Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
  • Size 955KB
  • SHA256 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8
  • MD5 13694c1e016d5a35d902070111f63d18
  • SHA1 8a7de1581df4a927a1b5144af9d590750649aa2c
  • SHA512 5ddc6f8a61d0879a337f6eb751cfdf8965ba6efcc59abb1fe84f5a304588e0738be214c76dbf6d565d72ec00b8ae398c62f1492a66510926d452c1eca16e6b89
  • SSDEEP 24576:nnrmNg9r6EAsSDBpvEwL55pkRT8cDbhvKyew4:n39r6/DjlL55rcHE5w4
  • TLSH
    T1662523596BF72123F1B1A930313486B07BA7BE307A70A29D1654116C1F786E35AB0F6F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerbotnetdiscoverydanabottrojan

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  behavioral1behavioral2
• • Target
    014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe
  • Size 1.0MB
  • SHA256 014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89
  • MD5 00b24dcb1665fc7c6e67e51ed80d660f
  • SHA1 928f0cde4c8d935e181aa9b1990d72cbe58fd6eb
  • SHA512 588119d135c3a8d3cd3037da882a5e75f02075848f5a2624ead6739fd0e4c984493bfad6daa48306e8b30c03744156bc3be04532cfea7d2492212ce3f78e41d6
  • SSDEEP 24576:9QurI9Kqgrkv7yNS9QgPB5zbuawcXQhgKF:9QAI9KfQyEQq2O2XF
  • TLSH
    T1E735122237D0CDF6F1625E306952C6A49AEBBC265E25558FCB84672F0E370E087ED346
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    PO-8372929.exe
  • Size 1.6MB
  • SHA256 c2d42ef1435490d3bd280f0e1aaa0b42fe1d417e5364a000531a930c841f22f9
  • MD5 0b7d26586342b5eee2f7bd0e5d9c40fc
  • SHA1 204ea25f8d131c88b751aba5a4672a48692d324a
  • SHA512 98d7568b59c922495cf91864eb60f3d93d1c9fec2d34ceea443469c8890d8d781614c9b8235ed830a93df4717459fe20210bad25ee0ddd2b46aa6973026ebf1d
  • SSDEEP 24576:Dtb20pkaCqT5TBWgNQ7awxB1CdRVtYon4AS9HfmqMK5WKm5sJ6A:AVg5tQ7awxB1Cp7SWgWKme5
  • TLSH
    T11F75E12273DDC361C3B25273BA167751BEBF782506A5F46B2FD8093DB920122521EA73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • AgentTesla payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f.exe
  • Size 522KB
  • SHA256 0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f
  • MD5 026649ffe495ccbe47e6aa8215eb2291
  • SHA1 faab853607386e928e73c77c1338e16fea981bd1
  • SHA512 182b279e16e5c69db6de815861bcb1a13ec285f0b341cb53e78e4249ac781cad9bb3af20d608869d5c6506b4e94b08de61285bb0f42aad493502ba6bbfbb5b70
  • SSDEEP 12288:oNiBx56BMvgWUN02zePAZjI8R2PIVTDt:PWk4Rye5
  • TLSH
    T195B4E5B3D31CD9D1DD9952F4610E9E630A607F9FA0D5A2C81DEDB1BBC738661E1E0882
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverys5lformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral7behavioral8
• • Target
    OSSB RESPO....D GASES PDF.exe
  • Size 404KB
  • SHA256 f117245eaab9a6b6d5b35cf2c8be03e3b4411b7194291649d676d43037fd7626
  • MD5 e005a0a91d66a7686e28b59d3ab9e72a
  • SHA1 894d84bd4e1a1787112cca9c987b8820dae9454d
  • SHA512 bc10993d4578423596801b278c511a365452d3ace5493a9f01ba7ae29765e5bc6674918a43e72bf60223a5b0f5800ebc4db2e84d2bf7d0413b22086879a9c45a
  • SSDEEP 12288:LNiBx56BMvgcr15HECu2e/K4zD0sr2y3r+mcXu:m15HECu2e/trd3qmau
  • TLSH
    T11194F106A22A3B96D77FC3FDB162210047F5E4A27296E79A7FE140F50C62FD40525ACB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • AgentTesla payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral10behavioral9
• • Target
    RFQ- PT MULYA MANDIRI NEW ORDER PO 02.05.20.doc.exe
  • Size 699KB
  • SHA256 a744e64bd387c4f4ef681744a8fd7d8ab024e3f6650302f24163fe506e92cccf
  • MD5 cc65735b15a81c1070912c7f4e5455b1
  • SHA1 7b28884f945790693d37ad2625337ae26a58dcc2
  • SHA512 9172819283b1531e6f89d88540c5348e42c79621260859bcb8cdc3db40781e1779196d95b03b0ebbffa90f53309a509d53e68f4811fc3fd0403f575ceca9f9f1
  • SSDEEP 6144:Gwg5JHngb+geFAFOeFAOBOAEpMUwSoa1X6lHMqhAmCRFDhEbziWlL+91mRJ:IJgygzFOzOlECmoa1X6dMqhA3RQiWx
  • TLSH
    T1AEE46E3FAA456805E13C45B210A595A17276EAC73D01C74F39C9A7BCAF823CA371937D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  agilenetdiscoveryexecutionpersistence

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral11behavioral12
• • Target
    PO_May.exe
  • Size 934KB
  • SHA256 5b15b1fd3bf2eef911358d7125b5120eb716dcd75af883cd133dc0e346988c85
  • MD5 2e9388fa93aa73819d8fc600611cc73c
  • SHA1 cc271db98fc74f0cf3ee8508b3b546522876cdc5
  • SHA512 7f4181524ee0d908cd8bae86b9f355f0f1cd66b4837f820a2981b7b9444dec27ce2123885440c3971b0dc8c5279145100017322f09491804d7bf9d23f1ec852f
  • SSDEEP 12288:4YOUBBN/eZZe7M138vlLtfTpOOPBebQubsRPuUcsl6k4/yypwD6FoEwc:r58ZCM138v9rTJebvb55xk2pwD6FoEwc
  • TLSH
    T1AA159FC5F14888DBE93B19B3983BA63050467DED90F1811E729E772955B338210BFE6E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sa06discoveryformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Suspicious use of SetThreadContext

  behavioral13behavioral14
• • Target
    152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9.apk
  • Size 36KB
  • SHA256 152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9
  • MD5 e1f93c3987cdfc7841ec6bfb78b4e25e
  • SHA1 8013ac90e173750939bd5d3e43b20293c2e0f512
  • SHA512 aeb48a525b84f8a0d83c9edd9893ef1d0f24949ef75704ac63b2de3d74db5ff206627b5cbd08e18b85c420e17735eddbc7536e3e7954fe1806bf12b17ac9f029
  • SSDEEP 768:BjLOVb6vHL935DpWGjOIW6RFrYPlXfpcpP4N:BWbsL93t1TvRF4lXfpcpU
  • TLSH
    T12EF2F147BFA0B676D267AA3A9F691701FCBCF24D692B691AC510053E8D190B19F0B80C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryevasionimpactprivilege_escalationstealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads information about phone network operator.

    discovery

  • Tries to add a device administrator.

    privilege_escalationimpact
  behavioral15behavioral16behavioral17
• • Target
    PMT DETAILS.jar
  • Size 5KB
  • SHA256 928111a62a25ff3af20e627c8ab5edd0f333413988ea4ef90f75adf7cd5b6c39
  • MD5 3a9a0752b21ddce5af9dc6995c942405
  • SHA1 59922f4aebff3aaf2eb60e4ecb75fa00b38ed4cc
  • SHA512 94f580a1865a4566645cc3dc918d2427114f6c9c3d2de8cad3e411e7ce5207ea2b72b1b89c5434f85994cca91901231adf2e236bf4a8ef2c4a42780cb154b615
  • SSDEEP 96:GRFZlapHZhil91onRGXMhcGUYU6QB6/YshjVs9mhPgNSiTNySFryc1ZIumfv5xck:eFZMHZlIXMyne/drhIg6Lrl1AvvjR
  • TLSH
    T1B3C14B782DE8C38EC233C274C3CFA035EA6402D84B99F0975788E8542D698D4574BFEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  qnodeservicetrojan

  • Family: QNodeService

    Trojan/stealer written in NodeJS and spread via Java downloader.

    trojanqnodeservice
  behavioral18behavioral19
• • Target
    (RFQ_#20200219).exe
  • Size 76KB
  • SHA256 c3bc66d18946ecf4e0be034df58f5fdc4e7c78210c93a6b4c0a197288a976f0b
  • MD5 48463eb8b5ff3aa0b0d6014d28f15e80
  • SHA1 9f73f323e6d9fb4d3d40e32c90b57f35e5d1ab9b
  • SHA512 cd14f3ac1d61d446b6d594c1b4cbae77ab839a8b8ca78cf2d9f5c51a376ab6cc8cd69647eba7d4c66ff1c5dda1275ffbb25ace66d245b4a7b0f364ec2be7316c
  • SSDEEP 384:SF1J4ffYMHC7WPz0f7S0cl4ND+O4Eq6iouTmRtKvP7rL9Sqt:E1mi71Wvlwiy7vRI7rL9j
  • TLSH
    T1E7733C96B5D8E0B3D1924AB20F54FAF80A927D740C02CD03324E3B1D5A7BF15A9757A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloader

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent state file

    Checks state file used by QEMU agent, possibly to detect virtualization.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral20behavioral21
• • Target
    1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480.exe
  • Size 291KB
  • SHA256 1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480
  • MD5 c97d31e6c4311d688c7de8a19ba9f488
  • SHA1 2c0aa234321581f6414535e165a832b8cd4a4704
  • SHA512 62ffa02b28fa3105aa8da596d3f1fa3d26e820909de85e63dc1b539ac02305e08d5e77ec06a462f9864c281d3ff5db71fb8c9f624ea973c99981da080fa8b0ee
  • SSDEEP 6144:weOh9kp45g6fNFO2ActWo7qMT357w4DRUzI2t7UMS5PfK:wdkYn4AqMT35M4DRULHA3K
  • TLSH
    T1C254E106B6E38B6EF693E5735831CA4C0732895729325F679583C21568E1FCBB421BCB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverynanocorekeyloggerpersistencespywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral22behavioral23
• • Target
    237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc.exe
  • Size 245KB
  • SHA256 237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc
  • MD5 953de55f32a514c6590587789efc13bc
  • SHA1 e5d76050f2c6be59550eb0ad3302968b09774a26
  • SHA512 e216c66651efab6d6c5c05ccb753de51d7b53ceb93532f7db389d9a233527fd9d6800679fbf1a679b60fda2e79981602e21d344873331762ab79939ee4e9ca05
  • SSDEEP 1536:xfrG0BX7rRWua3L8rgUbvqDHSn34eU8fCZFQzBPmSASvaYV9zBmN7qD5G5Gcq4Ol:xDGsXn03tD6vNUGZchVrshM7KzhQ5
  • TLSH
    T1F334C4E2D5814190EDA94F7411322D3681BBBFBA7DB8B54E985EB0767B731C3203681B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral24behavioral25
• • Target
    280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b.exe
  • Size 613KB
  • SHA256 280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b
  • MD5 1331b2aefb47bb0be0ff0887d494daa9
  • SHA1 25a5ea4ebccabd376332f1b089789531a432812b
  • SHA512 027f978c64ee26757e0cecd1a271949c2b3aac60e57fde12a3492d2c6631456d2f40ce34d4feb12aa4941f0499ea9d38960a65629ed3531c7edb9afba6aa58ad
  • SSDEEP 12288:cxGRFtmUUzQySL0wKkQI84Ijz33tSXtYgdfeR44lF8t:UkFtmxQyQ0wiI84I/3Q9YgdGTWt
  • TLSH
    T155D48E73F2D04677D0761A795C1B97A8583ABE203E28A88B2BF53D4C9F35381743A197
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral26behavioral27
• • Target
    PO Doc 882258113 jy2rpdvg. xcaned from xeros multifunctional device (2).exe
  • Size 397KB
  • SHA256 437814cb410ed70eaaac12965985bf31492ade3b5adc6efea838868ac61c624a
  • MD5 97e137140c1ad868364d3018cdc877a9
  • SHA1 6257ed03911016997edbe6deec63416b75933ec5
  • SHA512 8d693141ce244640d29b8dc4343f7970273473091401dedc1ceb4bb6b42cdb0742e9133d3c895c0fc6df22a53efad62e083670d77a918f3310a5a79c020c6f7e
  • SSDEEP 12288:uNiBx56BMvgpKDlmX7ZNsD03MSONeJ4MTeERAfEcXMs4:KKDOvW08NM1bAEm4
  • TLSH
    T10E840166BB6A7F17D37E87FCA2A2700003F5B097B197C3592FE650F41A26F900515A8B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverycollectionagentteslakeyloggerspywarestealertrojan

  • AgentTesla payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral28behavioral29
• • Target
    BOQ & SPECIFICATIONS.pdf.exe
  • Size 1.6MB
  • SHA256 52f995a46c899c2f2eee60bfcff3788fa72d5953632121366aa00e6bff74ef57
  • MD5 ca47b1087159af27517471a7bd4af6ea
  • SHA1 15ede8441219ecdef9abb4f814957ab5dedd684a
  • SHA512 fe174470b5fecff826945c180f1b3625921f461a14728eb5aa4a4660faac9d37bffa6971b7f7885be5c954f3bd7a422d7b78d4ee81b29e184cc095c3937a3eb6
  • SSDEEP 24576:5tb20pkaCqT5TBWgNQ7axC7mUi3/kGBMpryZljVwKW0Dfnl/I1CR5qH9MV6A:KVg5tQ7axCaUOkGapryZ3BNbe1u5qk5
  • TLSH
    T18475E12273DDC364C7B25273BA16B701BEBF782506A5F86B1FD4093DE920122525EA73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojancollectioncredential_access

  • AgentTesla payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral30behavioral31
• • Target
    3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6.exe
  • Size 452KB
  • SHA256 3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6
  • MD5 885319be5c719ca896a32a123c3af494
  • SHA1 1244fb70d3639c31cf3ffc9503e7bc29863b5d3b
  • SHA512 b4db55f85d5f93c661074424849dbb3dba1c8d2f392205844ced74f5f282b9367620039a95ea7dd9b89a753cc4cacb1587add56d5b6526460e1a299627382cf0
  • SSDEEP 6144:2XNqCM/2Sxscg0KRENASR1W45K9eAoRfQWod1:2ECDt7mRsDet9Q
  • TLSH
    T114A44AC6B09697BFED4726FF358A855DBC23D91C1B4974FBC789AA520A30705EE22340
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdavediscoverytrickbottrojan

  • Family: Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Dave packer

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

    dave
  behavioral32