Extracted

Extracted

Extracted

• • Target
    ae_mixtwo.exe
  • Size 1.2MB
  • SHA256 b3e188bf57cbc7a25832ea1623180c43508e31c9dfcd50c914b42954d6dd8ca9
  • MD5 3887291cd322703465aeb5a65f43eee7
  • SHA1 bf9592a2d325f2202869f067d54b9375eba1f378
  • SHA512 6e214a7c80c28b92f384e571ced872990b479b2fbcbb9f2babcd0f3c290c4458c133c3647f53ea664dc5f5dd9f37603a7fd29186f6645f76a913ed563d4c6b7a
  • SSDEEP 24576:MFCXxEYN57lxPc2U90hkyz6R7L4rQTf7yT:pmYN57ly2U90/Q7crQHyT
  • TLSH
    T17F454D5037EA25D9F0777E36D7EAB691EA3FB3737A06965B0600030F0622582DE53939
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoveryamadeygcleanersocks5systemzinstallerloaderspywarestealertrojancredential_accessexecutiondonutloaderremus_stealer

  • Detect Socks5Systemz Payload

  • Detects Amadey x86-bit Payload

  • Detects DonutLoader

    loader

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4