Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged.7z
  • Size 328.4MB
  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 0c22c97e5f0c0cd86a1daeff10d51581
  • SHA1 9f760e31fc9f4763cc04716e669d6ddd547f9fd3
  • SHA512 e31ee3466d4be1b660c73917fbc3ad288974316f4d8e92f8d2e8520c4c805ceb3b545bc1fda47a67563301aa4f2d12c8685818653e95d28fd5a8387154d9c833
  • SSDEEP 6291456:m3tJGUA4R5hz4EQLvSkRNLF9lD7C2GabF9sV0c3V+5ZcqAgZDFvVCG9KrGpUQXKz:cIqmSkRL7D7CBabqhGsuF9C3rGUQXKz
  • TLSH
    T1FCF833E898E71050F222D1A80DEAEA021F4D98D4B66DC4D32E652FFB5CEC2FF85B5055
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Red-Flaged/JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe
  • Size 938KB
  • SHA256 08c29dfa0ccb747751c5ff3ccde88f7f8a5a87152121f75f60a886b14e86bf00
  • MD5 2363f93331fc792ae9cb5750043bdc89
  • SHA1 2fc0b7b4106a28ffe7f63f36ff64fe045e8f7daa
  • SHA512 a4a47c39e03c22844725b51ffd56f3ae01e9095733e8442eaba1fcf0e3a0e1edb127a6bf4b5ab8063614829db27919dea5a0e62f9e7d320e625fc498a603ad3e
  • SSDEEP 24576:PYrNtws0/BP9qDVgk7YIPo0NJ+ISzFKs:PM7YBlqDVbNNJNS0s
  • TLSH
    T10015CF0021796FA2F93C97F52649621883F9369F08EEE7740CE5B0E711B9F875A50AC7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionmatiexkeyloggerpersistencespywarestealer

  • Family: Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    Red-Flaged/JaffaCakes118_30f515392358142b507a486d7ab379d2.exe
  • Size 70KB
  • SHA256 c36f30481ce328712716ed35515c79075b411ac492164996e9078a540f89f4e2
  • MD5 30f515392358142b507a486d7ab379d2
  • SHA1 d1b8436f0d752e965dae8cc2459cedd5647d00ea
  • SHA512 208773ac0578e1099a3e4f47c50d6dcb938748182922fc73105179e66f9386225b6f3c65689fa6d23a620303e9ee8f1e7f8e16251f7aa2f3f47a4b4ee52d1c48
  • SSDEEP 1536:oT+dIkJg6exZOWCYsPlFAFbDNkgRO5JylSp4mlG6hK4UZygM:oBkMxsYylFAFDWgIyIGIK4UZygM
  • TLSH
    T1616312A4FBBE1DEFD4FF0533022E90121166E431109185979EF4BC9C7C24BB9D88867A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  blackwoodaptbackdoordiscoveryprojectwoodupx

  • Detects ProjectWood Payload

    backdooraptblackwood

  • Family: ProjectWood

    ProjectWood is a backdoor attributed to BlackWood APT group.

    backdoorprojectwood

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5behavioral6
• • Target
    Red-Flaged/JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe
  • Size 625KB
  • SHA256 293d7e82688a0af531aca5d3197c2671d4c7be759463d71d1415438d91333aae
  • MD5 337dd03f1d287dcdb6471704d14aa3b6
  • SHA1 a13f40e7fadd226795a6a57bd5e5bd8b8fce568d
  • SHA512 7224d57da3b108ae2b28f380c50045cf7307a805c8a7c1ab5f9933074596172e2c52f5c74af8e219aee0f0ea95a2552dd6a6048acf5742171d6d0c63d54b4bea
  • SSDEEP 12288:96Hz52J2DT1mWK5u0MH/reKpvN7fxBLaAsNWGqgmeBWDroj43V:QHl2J21mWK5ufHiKpvNzPLaAsNWGqijQ
  • TLSH
    T164D44B76E60389F5DE7705F1054BFBBBA620DA0984328C5FD788CE90AFF6C22145D626
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerepoch2discoveryemotettrojan

  • Family: Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Drops file in System32 directory

  behavioral7behavioral8
• • Target
    Red-Flaged/Jigsaw.exe
  • Size 283KB
  • SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
  • MD5 2773e3dc59472296cb0024ba7715a64e
  • SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
  • SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
  • SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
  • TLSH
    T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jigsawpersistenceransomwarespywarestealer

  • Family: Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Renames multiple (3624) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral10behavioral9
• • Target
    Red-Flaged/Locky.exe
  • Size 180KB
  • SHA256 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
  • MD5 b06d9dd17c69ed2ae75d9e40b2631b42
  • SHA1 b606aaa402bfe4a15ef80165e964d384f25564e4
  • SHA512 8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
  • SSDEEP 3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
  • TLSH
    T19404D0BB715D8806FF75947640CC2A23DDE3E8B091ADDE23A68346E78C852DC58C9727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylockyransomware

  • Family: Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky

  • Checks for any installed AV software in registry

  behavioral11behavioral12
• • Target
    Red-Flaged/MuckModLoaderSetup2.1.1.exe
  • Size 84.7MB
  • SHA256 ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317
  • MD5 8f43e321dec9dd12d638776a36ee194e
  • SHA1 9a36263e9e95812c8d756f6ac16c00e229483927
  • SHA512 35d3e59c1326d76623981dcfadf670de64bd978f8720285b3818de50732d7cd89bcf6f5d46422739fdcd5e151d17f9ec65c508e6d18d029c5fd18b2455c273cb
  • SSDEEP 1572864:jA+BWMFDe45kntGZ6hDRVOy1menoUu9Ma7vWZsYez153UubP7/5:jRBFle45yxhDRV7nohfvgo53UkPN
  • TLSH
    T11E18331C38E0CB5AC86EF97BE0731F1216A4704A2FC5775BB937AD8A64A8F51D730252
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiongenesis_stealerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: GenesisStealer

    GenesisStealer is an infostealer based on Electron.

    stealergenesis_stealer

  • Windows security bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral13behavioral14
• • Target
    Red-Flaged/MyDoom.A.exe
  • Size 22KB
  • SHA256 fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
  • MD5 53df39092394741514bc050f3d6a06a9
  • SHA1 f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
  • SHA512 9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0
  • SSDEEP 384:96ZQHXcE7hUHwT56cC9Kg65JdwGADkHw/Rjxtuu7VIGGwQWEqpD6:CavuHAUcW/ojwG6kHw/lxqbW
  • TLSH
    T134A2E14996B41DFBC08707728AB3761197551538E0F99387E73C4F9FA0762A8F74E902
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymydoomupxworm

  • Detects MyDoom family

  • Family: MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral15behavioral16
• • Target
    Red-Flaged/N-W0rm.exe
  • Size 16KB
  • SHA256 fffe3c68f5caeea568830803b982c3e58ad3e101e0241614bf5e87d2c07e7ab4
  • MD5 9301efdf355b6379aef4ba98dab78718
  • SHA1 308ac5df7bf6fe34115522d685814a49778c5539
  • SHA512 6cb47cb290330ad694cd8224c518ad063db61ed530a41b3eca1f3bf5b425e7a03141e8a55f1568884fc1c7e4a2df63f82d16587ad81928bbd17081bfdba6e8f1
  • SSDEEP 384:c71T+Rh/1xo+/6KPN/FYdQ8bDKgJRaqcJl74CoBU:c7sxroXKxFgXbmVL4CoW
  • TLSH
    T1F672FA0067F98625E2FE0BB85CB3431052F5E6535A32D7DBACC850EE6863FD48602BE5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadernwormworm

  • Family: NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  behavioral17behavioral18
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasionpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral19behavioral20
• • Target
    Red-Flaged/Product Sample pdf.exe
  • Size 612KB
  • SHA256 7765f79c31ac9fb10bc37a24b769738c61d2f562b0758c3a0a4ebe176ae0d7de
  • MD5 22e87999f93e9368b2272cdd49cf49d7
  • SHA1 68addbfad46359c58eb68dad524db6294838e02a
  • SHA512 4fff863181463b78b11523eda50ef67b80ae0964996fe4660db31fafa22f5a203551dbd15836534c3c426d2351ca6038a0d1eaeb1833b03c2ca9eefaff00e3e6
  • SSDEEP 12288:TMF/qkQz5Vj+OMR8HnTgLJuAliyJ5/wd8ln4R0tW1cPOVk:IFvS68HnTgL4yD/wzR0uc
  • TLSH
    T165D423636330C524D6FC48749CDBCB921661BAE38863634BABB4ED442DFA1D0F1A1F95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionhawkeyekeyloggerpersistencespywarestealertrojan

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral21behavioral22
• • Target
    Red-Flaged/Remcos.exe
  • Size 92KB
  • SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
  • MD5 fb598b93c04baafe98683dc210e779c9
  • SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
  • SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f
  • SSDEEP 1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6brM:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+7
  • TLSH
    T12F93C713FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA419D79892D416EBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hostdefense_evasiondiscoveryexecutionremcospersistencerattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral23behavioral24
• • Target
    Red-Flaged/Rensenware.exe
  • Size 96KB
  • SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
  • MD5 60335edf459643a87168da8ed74c2b60
  • SHA1 61f3e01174a6557f9c0bfc89ae682d37a7e91e2e
  • SHA512 b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb
  • SSDEEP 3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx
  • TLSH
    T118A3E0417AE1AE3BC67A6EBA197546410BB677386030E7DD0C8250CE29E3F044A91FDB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral25behavioral26
• • Target
    Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe
  • Size 1.2MB
  • SHA256 b6968bc63433009553101e5303b880d403e2a2a0c6521694ddb122e25336ad82
  • MD5 342fe7a48d34f0eb772e4cc606fb71b0
  • SHA1 4579992d607dda5ab61c9b5ff92e10499826c40f
  • SHA512 b1d4a6afb0c51de519227a25ee7fe5f34bf02790d61c9d70a9edb42f6003e091c49a1148bed100bb2ba2d75d1e48edc26b1de61ccf2430069cfe65ba8a7538c3
  • SSDEEP 24576:tVxWxeVzdyMxGn3etxHGWIxMN7BOPlQbX8mS8jmEXp7RMuiMGZ1OkV95jbbeQEUz:PxWxSdyMxGn3dM9BOIFrLpvfK1B7Eeg
  • TLSH
    T1FF451254B2A0C827C9B946F20E31FA7107F91EDE6411D3C88DD4ADEF79EAF045A41A63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral27behavioral28
• • Target
    Red-Flaged/Synaptics.exe
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • TLSH
    T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorr909collectioncosturadefense_evasiondiscoveryexecutionbridgeagentexelastealerlummametasploitphorphiexsharphoundstealcxredxwormhacktoolinstallerloaderpackerpersistencepyinstallerratrevoked_codesignstealertrojanupxwormcredential_access

  • Detect Xworm Payload

  • Detects BridgeAgent aka ShadowHVNC loader

  • Detects SharpHound hacktool

  • Detects Stealc stealer Version 2

  • Detects Stealc stealer Version 3

  • Family: BridgeAgent,ShadowHVNC

    BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.

    backdoorloaderbridgeagent

  • Family: Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: SharpHound

    SharpHound is an open-source tool that collects Active Directory data for BloodHound analysis.

    hacktoolsharphound

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Uses WMI to collect hardware manufacturer information

    Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

    defense_evasion

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral29behavioral30
• • Target
    Red-Flaged/Uniformitarian.exe
  • Size 357KB
  • SHA256 b0e8491d0558fe31d0e2f591e7c09beb20321b5551b008dec47da8c1b14c28ca
  • MD5 c01c24af72defeeed00f9dd92f17d088
  • SHA1 4b62292bee5e31480ff76ef731252a2ac4a2507a
  • SHA512 ce7ebba8b1c34db6da527ea83781002eaf12a8a48b3886df2227c80d3dc57c7885f66765bfdfffb7f8d79d54271866808d6354d1c4fa7ef9375e6f67d8cee96e
  • SSDEEP 6144:dMm4CCsD9RbmZGgnCroDxzSc+WIG01nv50tf45xAyI/bDli5uTwFOCxlteEq3D1y:dMwpD9tQ3DIc+WI7Fqtf45zI/vliIpCz
  • TLSH
    T1027401407264D40AECA047710DBAE9F21761BEA2BEB2C20F3314BB6E7F727C5551A761
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderguloaderprivilege_escalation

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral31behavioral32