Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged.7z
  • Size 328.4MB
  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 0c22c97e5f0c0cd86a1daeff10d51581
  • SHA1 9f760e31fc9f4763cc04716e669d6ddd547f9fd3
  • SHA512 e31ee3466d4be1b660c73917fbc3ad288974316f4d8e92f8d2e8520c4c805ceb3b545bc1fda47a67563301aa4f2d12c8685818653e95d28fd5a8387154d9c833
  • SSDEEP 6291456:m3tJGUA4R5hz4EQLvSkRNLF9lD7C2GabF9sV0c3V+5ZcqAgZDFvVCG9KrGpUQXKz:cIqmSkRL7D7CBabqhGsuF9C3rGUQXKz
  • TLSH
    T1FCF833E898E71050F222D1A80DEAEA021F4D98D4B66DC4D32E652FFB5CEC2FF85B5055
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoor.paydaytrybulkadefense_evasiondiscoveryexecutionamadeyblankgrabbercosmuflyagenthermeticwipermispaduneshtanetsupportphantom_stealerquasarremcosrhadamanthysrustmesheetratumbralwarzoneratxclientxredxworminfostealerinstallerkeyloggerpersistenceprivilege_escalationpyinstallerransomwareratrevoked_codesignrezer0spywarestealersuricatatrojanupxwiperworm

  • A stealer written in Python and packaged with Pyinstaller

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion

  • Detect HermeticWiper

    Detect HermeticWiper Payload.

    wiper

  • Detect Neshta payload

  • Detect XClient Payload

  • Detect Xworm Payload

  • Detects Amadey x86-bit Payload

  • Detects Cosmu payload

    Cosmu is a worm written in C++.

  • Detects FlyAgent Backdoor

  • Detects Mispadu

  • Detects PhantomStealer written in C#

  • Detects Rhadamanthys Payload

  • Detects RustMe Keylogger

  • Detects Sheetrat Obfuscated Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Umbral payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu

  • Family: FlyAgent

    FlyAgent is a backdoor written in C++.

    backdoorflyagent

  • Family: HermeticWiper

    HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.

    wiperhermeticwiper

  • Family: Mispadu

    Mispadu is a stealer written in Delphi.

    stealermispadu

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Family: RustMe Keylogger

    RustMe is a keylogger written in C++.

    keyloggerrustme

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Family: XClient

    XClient is a trojan written in C#.

    trojanxclient

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber

  • Quasar payload

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Warzone RAT payload

    rat

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • HeartCrypt Windows executable packer

    HeartCrypt is a packer-as-a-service (PaaS) that injects malicious code into otherwise legitimate binaries

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Enumerates processes with tasklist

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1