Static

static

10

Resubmissions

18/07/2026, 06:29

260718-g89lcses8z

18/07/2026, 06:25

260718-g631ssax9k10

Sharing

Copy URL Twitter E-mail

Errors

Reason
XML syntax error on line 1: illegal character code U+0000

General

  • Target
    11031592.bin.7z
  • Size 185.1MB
  • Sample260718-g89lcses8z
  • SHA256 8c50a48c76172b3b7c35dd872b68a3599937c8fb7836ae3961aa7dfd8d66d5d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
agilenetratstealerminerpdflinkbackdoorspywarea310loggerblankgrabberinfostealerdcratloaderhijackloadermassloggerxmrigkeyloggerardamaxtrojancadelspy888ratluna_stealervidarransomwareech0raixsunburst

Malware Config

Signatures

  • Family: 888RAT

    888RAT is an Android remote administration tool.

    trojaninfostealerrat888rat
  • Family: A310logger

    A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarea310logger
  • Family: Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax
  • Family: Cadelspy

    Cadelspy is a backdoor that has been used by APT39.

    trojanbackdoorcadelspy
  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader
  • Family: LunaStealer

    LunaStealer is an infostealer written in Python and packaged with Pyinstaller.

    stealerluna_stealer
  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • Family: Sunburst

    A trojanized SolarWinds digitally-signed component for the Orion framework.

    trojanbackdoorsunburst
  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • Family: eCh0raix, QNAPCrypt

    Ransomware targeting network-attached storage devices.

    ransomwareech0raix
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • A310logger Executable 1 IoCs
  • Android 888 RAT payload 1 IoCs
  • Ardamax main executable 1 IoCs
  • CadelSpy module (Chafer APT) 1 IoCs
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • DCRat payload 1 IoCs
    rat
  • Detect Vidar Stealer 1 IoCs
    stealer
  • Detected SUNBURST backdoor 1 IoCs

    SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

    backdoor
  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • LunaStealer is a stealer written in Python and packaged with Pyinstaller 1 IoCs
  • MassLogger Main payload 1 IoCs
  • Vidar Stealer 1 IoCs
    stealer
  • XMRig Miner payload 1 IoCs
    miner
  • eCh0raix ransomware 1 IoCs
  • Detectes NiceHashMiner Payload 1 IoCs
    miner
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • Office document contains embedded OLE objects 1 IoCs

    Detected embedded OLE objects in Office documents.

File Explorer

  • 11031592.bin.7z
    .7z 185.1MB
  • 11031592.bin
    .jnlp .vbs 256.0MB

11031592.bin.7z

  • SHA256 8c50a48c76172b3b7c35dd872b68a3599937c8fb7836ae3961aa7dfd8d66d5d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected