Extracted

Extracted

Extracted

Extracted

• • Target
    Synaptics.exe.bin
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • TLSH
    T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoveryexecutioncobaltstrikediscordratdonutloaderrustmesalatstealersheetratsupershellxredinstallerkeyloggerloaderpersistencepyinstallerratrevoked_codesignrootkitspywarestealerthemidatrojanupx

  • Detect SalatStealer payload

  • Detects DonutLoader

    loader

  • Detects RustMe Keylogger

  • Detects Sheetrat Obfuscated Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: RustMe Keylogger

    RustMe is a keylogger written in C++.

    keyloggerrustme

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: Supershell

    Supershell is a cross-platfrom reverse shell written in Golang.

    backdoorsupershell

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Modifies WinLogon for persistence

    persistence

  • Contacts a large (8238) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1