Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
  • Size 955KB
  • SHA256 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8
  • MD5 13694c1e016d5a35d902070111f63d18
  • SHA1 8a7de1581df4a927a1b5144af9d590750649aa2c
  • SHA512 5ddc6f8a61d0879a337f6eb751cfdf8965ba6efcc59abb1fe84f5a304588e0738be214c76dbf6d565d72ec00b8ae398c62f1492a66510926d452c1eca16e6b89
  • SSDEEP 24576:nnrmNg9r6EAsSDBpvEwL55pkRT8cDbhvKyew4:n39r6/DjlL55rcHE5w4
  • TLSH
    T1662523596BF72123F1B1A930313486B07BA7BE307A70A29D1654116C1F786E35AB0F6F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerbotnetdiscoverydanabottrojan

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  behavioral1behavioral2
• • Target
    014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe
  • Size 1.0MB
  • SHA256 014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89
  • MD5 00b24dcb1665fc7c6e67e51ed80d660f
  • SHA1 928f0cde4c8d935e181aa9b1990d72cbe58fd6eb
  • SHA512 588119d135c3a8d3cd3037da882a5e75f02075848f5a2624ead6739fd0e4c984493bfad6daa48306e8b30c03744156bc3be04532cfea7d2492212ce3f78e41d6
  • SSDEEP 24576:9QurI9Kqgrkv7yNS9QgPB5zbuawcXQhgKF:9QAI9KfQyEQq2O2XF
  • TLSH
    T1E735122237D0CDF6F1625E306952C6A49AEBBC265E25558FCB84672F0E370E087ED346
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerbotnetdiscoverydanabottrojan

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  behavioral3behavioral4
• • Target
    0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f.exe
  • Size 522KB
  • SHA256 0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f
  • MD5 026649ffe495ccbe47e6aa8215eb2291
  • SHA1 faab853607386e928e73c77c1338e16fea981bd1
  • SHA512 182b279e16e5c69db6de815861bcb1a13ec285f0b341cb53e78e4249ac781cad9bb3af20d608869d5c6506b4e94b08de61285bb0f42aad493502ba6bbfbb5b70
  • SSDEEP 12288:oNiBx56BMvgWUN02zePAZjI8R2PIVTDt:PWk4Rye5
  • TLSH
    T195B4E5B3D31CD9D1DD9952F4610E9E630A607F9FA0D5A2C81DEDB1BBC738661E1E0882
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverys5lformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9.apk
  • Size 36KB
  • SHA256 152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9
  • MD5 e1f93c3987cdfc7841ec6bfb78b4e25e
  • SHA1 8013ac90e173750939bd5d3e43b20293c2e0f512
  • SHA512 aeb48a525b84f8a0d83c9edd9893ef1d0f24949ef75704ac63b2de3d74db5ff206627b5cbd08e18b85c420e17735eddbc7536e3e7954fe1806bf12b17ac9f029
  • SSDEEP 768:BjLOVb6vHL935DpWGjOIW6RFrYPlXfpcpP4N:BWbsL93t1TvRF4lXfpcpU
  • TLSH
    T12EF2F147BFA0B676D267AA3A9F691701FCBCF24D692B691AC510053E8D190B19F0B80C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryevasionimpactprivilege_escalationstealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads information about phone network operator.

    discovery

  • Tries to add a device administrator.

    privilege_escalationimpact
  behavioral7behavioral8behavioral9
• • Target
    1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480.exe
  • Size 291KB
  • SHA256 1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480
  • MD5 c97d31e6c4311d688c7de8a19ba9f488
  • SHA1 2c0aa234321581f6414535e165a832b8cd4a4704
  • SHA512 62ffa02b28fa3105aa8da596d3f1fa3d26e820909de85e63dc1b539ac02305e08d5e77ec06a462f9864c281d3ff5db71fb8c9f624ea973c99981da080fa8b0ee
  • SSDEEP 6144:weOh9kp45g6fNFO2ActWo7qMT357w4DRUzI2t7UMS5PfK:wdkYn4AqMT35M4DRULHA3K
  • TLSH
    T1C254E106B6E38B6EF693E5735831CA4C0732895729325F679583C21568E1FCBB421BCB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverynanocorekeyloggerpersistencespywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral10behavioral11
• • Target
    237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc.exe
  • Size 245KB
  • SHA256 237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc
  • MD5 953de55f32a514c6590587789efc13bc
  • SHA1 e5d76050f2c6be59550eb0ad3302968b09774a26
  • SHA512 e216c66651efab6d6c5c05ccb753de51d7b53ceb93532f7db389d9a233527fd9d6800679fbf1a679b60fda2e79981602e21d344873331762ab79939ee4e9ca05
  • SSDEEP 1536:xfrG0BX7rRWua3L8rgUbvqDHSn34eU8fCZFQzBPmSASvaYV9zBmN7qD5G5Gcq4Ol:xDGsXn03tD6vNUGZchVrshM7KzhQ5
  • TLSH
    T1F334C4E2D5814190EDA94F7411322D3681BBBFBA7DB8B54E985EB0767B731C3203681B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral12behavioral13
• • Target
    280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b.exe
  • Size 613KB
  • SHA256 280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b
  • MD5 1331b2aefb47bb0be0ff0887d494daa9
  • SHA1 25a5ea4ebccabd376332f1b089789531a432812b
  • SHA512 027f978c64ee26757e0cecd1a271949c2b3aac60e57fde12a3492d2c6631456d2f40ce34d4feb12aa4941f0499ea9d38960a65629ed3531c7edb9afba6aa58ad
  • SSDEEP 12288:cxGRFtmUUzQySL0wKkQI84Ijz33tSXtYgdfeR44lF8t:UkFtmxQyQ0wiI84I/3Q9YgdGTWt
  • TLSH
    T155D48E73F2D04677D0761A795C1B97A8583ABE203E28A88B2BF53D4C9F35381743A197
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral14behavioral15
• • Target
    3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6.exe
  • Size 452KB
  • SHA256 3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6
  • MD5 885319be5c719ca896a32a123c3af494
  • SHA1 1244fb70d3639c31cf3ffc9503e7bc29863b5d3b
  • SHA512 b4db55f85d5f93c661074424849dbb3dba1c8d2f392205844ced74f5f282b9367620039a95ea7dd9b89a753cc4cacb1587add56d5b6526460e1a299627382cf0
  • SSDEEP 6144:2XNqCM/2Sxscg0KRENASR1W45K9eAoRfQWod1:2ECDt7mRsDet9Q
  • TLSH
    T114A44AC6B09697BFED4726FF358A855DBC23D91C1B4974FBC789AA520A30705EE22340
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdavediscoverytrickbottrojan

  • Family: Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Dave packer

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

    dave
  behavioral16behavioral17
• • Target
    3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js
  • Size 193KB
  • SHA256 3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00
  • MD5 421bdc206ca515eff10d9019e7d6682d
  • SHA1 61d69fe41176f9dcf84fcc451cd3375d55b277c6
  • SHA512 d1ad2b34cb8f816468839ed38fce1ea9ca7bae14a30807832d2c108608ecfc2b1f9cec1e5254b6bbae0827b3f2944b504b750d3f6a3499bcdf2847d2aabb9507
  • SSDEEP 6144:GpdWeXigeXFd1LdkiOBvRZRHFPAeRnAklgF2GuuZD:4Sd1LjOJ7dTtl029q
  • TLSH
    T16F14A07B690AFDDDA7762AC090292615CCDDB60B1308C158FACCB5483F76160CFBA976
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral18behavioral19
• • Target
    4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da.msi
  • Size 1.1MB
  • SHA256 4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da
  • MD5 ef4be631848738f8a19b9c83aedb2fe0
  • SHA1 f8a546309e2cc86900654788c01a2344b4f6e4f3
  • SHA512 93fcdca28c2f19ac21fce976812b9baabc1c6cf239540bc28d5aafd160838f68d026f2ba235a9b548e29018ad070387810c43f2caa492b087e8e80f693484912
  • SSDEEP 6144:OE1fJEHMOJABJJ2+Rinnnnnnnnnnnnnnnnnnnnnr:OEfE4Unnnnnnnnnnnnnnnnnnnnnr
  • TLSH
    T1B135F1E0E829FE57F326D43CA025F658C6D91CE1E706D07AB02AF6A455B3390245DB2F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoverypersistenceprivilege_escalationransomware

  • Checks QEMU agent state file

    Checks state file used by QEMU agent, possibly to detect virtualization.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral20behavioral21
• • Target
    437814cb410ed70eaaac12965985bf31492ade3b5adc6efea838868ac61c624a.exe
  • Size 397KB
  • SHA256 437814cb410ed70eaaac12965985bf31492ade3b5adc6efea838868ac61c624a
  • MD5 97e137140c1ad868364d3018cdc877a9
  • SHA1 6257ed03911016997edbe6deec63416b75933ec5
  • SHA512 8d693141ce244640d29b8dc4343f7970273473091401dedc1ceb4bb6b42cdb0742e9133d3c895c0fc6df22a53efad62e083670d77a918f3310a5a79c020c6f7e
  • SSDEEP 12288:uNiBx56BMvgpKDlmX7ZNsD03MSONeJ4MTeERAfEcXMs4:KKDOvW08NM1bAEm4
  • TLSH
    T10E840166BB6A7F17D37E87FCA2A2700003F5B097B197C3592FE650F41A26F900515A8B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistenceprivilege_escalationcollectionagentteslakeyloggerspywarestealertrojan

  • AgentTesla payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral22behavioral23
• • Target
    484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863.jar
  • Size 495KB
  • SHA256 484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863
  • MD5 387f5cedb97aff48c3905a0b5a635604
  • SHA1 7b8c94ccc84d5f48119af79ff5e47b4fa8d3738c
  • SHA512 899d8848351d5b7b918a7ed38a610dceb82d8928c1f26d955aa206f0fe9ede1161e93e845adb67372d953ea972cbefc3d8d53a624ba909b6ea5a9e29d861988a
  • SSDEEP 12288:Ipeb8cFBDLwPHEPrqxXVzqnQOzaO9yHhH7jtvEAv2ODv71Dzbk:eqBQwSYaOIHhHd52sv79k
  • TLSH
    T130B423B9A90C9337E27F2338580178B29CBDC12DE40BD8A5D0A5D336596CEE91F87E51
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionadwindpersistencetrojan

  • Family: AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral24behavioral25
• • Target
    484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78.xlsm
  • Size 411KB
  • SHA256 484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78
  • MD5 b430c7ad70cf8acf00c3399041d0e90a
  • SHA1 162f4ba878f11c824c88760ad3322f7b85a99a51
  • SHA512 27e4d4c6cfbac4ab1a717f3a8c56be98f7456b003fb294f29ab41f8012522bfde4c74519ebcbcc00cc23344614f9e927b65e79423884d1a623db16575f0eb8df
  • SSDEEP 12288:G49w8fyunGthwu8kxPthZugvq4jzjSGUu9M:G49b7AhFxPthZnvL3tq
  • TLSH
    T10094233FD298BE8ECAF3EA7D8D458AE7231653DD339078BA686C8484065F12DC071D95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral26behavioral27
• • Target
    4ca951e9d3fcc4196ad777f1f908cf2857e6ed55a7d72d7b0f6636a6b522fe7e.exe
  • Size 963KB
  • SHA256 4ca951e9d3fcc4196ad777f1f908cf2857e6ed55a7d72d7b0f6636a6b522fe7e
  • MD5 11b8443bb27a671c0fe7b7bd176f205a
  • SHA1 cea9fb3e370f50ddc41a1dee7a55d80c9358c1e7
  • SHA512 b31e0e6915ddb62afa88a8906273a4c46a2b4b04ca84647024af6404ae9b89af05fd1f7bbfbbfa0d98e21d48230a3dac35d78fbbc0a4393a3f1d7a9d47c1bdfe
  • SSDEEP 24576:YuuH8Hn64rWbXiaYXLmUBVpCsBtEe/eTXrLx:5H6ZyTX6+pCQEwel
  • TLSH
    T1D325239966D6983AD4E1D1F539B1B3E41A273932B371865FF34C9A8E1E306E40CB6307
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerbotnetdiscoverydanabottrojan

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  behavioral28behavioral29
• • Target
    4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe
  • Size 438KB
  • SHA256 4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991
  • MD5 a6b33c0c749c8f6b094de46fbd993627
  • SHA1 5b8cb1fdcea5858efbd48362512220983225eca0
  • SHA512 9dcbcbd601d2e9ef807b1abcb2a23b2c76f133c8adca099c14872ee39174a294caf2f2a6a44c329262b14adef388b33c5a462c0cf414944b2ff8e72e9a4117a6
  • SSDEEP 12288:77gLd7i2OcejBo+ek4ciC1dmamRSL77Emi162IkSajXphuhoFPVzfIl5cJb:7Ed7i2OcejBo+ek4ciC1dmamRSL779it
  • TLSH
    T1F4949D2815E9551DF5BF5B79D9F82121CBFCBA633603F75E45A011AA0D33B80CE8226B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdefense_evasiondiscoveryevasionexecutionremcospersistenceratrezer0trojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral30behavioral31
• • Target
    51ae05ee92d6ab4b2a4590f967d645c4db074f74267e95e4fa5c2b9e5485cbc3.exe
  • Size 391KB
  • SHA256 51ae05ee92d6ab4b2a4590f967d645c4db074f74267e95e4fa5c2b9e5485cbc3
  • MD5 d301e3da0a7cb82dd0c1d926e3028007
  • SHA1 3c9651c0c529004cfd81e96c6a754b24bfc6bc4d
  • SHA512 0bbdf5274261cfd4fcb988dc45fea5c2610062f52c529c739732b9744efdcf6dcb850cf6e578107bf62831f023386bf78f85cc17e3d7619fb6637322080f9b1b
  • SSDEEP 6144:/NiBx56TIAMvg9/zlcmAXe+VMvij926Yk45x+HqBlodgPQJ3ofL/BnhJfAorB270:/NiBx56BMvg55ijcvzpr5D9fAorB
  • TLSH
    T1B384F19272697F57C23E87F9E161311043F1B0D77262E3867ED142F92829FE81A255CB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral32