Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    hgf.zip
  • Size 15.9MB
  • SHA256 239d9701ff9c57e84080e53fb4c4606ca86438f4658994748000cf80e9ffd743
  • MD5 55edfebf5fdeda28d7baa7858b554019
  • SHA1 395d0034a2737e282d3c27b2eb533883056baa3c
  • SHA512 144e62a41d2ecf11dbcda2f50bc9d3f5778edad858a57e6538982ad054ddd67b396035598d22620441640bca22aec3644756317a2b1ff4f60822aecb99ec0d03
  • SSDEEP 393216:8IjtSEWPuhRW1R2JtWNhqKVzuC5zXA34tSQj:zRqR2JtEhqKVqC5jG4tJj
  • TLSH
    T1EEF61118A5073817FC655A33F1CE95B385B1AC80DA33DE7B325A768D8BB2187247235B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Power Off.exe
  • Size 621KB
  • SHA256 f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457
  • MD5 8d0b18eb87590fa654da3704092b122b
  • SHA1 aaf4417695904bd718def564b2c1dae40623cc1d
  • SHA512 fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828
  • SSDEEP 3072:paeTGhFvdX34iSh+gP01dM6U7Ho2nZ11YFVagzidIaYKaQFiyC6/sIvdX34iSh+B:p3TSvwo+TI9gNMwsEvwoLTI9AAI
  • TLSH
    T199D4DA48A5073807FC282973F1DE95B785B0AC80D933DE7B365A368D8BB555B20B274B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    UNKNOWN.zip
  • Size 22B
  • SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
  • MD5 76cdb2bad9582d23c1f6f4d868218d6c
  • SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
  • SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
  • MD5 SHA1 SHA512

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    a/Axam.a.exe
  • Size 11KB
  • SHA256 4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
  • MD5 0fbf8022619ba56c545b20d172bf3b87
  • SHA1 752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
  • SHA512 e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
  • SSDEEP 192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
  • TLSH
    T186329E8A7BBA6451C3D6C13347934E3863502D542D3A5F4A2AF5B3BB8CB0160F8106F4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  adwarediscoverypersistenceprivilege_escalationspyware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral7behavioral8
• • Target
    processhacker-2.39-setup.exe
  • Size 2.2MB
  • SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
  • MD5 54daad58cce5003bee58b28a4f465f49
  • SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
  • SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
  • SSDEEP 49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
  • TLSH
    T14CA53303DF540D3BD5B79B76973FCB154E6A734528346C63B20D5C8E8BA47A288923B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarediscoveryinstallerpersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral9
• • Target
    virusvippro.exe
  • Size 13.1MB
  • SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
  • MD5 7d1a85e807ff9b48edc2e08a01b35e07
  • SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
  • SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
  • SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
  • TLSH
    T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoor100000000defaultoffice04costuradefense_evasiondiscoveryexecutionasyncratcobaltstrikeformbookmetasploitphantom_stealerquasarratonratremcossolaris_loaderinstallerloaderpackerpersistenceprivilege_escalationratrevoked_codesignspywarestealersuricatatrojanupxdownloaderacrstealerdestiny_stealernanocorenightwiresalatstealersvcstealerxredxwormkeyloggerminerpyinstaller

  • Detect SalatStealer payload

  • Detect Xworm Payload

  • Detects ACRStealer V4.x

  • Detects NightWire

  • Detects PhantomStealer written in C#

  • Detects RatonRAT payload

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: Destiny Stealer

    DestinyStealer is a stealer written in C#.

    stealerdestiny_stealer

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Family: NightWire

    NightWire is a Windows stealer written in Rust.

    stealernightwire

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Formbook payload

    rat

  • Quasar payload

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Contacts a large (4904) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Creates new service(s)

    persistenceexecution

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Use of msiexec (install) with remote resource

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral11behavioral12
• • Target
    main.pyc
  • Size 12KB
  • SHA256 ef7220d8bc8a9cce0341a88026eef346facaed0f859525d55184caf4df18cb57
  • MD5 0ee8963c24b008f9a96fa492c89e69ef
  • SHA1 5628d9974ea0d4d4c3c5c1a77370ef664d0a8aba
  • SHA512 bc0f7569892dbe8c426997c35fe5439a79be8f753a0c0c2801c8529d29bf5b3982092eaff16bdace479e68efa248b1c38ac7b26ede4a214299fb62475fb4dbe3
  • SSDEEP 384:itYLLo88lQu1DnZnmQ3+9KCAbwgYVJrQkn:22LoHVDnVckb4SG
  • TLSH
    T1C342CF261C44D5B7CBB888B3DD6EC55E7ACE350A04B286FF56049990D57DAC801F9DC3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral13behavioral14