Extracted

• • Target
    Miami Graphics.exe
  • Size 507KB
  • SHA256 3d08ef00c7b7c1ae32bbe32503644d7fbf4b34b9cbfa89c9a4aacd4a74691fdb
  • MD5 66f16204c98a3b93f0af0ace5865300d
  • SHA1 1b1889a0dd0ad65bcbf03c95390a2673406fd78a
  • SHA512 3ced065b4d5c353eddbc3509c0899242f6763301211e3f57004fba5801b6873a21213f66ab694734f3a7e724d00631537b9484da1013b89632408bce38c0fa5e
  • SSDEEP 12288:3oITx3f9+DAmq4tgktwBzCEMnjsuEAUxsL:dTxFG9tnwlCEBxs
  • TLSH
    T183B439247FA98A08D481267E455E1A04CBDED1F226327307370AEF624D05DDEDE6D3EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoorbankercollectiondefense_evasiondiscoveryevasionexecutionbdaejecdracula_stealerramnitpersistenceprivilege_escalationransomwarespywarestealertrojanupxworm

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Detects Dracula aka Samurai Stealer payload

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Modifies WinLogon for persistence

    persistence

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2