Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    2to1ep.bin
  • Size 13.1MB
  • SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
  • MD5 7d1a85e807ff9b48edc2e08a01b35e07
  • SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
  • SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
  • SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
  • TLSH
    T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefaultdefense_evasiondiscoveryexecutionasyncratcobaltstrikegh0stratkoiloaderquasarinstallerloaderpersistenceprivilege_escalationratrevoked_codesignspywaretrojanupxratonratxwormstealer

  • Detect Xworm Payload

  • Detects KoiLoader payload

    loader

  • Detects RatonRAT payload

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Gh0st RAT payload

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    4363463463464363463463463.exe.bin
  • Size 10KB
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 2a94f3960c58c6e70826495f76d00b85
  • SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
  • SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
  • SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
  • TLSH
    T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutioncobaltstrikedharmaxwormimpactinstallerpersistenceransomwareratrevoked_codesigntrojanupxr909credential_accessdestiny_stealerdiscordratmetasploitmimikatzphorphiexrustmestealckeyloggerloaderrootkitspywarestealerworm

  • Detect Xworm Payload

  • Detects RustMe Keylogger

  • Detects Stealc stealer Version 2

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: Destiny Stealer

    DestinyStealer is a stealer written in C#.

    stealerdestiny_stealer

  • Family: Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: RustMe Keylogger

    RustMe is a keylogger written in C++.

    keyloggerrustme

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • mimikatz is an open source tool to dump credentials on Windows

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft EdgeCookiesView

    Password recovery tool for Microsoft Edge browser

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Downloads MZ/PE file

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4
• • Target
    Synaptics.exe.bin
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • TLSH
    T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorclientpruebacollectioncosturadefense_evasiondiscoveryexecutioncobaltstrikedonutloadermetasploitmimikatzremcosremus_stealerrustmesharphoundxredxwormhacktoolinstallerkeyloggerloaderpackerpersistencepyinstallerransomwareratrevoked_codesignspywarestealertrojanupxadwaremacro

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Detects RustMe Keylogger

  • Detects SharpHound hacktool

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: RustMe Keylogger

    RustMe is a keylogger written in C++.

    keyloggerrustme

  • Family: SharpHound

    SharpHound is an open-source tool that collects Active Directory data for BloodHound analysis.

    hacktoolsharphound

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • mimikatz is an open source tool to dump credentials on Windows

  • Contacts a large (18476) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5behavioral6
• • Target
    TsarBomba.exe
  • Size 25.2MB
  • SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
  • MD5 91025d6f02e542f2e37ffce7d0ce8b51
  • SHA1 e2d80ef6075556cd23ce0445473c061f200b5dd4
  • SHA512 09c6d7f8b64c75e963d63ad1478a81f567182a948d652346f1c68d233efead615703aadb4ce9cd5e5fd7235089f2439e9153231ea3e1a2c677ae84aec29afc89
  • SSDEEP 393216:NVn+SLSF5pdHn2AXUCITkkkkkrkkkkkkkkkkkk6lX0wfGtbYTZb08MQUCITkkkkS:PduvnNG0shAQ31qnMb5OM9Tt
  • TLSH
    T13547C0863B60C192CDF278719473DAC016387E6DCF3255A6DBCB4A0ABC518B7051BE7A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoor158fdd2a4f5abb978509580715e5353f987654321cheatdefense_evasiondiscoveryexecutionades_stealerchaoscobaltstrikedcratdiscordratdragonforcegh0strathiddentearjlockerlockbitmassloggermodiloaderredlinerokratsectopratumbralvalleyrat_s2vidarvipkeyloggerxoristxwormimpactinfostealerinstallerkeyloggerpersistenceransomwareratrevoked_codesignrootkitspywarestealertrojan

  • Chaos Ransomware

  • DCRat payload

    rat

  • Detect Rokrat payload

  • Detect Vidar Stealer

    stealer

  • Detect Xworm Payload

  • Detected Xorist Ransomware

  • Detects AdesStealer

  • Detects HiddenTear Ransomware

  • Detects JLocker ransomware.

  • Detects Umbral payload

  • Detects ValleyRAT payload

  • Family: AdesStealer

    AdesStealer is a modular stealer written in C#.

    stealerades_stealer

  • Family: Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Family: DragonForce

    Ransomware family based on Lockbit that was first observed in November 2023.

    ransomwaredragonforce

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: HiddenTear, Cryptear

    HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.

    ransomwarehiddentear

  • Family: JLocker

    JLocker, also known as JRansomware, is a new Rust based ransomware.

    ransomwarejlocker

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Family: ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Rokrat

    Rokrat is a remote access trojan written in c++.

    ratrokrat

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Family: Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Gh0st RAT payload

  • ModiLoader Second Stage

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine payload

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • SectopRAT payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral7behavioral8
• • Target
    cobaltstrike_shellcode.bin
  • Size 219KB
  • SHA256 b9321c27be4295c15d7f92fafc20d7ccac5f21204b79ebc2fed583dda0197cf9
  • MD5 24d99ba5654cdf31141c66fd9417b7e0
  • SHA1 0e06aedf5b25cf248131c9eff5a331f4bb1fcb67
  • SHA512 351e8c078595d1c829385d0bfbeb2560dd62fa063645e40593ba63af8862fc90bbd24438aebb0fb952cb78bf80b91ea35dbabdc91d760fd69c7f188e45075872
  • SSDEEP 6144:c8X2sNEFy+HVJbny+lgzgeFgUQI9aiGynMOyX:T3NEFy8VJO+GTFgUzaL6MO+
  • TLSH
    T16624CE7F6272415DCD82933955C180BE8C9B9C835FD0A324DDC0A0E47F65E7AA68EBC6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoor1359593325discoverycobaltstriketrojan

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  behavioral10behavioral9
• • Target
    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
  • Size 3.4MB
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 84c82835a5d21bbcf75a61706d8ab549
  • SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
  • SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
  • SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
  • TLSH
    T173F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealersuricataworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral11behavioral12
• • Target
    random.exe.bin
  • Size 6.8MB
  • SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
  • MD5 001e8ad1e0d0800e75b1fa32b07d2a46
  • SHA1 4c4fd4adfbcb8a2c3831f0f9605fcf65b44e9db7
  • SHA512 f0dde843f8b83c74ec05e7dbfa311f6943f5707c5ea641c7adfeab3e8cb2561c77c4ef0b74916fe90267a5c7093df98dd506ca89f1b24c6d5cc86f09539625f6
  • SSDEEP 196608:N0Dyo+Ougx9JW8e0e3/tELtyuT8IziZdG3fz:N0OfKWPKLtVQIeCz
  • TLSH
    T18F7633D43BD9A7A8E08B5BF9AEE180FA90A2C3F87CA8743C4D5E5141FC64A39B401D55
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fbf543fc155c5bf8a148a93a2ba17de68393f0nrif0lmdefense_evasiondiscoveryexecutionamadeyvidarpersistencestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects Vidar Stealer

    stealer

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Modifies security service

    defense_evasion

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral13behavioral14