Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
  • Size 782KB
  • SHA256 a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b
  • MD5 0307ec61fb90b7281da0ffbd4def0e80
  • SHA1 259a485ba24dbc243a0e7f8f8f60c890ac87a161
  • SHA512 a25b3b8f86f22fd93976fa50e6fae13b4076ae4b3895dd96a694cb667c39908c0a628b7765e50ba819249143386d7406d7ec44f0bd397c9a6eed9f5d0a847ae1
  • SSDEEP 12288:VvYIWGASYfVsFlEIU+iQanWcR79bVqIhf9aNZzZi+kzcnUEJ:VlWOpxiQSW22BZi+5xJ
  • TLSH
    T12B05BE00B2788F0AE5BA4BF80166D63097F55E5D747DE7098DDABCEB7A60B011B84B13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverymassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
  • Size 689KB
  • SHA256 ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a
  • MD5 1ca786b1741e68cec2ce1c13bad8a45f
  • SHA1 ec590c27e631ad238b1e736efc77d5c41fbeb15a
  • SHA512 107d0984ef5ea10d2e6d270d788594394f0121d9d62f6713f8e452bfdfa88edd5ed865baa7ac0a20df56146eaafb693afb2f117286ebd19cc9af0cf7cf04eb6c
  • SSDEEP 6144:GeJ286NdbQ3c/jOTKEPojJ0hAWlUDt9O3PItF0GvNpBCTwdFvqg9hgWImSepTPbV:uljOTKEzht8t9O/K64NpkTL4jIm5Pd
  • TLSH
    T1EEE45B4137E88A27D26F13B9D4F1051657F1E48AB6A6DB8F5AD4D2DC1C83B806E043EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryduplexspyratrat

  • Detects DuplexSpyRAT

  • Family: DuplexSpyRAT

    DuplexSpyRAT is an open-source Remote Access Tool written in C#.

    ratduplexspyrat
  behavioral3behavioral4
• • Target
    Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe
  • Size 147KB
  • SHA256 aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb
  • MD5 6241f16b5c466a46f925c0415ef38214
  • SHA1 3aaf9ac50fe04ba4b4535e89c056170ba74b8ebb
  • SHA512 0f2c6477f245299f186676d10c198d95b2acb4362a36d7247019cb269a759ae50570acd27330164091a88f4bf1f8bf5867dd3f1793cd8b78eb3ce38857d2c46c
  • SSDEEP 3072:y6glyuxE4GsUPnliByocWepSaEYLUTcVWH0XUQx4b:y6gDBGpvEByocWeOYLULUXUQ
  • TLSH
    T15FE36D21F212E073C87718F53B36B572F39A4D6C19996847DAE80F5DBCA48232F14A97
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydragonforceransomwarespywarestealer

  • Family: DragonForce

    Ransomware family based on Lockbit that was first observed in November 2023.

    ransomwaredragonforce

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral5behavioral6
• • Target
    Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe
  • Size 1.1MB
  • SHA256 b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02
  • MD5 41fd143e8a7cd4d3c98a20e8380a6cfd
  • SHA1 b8c85fa5a81b3d70a21835fbea394e0611461bf8
  • SHA512 521dadc80bd429ab99d4a1e4a2b3f41329cba8b8b1708c35c20361f5e925496ec1509af449142f0fda2fc3cf53f806509dee98ae2096ec2cc1bd27e62047c05d
  • SSDEEP 24576:l/R+w8jaP9HncW1/CQ/FO4iOu5AxZkQULiHErN7+uUcLw:l/D19aNXiqYvv
  • TLSH
    T1AB356C2BB284653AD4AA1B3A4A73A310593BBB6175238C5F57F14CCCDF395402E3E687
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionblacknevasimpactransomware

  • Detects Windows variant of BlackNevas ransomware

  • Family: BlackNevas

    BlackNevas is a cross-platform ransomware related to the Trigona family.

    ransomwareblacknevas

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  behavioral7behavioral8
• • Target
    Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe
  • Size 11.1MB
  • SHA256 7f45e64e06c8f0441ad2701b9bb2c0c15722d7066459eca27f41d1b05a3f428c
  • MD5 3e9487501bf00185e1a22e7907b97e44
  • SHA1 a7a0ad08218366aad51472e54b780f68b924ca84
  • SHA512 501ab149c155f75e787ddf9ee5724b488bf9df5e690d207984042b82c31bc468ea9f0ac8012c11635cfddde9b91223da0c4af089ffaa8c37860bd9c351022169
  • SSDEEP 98304:N4bd/JshlzK5KbZVT4A4pfmST0sIIuxPZT:cs6MO0svuxPZT
  • TLSH
    T159C65B41FA8B54F6E9031831406FB23F63315D049B28DBDBEB587F6AFC77681196A209
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysalatstealerpersistencestealercredential_accessspyware

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral10behavioral9
• • Target
    Red-Flaged/b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637.exe
  • Size 151KB
  • SHA256 b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637
  • MD5 1aadb27c19050b903a8cfc63f426db36
  • SHA1 8d890c547c1ca7538a6762e0077962661c3e0438
  • SHA512 b8beb2279ecc3d6a06539abad111e50842e08451c1f252701dde59d795dc7338027435b39afaaa37a775c8e75a2d4ddb86ed132dfce8c466edc8ad44913ba137
  • SSDEEP 3072:WwyN3+agCaCcaTHuMOaZDMsMPdgyagEBHk+hvwz1B:WwYuMTOMOa1MsMla3w
  • TLSH
    T1BFE36C02B3F991FCE063C534DA729D13EB767C4A5139571E8B5047A60F22F50AEAB721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondiavolimpactransomwarespywarestealer

  • Family: Diavol

    Diavol is a ransomware that has been active since 2021.

    ransomwarediavol

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral11behavioral12
• • Target
    Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
  • Size 2.8MB
  • SHA256 b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7
  • MD5 03c2034d91589b84d2f95b5e9408aedb
  • SHA1 ce1d4859cc8aedd425104ccb95f7e10b32658785
  • SHA512 049d94328709ce28c910bbd01ea22a563397169b6ed3659834eeec8a21bb6999d84791ac09a2c440ffc0ddbf1455f5360948555679e98871cfba37842490ff20
  • SSDEEP 49152:WU7XuDD/7oLfKyB4nJkq0Nw9c3A0Q5YzE8PvV3B/lH:W77cKdiq0sc35oYxPtR
  • TLSH
    T165D57D07BCA108B9C4AAA331C9A692537B75BC481F3223D77E50B27C2FB6BD45976704
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhellcatransomwarespywarestealer

  • Family: Hellcat

    Hellcat is a cross-platform ransomware written in Golang.

    ransomwarehellcat

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist

    discovery
  behavioral13behavioral14
• • Target
    Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
  • Size 820KB
  • SHA256 bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
  • MD5 4f8091a5513659b2980cb53578d3f798
  • SHA1 60f925ca7f6d2ea77fd58b14d6259c4256fba899
  • SHA512 ad99a6e51e4bb68856f7ae2d85eee777ba55fd93808805df8991535bbc72ebe28a3f20557ca234aa76702608fa2539c02011b3f17b4b571fd1b06970a42b0fe5
  • SSDEEP 24576:4AzX0QVt4LjwctL0fn7J7eKj6a5VCxoq:bRccw47J7Fj99q
  • TLSH
    T1CE051901E660D039F69301FBC7B681B8AE24AF30134554DFA2D879E59B368E63D3752B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates processes with tasklist

    discovery
  behavioral15behavioral16
• • Target
    Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe
  • Size 167KB
  • SHA256 c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d
  • MD5 41d3660b5321768122f4c25ac9868fc3
  • SHA1 d42e3c5fc24e309581819cba723b14c3c247d824
  • SHA512 e02797980f11075715499878f06cfcb71a12da81f8b62f7c30deb31b831137472c450b95f5ebe9349a4205041b6f65c6468d217c2fa36a91902f75c7d5aed549
  • SSDEEP 3072:oBYHQAFbcjCdDK8l8wqxrytfAndlzFvxHebZ5h2jgSw6KXwApEnB:oBYHjajw5lB2LzdxHeblqk6K
  • TLSH
    T127F34C6833FD4A19F3BF4A3998B4919046BAF9A56933D75D598030FC2A327C1DA10B73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryarcanepersistenceprivilege_escalationratspywarestealer

  • Detects ArcaneStealer in memory.

  • Family: ArcaneStealer

    Arcane Stealer is a .Net information-stealing malware that is easy to acquire in the dark web.

    ratstealerarcane

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral17behavioral18
• • Target
    Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
  • Size 436KB
  • SHA256 c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6
  • MD5 a59cca1e2762abe6f3518452655e7c32
  • SHA1 3302718cffc7454b85df790a61da318b4a93505d
  • SHA512 016e09b7895f1fbe814ce395a7277d2e4c09f3168ae86e16de7a1e6cdb6e63d6865beee0d0718b1f76b3cb12310563094c642bd3e02e15abbb25c130b71fa760
  • SSDEEP 6144:KbEJIjNDv0bNXkbvLdEJIjNDv0bNXkbvL5:rIZGNXkbvL0IZGNXkbvL5
  • TLSH
    T1A394185069BDFD60EA245279AC537DC392593ECA3F9DCF52B1A188F38438AA51C4B0D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverycosmuransomwareupxworm

  • Detects Cosmu payload

    Cosmu is a worm written in C++.

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu

  • Renames multiple (2683) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral19behavioral20
• • Target
    Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
  • Size 181KB
  • SHA256 c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7
  • MD5 0f6d6ef9b82ece9dbbdc711ac00b5e6a
  • SHA1 15ca8d66aa1404edaa176ccd815c57effea7ed2f
  • SHA512 f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1
  • SSDEEP 3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18
  • TLSH
    T16B047D10FED2C431E4B70A701AF9E7F5953E79140B3099DFA7900B69AE30AD286357B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymamonaransomware

  • Family: Mamona

    Mamona is a ransomware that has been active since 2025.

    ransomwaremamona

  • Renames multiple (145) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral21behavioral22
• • Target
    Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe
  • Size 1.3MB
  • SHA256 c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8
  • MD5 f0f300206af1eed81b7b74357df437da
  • SHA1 08fe9443a43fff0c40847b42345183038c159ae1
  • SHA512 6582459c5bcec1babd5239ddf716823e97b6bfc5c7954f2faebb36092cb698369110218ea33cf59ec61a005c5de9c5082ccb66f78f1bd487d8dd4f607d55d4b2
  • SSDEEP 12288:6GEjaHvBhXPmL8sBCL4cQH3TI70bhZTow+q+ttQONIa8l9mCcxNp75sNyF:6NuDmL8ssc3H3TII7QQQiX6iC
  • TLSH
    T19E553A217B4A98BDC05AC47487464A722A7130CB1B36BDFF44D896783E6AAF41F3D724
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryjlockerneshtapersistenceransomwarespywarestealer

  • Detect Neshta payload

  • Detects JLocker ransomware.

  • Family: JLocker

    JLocker, also known as JRansomware, is a new Rust based ransomware.

    ransomwarejlocker

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral23behavioral24
• • Target
    Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
  • Size 1.2MB
  • SHA256 d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455
  • MD5 823e4c4e47e8dabe32fc700409a78537
  • SHA1 f973a6495b33941be62a59ee17085051cfca4719
  • SHA512 a805c176e0d650bee5270f4da0d7907c828affeb6d351506a13bc42a5550901006f1ca51d39c24bc1d64e86cff5592b81ef0ec3edc2459d282aee85d7a6a2c29
  • SSDEEP 24576:W88lWqXTOlAiZLkk7g9WWYNranPdeDk7bE0KdYqTAK:WTl3XTOl6ag90cPdX/Ad9TA
  • TLSH
    T12155332AD712E8A5F34B847DB47C9F990824B4E8C4AC7A57873F4D2365735D2A0CC9E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutioncrytoximpactpersistenceransomwarestealerupx

  • Family: Crytox

    Crytox is a ransomware that has been active since 2020.

    ransomwarecrytox

  • Clears Windows event logs

    defense_evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (14322) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral25behavioral26
• • Target
    Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
  • Size 1.1MB
  • SHA256 d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc
  • MD5 1ecbe08e98d64f9f39848b939710e560
  • SHA1 00a618d18552efe1ce68b0ed526e4a447e8333bf
  • SHA512 186ba338686f7517a56e15921a407bbed24492b7ca6c4dd5c563447939ffecf4dc08853f9ce95dcc49e20659c83075fbdab8c515c0e3e38cbd061df0a72c183a
  • SSDEEP 24576:Yna4qO2uUWyu2czCieYdBQdtsqha1odDSwwOOa:YnKO2ox1eYdudOqiolSwwOOa
  • TLSH
    T15D45E196B7E503F5E1B3D179CA958E42FAB2B8450720A7C703E496B12F136D15E3E322
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ebf46513ca28013c559d967cdb3a7740vidarstealer

  • Detects Vidar Stealer

    stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of SetThreadContext

  behavioral27behavioral28
• • Target
    Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
  • Size 4.6MB
  • SHA256 dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a
  • MD5 7e6bf818519be0a20dbc9bcb9e5728c6
  • SHA1 73f9469507d6162303821fc97d4809a2968f4ba3
  • SHA512 8824d15eefea3718b81c86134e078b5c1dbb49f9063ca636f76dba8c88e7aa7dc435a8ebf64e38528b6124e423e82f7e9ff8d40e538c78876b773db2048d4346
  • SSDEEP 98304:XK/cNYG9+pS2QyplZlUiQdt9fRWfWT6XQSUtaVkq9mVZR9Zw38Er6+0:tj6XlU6uZ08D+
  • TLSH
    T1C3366C43F69585E9C06DC1B5831BA333FA33B8894524B3AB2BD44B213E55F906F5D3A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverypipemagictrojan

  • Family: PipeMagic

    PipeMagic is a modular backdoor written in C++.

    backdoorpipemagic

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral29behavioral30
• • Target
    Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
  • Size 418KB
  • SHA256 df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403
  • MD5 e84270afa3030b48dc9e0c53a35c65aa
  • SHA1 4a34bbad85312ef34b60818a47f7b5bb8e9a7e26
  • SHA512 6ed67ba3a12ae81b9899cfe5ecc7fad77176f8c0094bc09b16fe6508a813482e771fd7edb00f947a0f1efab46968c23fb217fa1a826da311ada4ea80d2b93374
  • SSDEEP 12288:FnvxplpMAX99S4B009MqyQMKNT7uwhfAD8xE:FvxplpMAtU4Bl9MdQFT7ukIoS
  • TLSH
    T1F5947C21B688C234E45119701DB8BEB245FC6A34275F88FBFBC58D795AA0AC17234F97
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverydevmanransomwarespywarestealer

  • Family: Devman

    Devman is a ransomware forked from the DragonForce ransomware.

    ransomwaredevman

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral31behavioral32