Resubmissions
14/08/2026, 18:11
260814-wsq7eayzcv14/08/2026, 18:11
260814-wsqkwayzcs06/08/2026, 04:02
260806-el3s7aff5806/08/2026, 03:16
260806-dsrh3asdja28/07/2026, 14:04
260728-rdfpxayajh1028/07/2026, 13:53
260728-q66alayxav1028/07/2026, 12:55
260728-p5zkzsxyay1023/07/2026, 15:06
260723-sg2l8a1frg26/06/2026, 14:20
260626-rnlznscy7l1025/06/2026, 14:59
260625-scvywacx3vGeneral
- Target 1d1decac693bfc7c19e26f01929716924d7607e300f8385a7a8a02d176800db5
- Size 113.7MB
- Sample260625-sbpepsc15l
- SHA256 1d1decac693bfc7c19e26f01929716924d7607e300f8385a7a8a02d176800db5
Malware Config
Extracted
-
netwire
-
londonkc.zapto.org:20114
-
activex_autorun
true
-
activex_key
{K0457A6I-AG86-4U3N-827E-FV3R34144863}
-
copy_executable
false
-
delete_original
false
-
host_id
123456
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
FKEDHidl
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
true
Extracted
-
cobaltstrike
-
http://192.168.239.128:80/OqCZ
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MAGWJS)
Extracted
-
systembc
-
107.172.197.105:4016
-
dns
5.132.191.104
92.163.33.248
206.189.120.27
Extracted
-
gafgyt
-
51.15.0.28:666
Extracted
-
stealc
-
b5
-
http://45.200.148.115
-
url_path
/0a616124ff2f2b69.php
Extracted
-
predatorstealer
-
http://florapansiyonotel.com/images/jaf3/
Extracted
-
latrodectus
-
https://aytobusesre.com/live/
-
https://scifimond.com/live/
-
group
Littlehw
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Extracted
-
zebrocy
-
/managment/cb-secure/technology.php
Extracted
-
pony
-
http://arabnotification-001-site1.btempurl.com/dd.php
-
payload_url
http://arabnotification-001-site1.btempurl.com/shit.exe
Extracted
-
sodinokibi
-
$2a$10$QxsCf5cdia/Z/FajTwcMlei3GljcoLzkvZC78fqd3ac2xdlebUdjW
-
5012
-
classycurtainsltd.co.uk
-
hairstylesnow.site
-
happyeasterimages.org
-
catholicmusicfest.com
-
aunexis.ch
-
zweerscreatives.nl
-
carlosja.com
-
mooglee.com
-
lange.host
-
siliconbeach-realestate.com
-
galserwis.pl
-
xtptrack.com
-
bildungsunderlebnis.haus
-
linnankellari.fi
-
real-estate-experts.com
-
eglectonk.online
-
panelsandwichmadrid.es
-
comparatif-lave-linge.fr
-
tuuliautio.fi
-
winrace.no
-
net
false
-
pid
$2a$10$QxsCf5cdia/Z/FajTwcMlei3GljcoLzkvZC78fqd3ac2xdlebUdjW
-
prc
dbsnmp
mspub
msaccess
infopath
thunderbird
onenote
oracle
sql
xfssvccon
wordpad
dbeng50
encsvc
agntsvc
thebat
steam
sqbcoreservice
ocssd
mydesktopqos
excel
isqlplussvc
visio
firefox
synctime
ocautoupds
outlook
winword
mydesktopservice
tbirdconfig
ocomm
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
5012
-
svc
svc$
sql
memtas
backup
sophos
mepocs
veeam
vss
Extracted
-
blackmatter
-
3.0
-
4e591a315c54e8800dae714320555fa5
-
Username
-
Password
yhU6VJ$&
-
Username
-
Password
RPo@ndf9
-
Username
-
Password
DH5U87@rA0ELa2
-
https://fluentzip.org
-
http://fluentzip.org
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
-
darkcomet
-
Guest16
-
127.0.0.1:1604
-
DC_MUTEX-AC8ZNXK
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
MEcP6YegefHK
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Extracted
-
metasploit
-
windows/download_exec
-
http://158.247.204.245:80/OuIO
- headers User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36
Extracted
-
qakbot
-
403.573
-
AA
-
1649660679
-
41.228.22.180:443
-
47.23.89.62:995
-
176.67.56.94:443
-
103.107.113.120:443
-
148.64.96.100:443
-
47.180.172.159:443
-
181.118.183.98:443
-
140.82.49.12:443
-
103.87.95.133:2222
-
96.21.251.127:2222
-
197.167.62.14:993
-
46.107.48.202:443
-
24.43.99.75:443
-
172.115.177.204:2222
-
80.11.74.81:2222
-
66.98.42.102:443
-
75.99.168.194:61201
-
173.174.216.62:443
-
45.9.20.200:443
-
39.41.158.185:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Extracted
-
gozi
-
build
217030
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Extracted
-
sodinokibi
-
$2a$10$yAMP3nIcT2cdDmxcWGfMSO8kdqUEiAFW/M3lwAzFqERF9XglgmAUi
-
4525
-
qualitus.com
-
centuryrs.com
-
gw2guilds.org
-
pointos.com
-
zzyjtsgls.com
-
coding-marking.com
-
daniel-akermann-architektur-und-planung.ch
-
qualitaetstag.de
-
tstaffing.nl
-
abogadosadomicilio.es
-
arteservicefabbro.com
-
mirjamholleman.nl
-
farhaani.com
-
mrsplans.net
-
buymedical.biz
-
imperfectstore.com
-
classycurtainsltd.co.uk
-
ihr-news.jp
-
ceid.info.tr
-
kamienny-dywan24.pl
-
net
true
-
pid
$2a$10$yAMP3nIcT2cdDmxcWGfMSO8kdqUEiAFW/M3lwAzFqERF9XglgmAUi
-
ransom_oneliner
---=== Sodinokibi Ransomware ===--- All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4525
-
svc
sql
mepocs
vss
veeam
svc$
memtas
sophos
backup
Extracted
-
meduza
-
kapitan
-
176.124.204.206
-
anti_dbg
true
-
anti_vm
true
-
build_name
kapitan
-
extensions
.txt
-
grabber_maximum_size
1048576
-
port
15666
-
self_destruct
false
Targets
-
- Target capa-testfiles-master/.github/check_runtimes.py
- Size 2KB
- SHA256 23b0aabf3968db040b5a0e562bca67eabeda1f3356f88485761138b4c8ff8929
Score3/10 -
- Target capa-testfiles-master/.github/check_sample_filenames.py
- Size 3KB
- SHA256 e7788d67cfe6817e48ccf949e577912437133fa83704ceb096eb3bf21c95346e
Score3/10 -
- Target capa-testfiles-master/009c2377b67997b0da1579f4bbc822c1.exe_
- Size 92KB
- SHA256 f58c502a1f26f8e754caa1adb73df3714e54b256383becaedc4166aacad15a57
Score10/10-
Family: Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (853) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
- Target capa-testfiles-master/02179f3ba93663074740b5c0d283bae2.exe_
- Size 261KB
- SHA256 39fb2b683dacbaceb78995cd4cedff87ae1514e8aa3678de5deec7ccec187680
Score3/10 -
- Target capa-testfiles-master/021f49678cd633dc8cf99c61b3af3dda.exe_
- Size 87KB
- SHA256 dbef9d81aa5c47e97f966034dacd991039376aeb179a0df12e82a7e4f6179c34
Score10/10-
Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
NetWire RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
- Target capa-testfiles-master/034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe_
- Size 71KB
- SHA256 034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5
Score6/10-
Adds Run key to start application
-
- Target capa-testfiles-master/039a6336d0802a2255669e6867a5679c7eb83313dbc61fb1c7232147379bd304.exe_
- Size 32KB
- SHA256 039a6336d0802a2255669e6867a5679c7eb83313dbc61fb1c7232147379bd304
Score3/10 -
- Target capa-testfiles-master/03b236b23b1ec37c663527c1f53af3fe.dll_
- Size 566KB
- SHA256 6e730ea7b38ea80f2e852781f0a96e0bb16ebed8793a5ea4902e94c594bb6ae0
Score1/10 -
- Target capa-testfiles-master/03bb32d43885e83bc56c0b2bcad6f0c5ea40402763b7057056c654990022471b.dll_
- Size 13KB
- SHA256 03bb32d43885e83bc56c0b2bcad6f0c5ea40402763b7057056c654990022471b
Score3/10 -
- Target capa-testfiles-master/055da8e6ccfe5a9380231ea04b850e18.elf_
- Size 16KB
- SHA256 974cfecf7561cc6983e8c6f882f1c06b95e9134b0f38ec6373a5ad16b20aeaae
Score3/10 -
- Target capa-testfiles-master/0596c4ea5aa8def47f22c85d75aaca95.exe_
- Size 184KB
- SHA256 377fdff7fd24bf9257447480a8061e0380902f795ac5f8aac3738663b6503a3d
Score3/10 -
- Target capa-testfiles-master/068a76d4823419b376d418cf03215d5c.exe_
- Size 243KB
- SHA256 39655d8f0d03173bd98de4d6f0c9bde51bc7ea0deed3a644ccd5d7732052e9c6
Score8/10-
Server Software Component: Terminal Services DLL
-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
- Target capa-testfiles-master/071f2d1c4c2201ee95ffe2aa965000f5f615a11a12d345e33b9fb060e5597740.dll_
- Size 642KB
- SHA256 071f2d1c4c2201ee95ffe2aa965000f5f615a11a12d345e33b9fb060e5597740
Score1/10 -
- Target capa-testfiles-master/0731679c5f99e8ee65d8b29a3cabfc6b.exe_
- Size 451KB
- SHA256 38a41e8128ae3955d541c8a00a93de1cd10a01c58368c8254a35659f8627ba30
Score3/10 -
- Target capa-testfiles-master/0761142efbda6c4b1e801223de723578.dll_
- Size 8.7MB
- SHA256 94a9155bed7e9d2752f7d861a608ccfeade029379f734220c5a1bbc1b563ed0e
Score1/10 -
- Target capa-testfiles-master/0796f1c1ea0a142fc1eb7109a44c86cb.exe_
- Size 44KB
- SHA256 3400a7df9ec3dc8283d5ac7accb6935691e93feda066cc46c6c04d67f7f87b2b
Score8/10-
Tries to connect to .bazar domain
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
- Target capa-testfiles-master/07f7846bbcda782e5639292ad93907eb.exe_
- Size 24KB
- SHA256 a52c3792d8cef6019ce67203220dc191e207c6ddbdfa51ac385d9493ffe2a83a
Score7/10-
Drops startup file
-
- Target capa-testfiles-master/0831bb382211a67c57a392955138808526aa15e55531091841706aae2cb89613.exe_
- Size 114KB
- SHA256 0831bb382211a67c57a392955138808526aa15e55531091841706aae2cb89613
Score3/10 -
- Target capa-testfiles-master/0953cc3b77ed2974b09e3a00708f88de931d681e2d0cb64afbaf714610beabe6.exe_
- Size 122KB
- SHA256 0953cc3b77ed2974b09e3a00708f88de931d681e2d0cb64afbaf714610beabe6
Score3/10 -
- Target capa-testfiles-master/09bf850be5da44a1c3629a1f62813a83.dll_
- Size 119KB
- SHA256 21f173a347ed111ce67e4c0f2c0bd4ee34bb7ca765da03635ca5c0df394cd7e6
Score3/10 -
- Target capa-testfiles-master/0a0882b8da225406cc838991b5f67d11.exe_
- Size 169KB
- SHA256 aa2316ff30647295efac2c884b30b6e83a8515c2d2ff1df3c5d6091b404c73a9
Score10/10-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target capa-testfiles-master/0a30182ff3a6b67beb0f2cda9d0de678.exe_
- Size 86KB
- SHA256 f3f585befd991857991d34adb5fccc995aa3c60c2cc1f8c5af63cf0db6295e65
Score1/10 -
- Target capa-testfiles-master/0a942aca9589d10f7b8f127870ca35cdd90d25c0b3449abe0434ffeb9f93f277.exe_
- Size 121KB
- SHA256 0a942aca9589d10f7b8f127870ca35cdd90d25c0b3449abe0434ffeb9f93f277
Score1/10 -
- Target capa-testfiles-master/0cd2b334aede270b14868db28211cde3.exe_
- Size 309KB
- SHA256 14007b6fb425d03035a2a54dd71e3044c2b9601ff35dd2cc27b7dac8c5b7f63e
Score7/10-
Loads dropped DLL
-
- Target capa-testfiles-master/0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe_
- Size 104KB
- SHA256 0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464
Score7/10-
Executes dropped EXE
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target capa-testfiles-master/0da87fccbf7687a6c7ab38087dea8b8f32c2b1fb6546101485b7167d18d9c406.exe_
- Size 5.0MB
- SHA256 0da87fccbf7687a6c7ab38087dea8b8f32c2b1fb6546101485b7167d18d9c406
Score1/10 -
- Target capa-testfiles-master/0db010298586f17ee7e46f390d5724be.exe_
- Size 37KB
- SHA256 533b88374124845e501e0a83aac9a3c1289afe74f3021d50e07009c6fe3f246c
Score1/10 -
- Target capa-testfiles-master/0f33c2fec223823f84a732ceb1ad94ed2645e896095144850cf1443aeda67da6.dll_
- Size 52KB
- SHA256 0f33c2fec223823f84a732ceb1ad94ed2645e896095144850cf1443aeda67da6
Score1/10 -
- Target capa-testfiles-master/0fd8330e00aa48676d6d0c4f36e9a80b.exe_
- Size 79KB
- SHA256 7d7e91a26864d10cf3fb05e371366b2b67954150c2b7d7a33e715c07bcd7e0d4
Score1/10 -
- Target capa-testfiles-master/1038a23daad86042c66bfe6c9d052d27048de9653bde5750dc0f240c792d9ac8.elf_
- Size 41KB
- SHA256 1038a23daad86042c66bfe6c9d052d27048de9653bde5750dc0f240c792d9ac8
Score3/10 -
- Target capa-testfiles-master/10cd7afd580ee9c222b0a87ff241d306.dll_
- Size 71KB
- SHA256 cd697ed22e3ece7ef2e203c28c297d7be0b5ef862c2fd1a0c2f9b0fd3cc4e90a
Score10/10-
Detects PUBLOAD loader shellcode
-
Family: PUBLOAD, ClaimLoader, NoFive
PUBLOAD is a shellcode loader used by Mustang Panda APT.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target capa-testfiles-master/10ebcf8c20403457a08762200015b151.exe_
- Size 52KB
- SHA256 94d5ef0a9339770da3d38a7b6c02aaf3c63f3c95f878bb76c8bc6570ca15057b
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
3File Deletion
3Modify Registry
3Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1