ca
  • MD5 c01c24af72defeeed00f9dd92f17d088
  • SHA1 4b62292bee5e31480ff76ef731252a2ac4a2507a
  • SHA512 ce7ebba8b1c34db6da527ea83781002eaf12a8a48b3886df2227c80d3dc57c7885f66765bfdfffb7f8d79d54271866808d6354d1c4fa7ef9375e6f67d8cee96e
  • SSDEEP 6144:dMm4CCsD9RbmZGgnCroDxzSc+WIG01nv50tf45xAyI/bDli5uTwFOCxlteEq3D1y:dMwpD9tQ3DIc+WI7Fqtf45zI/vliIpCz
  • TLSH
    T1027401407264D40AECA047710DBAE9F21761BEA2BEB2C20F3314BB6E7F727C5551A761
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloader

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral23behavioral24
• • Target
    Red-Flaged/VerifierImGui.exe
  • Size 4.5MB
  • SHA256 966437012d3312230a38ec8b025140a6f55932a60b012e5d0fe649c8a6b71b17
  • MD5 07a189f58bee10ea63188b80f35ee141
  • SHA1 f866b03f473ac2fb064af333c6e4049274af75ad
  • SHA512 6a99481b528e44c4cec756c6afbf62c918cfbbbce8728a70dbe1446110c6e6d01fbb006480535b7ae20269e59b6c73942146ce31c4e3aa5a012afd528b1bfda0
  • SSDEEP 98304:lGjW4HRD7eWKnxG/oM7CzWTEoYsQr4oPkInb0XTYafLGZ/eA:l0D5N/7GzWvYcoDmF6Z/eA
  • TLSH
    T1A9263355AC54F592E2E52FF4E8FBC8D3B5133E1214AADB4D82037AC2D6A2D5A181D333
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnetsupportrat

  • Family: NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral25behavioral26
• • Target
    Red-Flaged/WannaCrypt0r.exe
  • Size 3.4MB
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 84c82835a5d21bbcf75a61706d8ab549
  • SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
  • SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
  • SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
  • TLSH
    T173F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealersuricataworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral27behavioral28
• • Target
    Red-Flaged/WarzoneRAT.exe
  • Size 321KB
  • SHA256 61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2
  • MD5 600e0dbaefc03f7bf50abb0def3fb465
  • SHA1 1b5f0ac48e06edc4ed8243be61d71077f770f2b4
  • SHA512 151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9
  • SSDEEP 6144:62GhN2db088fTdUuNU0we+HPps1zcJLVPzGKfwQ7PHC3NJTyhtPB1m:62iNG088fTWsU0wJBsGJPf4Q7PHC3NJ8
  • TLSH
    T12E6429AA71CD71EEC41BC0718D58BE6CBA202C26560B4D075C53B19D993CA839FB35BE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionwarzoneratinfostealerpersistenceratrezer0

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral29behavioral30
• • Target
    Red-Flaged/Xeno.exe
  • Size 482KB
  • SHA256 ddc3190dab77cfc8d440a86493c63a18b11b09fcaad75e5473ecca50271fb662
  • MD5 948bcc43d72208af81d8cc6c2eb79e31
  • SHA1 a508a6e50019607c56ce0763e262cbd6af521999
  • SHA512 1065fe1b284d9644f50f714f3af749e83cee4cd762437ccfaa5009122b7362981fa1161354bfe079b5f7733b38abfa40738aa0d2a1f3d989a44784cca41fb06f
  • SSDEEP 12288:FtGZhOVnihkVNoZtL+EP8nbJRiAfbouxUyzzqMNMC:FtxbVbI8bJRiAfbouxUyzzqMNb
  • TLSH
    T138A48D0537B8812AE16F9BB8C9A1154BD772BD43DB12F3CF0A8469E91D32B80DD29753
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionumbralxwormpersistenceratstealertrojandefense_evasionspyware

  • Detect Xworm Payload

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral31behavioral32