Extracted

Extracted

Extracted

• • Target
    .dll
  • Size 7KB
  • SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
  • MD5 dd3394a0ba6f7158d029e1c3a31b7a85
  • SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
  • SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
  • SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
  • TLSH
    T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Costura.dll
  • Size 5KB
  • SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
  • MD5 109bd38d2107f41573c48544992ead99
  • SHA1 028e9832f421f11f9497c610f1734e0f3d868037
  • SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
  • SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
  • TLSH
    T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral2
• • Target
    Leaf.xNet.dll
  • Size 129KB
  • SHA256 de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa
  • MD5 ea87f37e78fb9af4bf805f6e958f68f4
  • SHA1 89662fed195d7b9d65ab7ba8605a3cd953f2b06a
  • SHA512 c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a
  • SSDEEP 3072:gE3OJDHIfFLlL3pPiqhcLS/oZhttaMBM2cid:gHWZxJiqO
  • TLSH
    T182D33A357BF94A1EF7FE4778F87151008AB7B9496202EB6D681460EE1553B82C901FB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3
• • Target
    Spectre.Console.dll
  • Size 776KB
  • SHA256 317e77313bf0ed809d5f44eb1122c29b47927feea7bf692f2af8e405a101f6ef
  • MD5 984b7ee71c1c02ae46839743f87cdb87
  • SHA1 0fb998047809eca5072a055739e7f4d22a9beef2
  • SHA512 75fe98cb19681ec5889f722b2e4542f5c6da4cf883bb46c2dccfd2eddd3e9c848ec9a587338240dce79278db24330a806754b276aa0d9fea1fab727b5c496531
  • SSDEEP 12288:7zzvnfER2HXmvKixq7v4K9VwTU7Zv+Y4LkLiWgTJUbmvX:7vnyNKaIdYkLipJUs
  • TLSH
    T1D5F47C6433A483F6F4AD9E30E47655315A7F948A6610DB4E1D8C68CD0EFBF01AD02BB6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral4
• • Target
    Steamy Checker.exe
  • Size 16.4MB
  • SHA256 c543411b97421bb55446d2ee481c961f64b3567a8a023499f73c0403676e249d
  • MD5 ddb25088f56970fc53f40a19ee8c14c1
  • SHA1 7d5f55f604cc0aa6efdcb302478e6c8f618f11cb
  • SHA512 a2b1417d3998942a600de3cd31aa553d9c55fd96081bc73dc174e750b27a3f6819dcd56fc5c2ba60268763f095b44df387df4a0ae428882739f0409eac3d0eed
  • SSDEEP 393216:KkgffVmo4d8uT21V5kyc8X8Kzn9U3h9NbrKiREiHM4pt:Ng3APp6NLn9I9Nb+ibN
  • TLSH
    T1FF0733991A859BEED8C2DE312DD3E315B3BEBD604237438A05F03B161E366109ED79D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  runcosturadiscoverydownloaderexecutionremus_stealerstealcsvcstealerinstallerpackerpersistencepyinstallerspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral5
• • Target
    System.Buffers.dll
  • Size 23KB
  • SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
  • MD5 902760412abffbd10be14842e83f0c09
  • SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
  • SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
  • SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
  • TLSH
    T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral6
• • Target
    System.Memory.dll
  • Size 141KB
  • SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
  • MD5 bd7f42207f4fdb9c7eafb0013abd7334
  • SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
  • SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
  • SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
  • TLSH
    T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7
• • Target
    System.Numerics.Vectors.dll
  • Size 107KB
  • SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
  • MD5 a57f205ce75d4e4a19020e8b627469c4
  • SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
  • SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
  • SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
  • TLSH
    T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral8
• • Target
    System.Runtime.CompilerServices.Unsafe.dll
  • Size 18KB
  • SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
  • MD5 cb5b861883d2bddd9833c9fe956406f7
  • SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
  • SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
  • SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
  • TLSH
    T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral9