Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    261001-nx26ga1bra_pw_infected.zip
  • Size 328.5MB
  • SHA256 8871f6420737d19b9b042084523549bbe0325921da3ea70df175c298612c26f2
  • MD5 57256617a00fa25e88b32379df613e58
  • SHA1 a5448784b4c5850d90c01516e2706581f043b733
  • SHA512 35481044b40deeb72546cc1fc93b60891b649af9323ded38b0f0f97eedf303565d29bdf9cfab412d5e5c909fdfe303d6b25c7b9645645f10504e85281915608c
  • SSDEEP 6291456:Ju+Dy2UfcCa1QOC+2J10LGUb/Nws8moULkCv4yAIrJfC+DjMAb/NOudAh:THbCC/C+2J10LGIywoaXdDQOzI
  • TLSH
    T17EF8332A905DEFA2256239DE1809CAEE8FCCD45B9069162DD268D3611B5CFDD0BF4CC3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Red-Flaged.7z
  • Size 328.4MB
  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 0c22c97e5f0c0cd86a1daeff10d51581
  • SHA1 9f760e31fc9f4763cc04716e669d6ddd547f9fd3
  • SHA512 e31ee3466d4be1b660c73917fbc3ad288974316f4d8e92f8d2e8520c4c805ceb3b545bc1fda47a67563301aa4f2d12c8685818653e95d28fd5a8387154d9c833
  • SSDEEP 6291456:m3tJGUA4R5hz4EQLvSkRNLF9lD7C2GabF9sV0c3V+5ZcqAgZDFvVCG9KrGpUQXKz:cIqmSkRL7D7CBabqhGsuF9C3rGUQXKz
  • TLSH
    T1FCF833E898E71050F222D1A80DEAEA021F4D98D4B66DC4D32E652FFB5CEC2FF85B5055
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral2
• • Target
    Red-Flaged/028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe
  • Size 4.1MB
  • SHA256 028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe
  • MD5 21fbab5b43b6c04ffa18b769a7ae708a
  • SHA1 00c39020a913f7c0abe9e66f5432fd9ea01ce88e
  • SHA512 71aa99e81a00c1bff79e47e0b379f2ee154119135439eecd00a6f7d2dff1e075c264dfb80f446510fc38b2a4ddf22de4b27894d5f44864f4dde22132b90dc9e8
  • SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4C:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vc
  • TLSH
    T104169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverygofingpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing

  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops Chrome extension

  • Drops desktop.ini file(s)

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral3
• • Target
    Red-Flaged/02WLPQTDGE.msi
  • Size 9.5MB
  • SHA256 356c86d7bd72fa4fcb23d2276e07a854d1b92a49b3b7752adb915720a1e2668f
  • MD5 21272a4eab18b4ce018d66e846a594b3
  • SHA1 fd501ee783c5ed0c0631df7cc48a81288b688261
  • SHA512 3bdd23919afa5b09e4a08bfd21b131b1c95979fdcf8807c6d1291e6d08f47fcba06ca85574246290d8af72812e83f47624a077f8731dc702a13ab1215bc95fb3
  • SSDEEP 196608:C1M+xD2nDDlujAodvecq0rJvmI6UemBlLyamWRORy:6PIPlujAImcqWtB19mE
  • TLSH
    T171A6330FCCA213E7C0550174D615D36B4AAA9C233AD19A4E34CC73D5AEF43E9B725EA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryacreedhijackloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Detects Acreed Stealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: Acreed

    Acreed is an information stealer.

    stealeracreed

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral4
• • Target
    Red-Flaged/03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe
  • Size 733KB
  • SHA256 03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a
  • MD5 6596f49e2765b575debca8f790096b3e
  • SHA1 c166c1f59d9398fd2d2262523a892a6e032ad960
  • SHA512 2bc00deb060f032042ba01a1397367e1addc193cb5738e472ebd0b49977f032670fa271fb19a8779b8e6c13cae9d578435f64b33b31580503ddd4aa93be76bad
  • SSDEEP 12288:8qzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0wZxxXMcEe/3paPcgnX:8qzcpKIL0TvZzNlNky0wVW0wZxxVgnX
  • TLSH
    T19BF4AE2375D2C036D4B301B25679AB625EBFFE310A319997A7C8198D1E384C0EF2A757
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5
• • Target
    Red-Flaged/04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595.exe
  • Size 95KB
  • SHA256 04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595
  • MD5 e14d7baf640bfb479e186d0281a27179
  • SHA1 ef06cdc7c81c4a31bbc8a28fb20f0943e2599273
  • SHA512 445446597177fdfc34e3c5240edbb90dd0e9665c4c28cec0b227d47bbb9994af9091bcc7c93bc0aa4b85e6a1be0f3e64d347c2d463e838ad6352d5c9a4048ec1
  • SSDEEP 1536:9wBf5gYPKfZ9KD/46gQ3S2LgEgH3OxJks45IOYpOe5AQAUYro:MbPCE4M3S2LgRXMt45IPpOMX/
  • TLSH
    T176A34B0762E3B4FCE21AD4B4D5F69A32AB31FC310434AB2E6365DE310D22F519E35A95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionnitrogenimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Nitrogen

    Nitrogen is a ransomware that resembles LukaLocke ransomware.

    ransomwarenitrogen

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (7984) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral6
• • Target
    Red-Flaged/0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe
  • Size 1.0MB
  • SHA256 0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78
  • MD5 f2338d4020b2472340c72e91ffd8df7b
  • SHA1 36f6d0a15fae89c08d8459328d2f5b94e14229a5
  • SHA512 06a6fd9b4eed1e9d870c20cd55877495bb828737c926fc4f90321b39a958e9d96feae3f939b6deac174daef8642185e5e9dd86159566dad12944ea3b370fc259
  • SSDEEP 24576:1mEp+bl2LZ894kTja81N5Fjk4LfmVr2b2DamK0lFn:1jMbIZ894kBk0eG2+mKG
  • TLSH
    T1AF35232692E6C9F7C2EC0271484667C07A10C63984AAE53FB57480BED1D358DE376F7A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverycyborgransomware

  • Family: Cyborg

    Cyborg is a ransomware that has been active since 2022.

    ransomwarecyborg

  • Renames multiple (62) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7
• • Target
    Red-Flaged/0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe
  • Size 202KB
  • SHA256 0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff
  • MD5 50897414feedd08bb4bd1f3684447836
  • SHA1 fc208cfe4a87c316f0e256be41f91e69389ca160
  • SHA512 0f80830ce2c98403e7c48495eec857711247bd75b945c9cc51b2bca77b2f41e24118a56075efb3d043813bd58e5611ac802106fd5e413cd10b45a3fae958af31
  • SSDEEP 6144:gLV6Bta6dtJmakIM5a4Q4cpvMPFGDqMiQz5R7/34:gLV6BtpmkN4QRFBqMv9R7v4
  • TLSH
    T1A414CF1537A88A2FE2DE8679712212138379C2E3E8D3F3DE68D455B75B667E00A071D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverynanocorekeyloggerspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral8
• • Target
    Red-Flaged/12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434.exe
  • Size 942KB
  • SHA256 12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434
  • MD5 ac4a42009495e1d427447e353d83200e
  • SHA1 cf44a60c893d0252870d8a8d7f8853f1b6074cbc
  • SHA512 83342dea8268e1f53e4a8f8164ee841a356e6a333d8eaaf9a3081adb51fa9fbadca392165c8aa52a27c5843d53bf024f437f13a456ec1046c81bc8d24e0a588c
  • SSDEEP 12288:n/PF6rC1XrB2B9dBgIs7pVYoBf3MybQtcrU:16UrB2B9dSpVZB/9qcrU
  • TLSH
    T136252825AE9FD5CAC0EBA13F9485094291EEEB040B1762C347508974BB339E75E3B793
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral9
• • Target
    Red-Flaged/1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe
  • Size 7.1MB
  • SHA256 1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3
  • MD5 82456d523f39ecb87324542c918e7dd6
  • SHA1 0b4e4bece54b2f1c5fe48d88e44310ffdf9a4185
  • SHA512 628b7648365332628faebc72b167708f41ab42c802900e41fe9ba9910d386bb1f77fd2d1fe27500b079e943bc232055d677d4e6093ca08fed8d79b758eaf59cc
  • SSDEEP 98304:6RoW3kST9lgfU9PfCvRfj3Ml27OuKr+gvhf2:6Rouk49ifgCpfDvOuK6m
  • TLSH
    T185767D107BE8CA27E2AF53B185F116625BF4F805F352E7DB158C25A91C12380DE267AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxclientpersistencespywarestealertrojan

  • Detect XClient Payload

  • Family: XClient

    XClient is a trojan written in C#.

    trojanxclient

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral10
• • Target
    Red-Flaged/1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe
  • Size 2.7MB
  • SHA256 1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e
  • MD5 32d489eef7cbbdf51dc41d07648d7d8f
  • SHA1 570a0e5e82568202d25c951596db8e3f563d8446
  • SHA512 6aeeefb61d5535d24de263f0b8550b826afe76fedfec85d1fdf66514e73bbfec38ea9a08b376379d258138d93c0db1aef39208b0503bc51a82d7af86c1b35e67
  • SSDEEP 49152:Ql6KLJE4voB7YTJQR9RaZD1ssII1KxK9KmGP5Ei:U+m19XGBEi
  • TLSH
    T1D3D54B17FC9268B7C0AAA23589669152BAA17C493F3123D33B50F73C2F727D099B9714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionyureiimpactpersistenceransomware

  • Detects Yurei ransomware

  • Family: Yurei

    Yurei is a Golang based ransomware family derived from PrincessLocker.

    ransomwareyurei

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (192) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral11
• • Target
    Red-Flaged/2025-07-15_9fdd329535a395b3287bf94308c76785_elex_stealc_stop_tofsee_upatre.exe
  • Size 600KB
  • SHA256 3e2e65eb3e4dab82011c484af468c3dfa5e45958d8794f5b1d97d03c5eda919d
  • MD5 9fdd329535a395b3287bf94308c76785
  • SHA1 5a9e6925d7f4583833ef407004f7af9420d2e721
  • SHA512 f70d522a504b1cda703b2ba5cda9b8ca1fe40674300e2bc79a852deeae52d365334d3ebaeaea953fa6209edbfaa919f9c73a83603b60ccc0db877410e6c0f01d
  • SSDEEP 12288:GAfE+BTw4yzTaS/sgeaHd6MY4f6U8BqW+v/vhP3DJ:pynTTBd6OC6v/vhPTJ
  • TLSH
    T1E7D4AF3133E18532E1A72FB119F5833A9939BD222B32C5CF63A4B91D5E702D2D972356
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderstealcupatrestealer

  • Detects Stealc stealer Version 3

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: Upatre

    Upatre is a generic malware downloader.

    downloaderupatre

  • Executes dropped EXE

  behavioral12
• • Target
    Red-Flaged/2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe
  • Size 8.7MB
  • SHA256 5a840f691959a8a38c86f13c2cff7374ca2d9bbdc137a44b3d29c6112948a028
  • MD5 d1c0f450fd12161c126de8f17a8c1810
  • SHA1 c3fb797ecd24c284b38b68c66068bd65c3bab3ee
  • SHA512 f416272c70d8a80d68a21d63df8336f733cedc0d76e800b26baf76a83a8de0cd149caeae807d04fcae4a203ffe0675d4bc3fad821675eef1d763ea3ee60e28ea
  • SSDEEP 49152:y+9ARyfrb/T+vO90d7HjmAFd4A64nsfJiugg76XcQ75GVvUAa2BTNw1d7ONxDBYf:h6RwD8ybEiZGZBRA5RAu/Wty
  • TLSH
    T1D4964B47B95091A9C1BED234CA668292BB717C450B3063D72B50FBB92F37BD46E7A310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorsupershellupx

  • Family: Supershell

    Supershell is a cross-platfrom reverse shell written in Golang.

    backdoorsupershell

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral13
• • Target
    Red-Flaged/2025-11-10_423504692acf78cecd61922d89b87a1d_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
  • Size 208KB
  • SHA256 9577102c6118a316c632e2762f7a49f04c74d4b6c58e3edba3da47dc31866702
  • MD5 423504692acf78cecd61922d89b87a1d
  • SHA1 355ea33d721bdf0b27be184d2c2f44d273328a86
  • SHA512 2b17694addf5d605dc068e67dc353db60b01b3e200fe5d8fd5f14524ab69fc03b7d89fa711e26e1eff7938696ec4cfad838255519d184ec16a1f431300b4f47b
  • SSDEEP 6144:hLHDCuSk/dhWZESfzXKzUfzPzgfzkHMh8KtkJrsZel3olG7r/uexqAOeTimAO39I:8Cdh8KtkJr9OlG7r/uexqo3giE
  • TLSH
    T124246B08B1B2C072DCF605300520E7B65ABC75743B959AFFB7B46A6A7D303D1493A63A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverybazarbackdoor

  • Family: BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor

  • Tries to connect to .bazar domain

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral14
• • Target
    Red-Flaged/2025-11-11_895016d46d81fa30da9122e4abab6660_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  • Size 365KB
  • SHA256 7bd7ab6a8ccb9819c7fdff29853b4b845e0017d7f9cb6ca40557242a50f9b5df
  • MD5 895016d46d81fa30da9122e4abab6660
  • SHA1 c7ae3041edf00963eacb171703597c57f50d37d1
  • SHA512 7fbeab7617bd797b8b895db8f9632cbeea4d75ea2c8062ab7624f0425d36524c333b0675125b737abdf8247181c52957e9ac2eab0186679d61adb76619e9372d
  • SSDEEP 6144:nI0XV7fKxU35tRZq6eSocUkekHNTfz762uf8v+nVV:nHyxU35tRZq6eAaAW2uf8mnVV
  • TLSH
    T129848E01B5D08032DA3334320674E3B68EBDB47469556A8F17ED0DBFAF34681E62966F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral15
• • Target
    Red-Flaged/2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
  • Size 661KB
  • SHA256 d8124a523f64d1662304c5f2bda383e547d488e277b02e414c82ea7f85dd29c4
  • MD5 66b597d27d0554b1504430138369859b
  • SHA1 817b1b477a37fb228bd38720ea6018ee98baa187
  • SHA512 9bcf24ef43ad9f624ae0e80eca21c04b67b1ccb808c1149d7776ab12874199625181eda9f6c3da040af395ea160f607f0265ef4a7a7fab84bd5a60720bd6c87c
  • SSDEEP 12288:tmWdte04G4ajph8LkrISMvbLQPEXe1tA93KxHcMlSk:tmYP8kcLaEXeowh4
  • TLSH
    T118E49E21F59260FDE0F311B185ADB336DB3A3909DF109BCBEBD09B25E971250A91760B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral16
• • Target
    Red-Flaged/2025-11-12_6ab017c1b7d68321880fed7736122a20_cobalt-strike_conti.exe
  • Size 585KB
  • SHA256 efb85476b7bdaf5e78aa90a846ba3f09f887a3a5803704aa8ebabdd0e417d07a
  • MD5 6ab017c1b7d68321880fed7736122a20
  • SHA1 a330f88bc4e2c2ce4f17f17858df7d3dc97c1b09
  • SHA512 12dfd0bd029ebc5c16394f8043646fa04af646704be17a6745dd3dae4fcfa18e062758f7693a776cf152c87a6aa51d65ce84e7c8e5ad6284c01fb61587a3a0cf
  • SSDEEP 12288:BQrTeT1itUCZHV3wk3Ta77Hp0fWAUmBomJdqXOvYFV+qopd:Bae1itbnEOvYFV+qopd
  • TLSH
    T16AD43986E7D0ACEBC21503354DAB0355373AF6E46757DB672A28B2301E57BD0FE86209
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryslivertrojan

  • Family: SliverRAT

    SliverRAT is an open source Adversary Emulation Framework.

    trojanbackdoorsliver

  • Sliver RAT v2

  behavioral17
• • Target
    Red-Flaged/2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
  • Size 14.2MB
  • SHA256 7b119d035e2f77d9334032a120d6f7d8e838f216358a484c692aa6eb431557e3
  • MD5 9e11b0e463c9998ddbf018922648ef7e
  • SHA1 22255b9edc86afabe6ca6dc01be85352e782c1c7
  • SHA512 c8aa8738f3db768c78555d3e42d0e2557e109cfc95de06188815cf78cb9273b41c1a23b778c35c9687fee407cc37a115cf380e07e008ead3fdfb2c8204f57350
  • SSDEEP 98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
  • TLSH
    T1A6E60222B650C4F1D1D5107056BA4B37A9B976590B20FACFBBDCCD6A1F32390EA76309
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionmimikatzxmriginstallerminerpersistenceprivilege_escalationupx

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • mimikatz is an open source tool to dump credentials on Windows

  • Contacts a large (131693) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • OS Credential Dumping: LSASS Memory

    Malicious access to Credentials History.

    credential_access

  • XMRig Miner payload

    miner

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral18
• • Target
    Red-Flaged/2025-11-12_a787c0932def56cc7b85e6888e67bb87_amadey_elex_smoke-loader_stealc_stop_vidar.exe
  • Size 583KB
  • SHA256 dfdda04c16fa217f5beb2cef342e629ab6086cebba6a2946b6573e317867edf2
  • MD5 a787c0932def56cc7b85e6888e67bb87
  • SHA1 b26ec3edcba3b7ea8b7c49e3e17f2f3ec8db9592
  • SHA512 90e0825edb26597e9e9345199798d8f6c226f285c7871694b53a5bce502ce5d4c68bee4f9c7e36a6c107caa7b9e7a9cfe6cda7516c081132fb536dd19322c6a2
  • SSDEEP 12288:bXxo5rWbbRpfEpUysVnoWM84XW2W3/MErde0:orWBMs9oWx4XTmr/
  • TLSH
    T122D4AE52F1E2C032C06215B94ED5AA999BB9ED100539ACC73BDC1EADCF716C0E73A356
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysmokeloaderprivilege_escalationtrojan

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral19
• • Target
    Red-Flaged/2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe
  • Size 23.4MB
  • SHA256 0efdd1559b337face515a7a0d1212ac859518a8efbac34ef78b9c5983c8ef15b
  • MD5 5dce91e6d4ecc2af605e2eaf5537cb90
  • SHA1 90ff06c0fe3b3e5c60b310f0294b59ad0b23614f
  • SHA512 470c0519a4fe528dce47eeeb746518ecba768ebe061805426e8c6a875a357e34791952c56b4f97d0a365a7da76e765db4b550960ea683db12d8db82255e2fb1a
  • SSDEEP 393216:KnEwl1CPwDv3uFY43v13uFnCPwa/VW08Sr8lQeY3VjzJjYO7jVcB2nEwl1CPwDvV:KnEwOzBz+0j+B2nEwOzBz+0j+B
  • TLSH
    T1C037E06025425C56D88102B8C6B3CFBB367E3AA143E6BB4F7B55B9710E356C03DE931A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionmimikatzinstallerpersistenceprivilege_escalationupx

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral20
• • Target
    Red-Flaged/2025_Cotizacion Noviembre.exe
  • Size 1.3MB
  • SHA256 17e58d32c3edba5a27fc78a38c63206d312811794e694c108fe77e1f74ecfc57
  • MD5 7de170ce970af68f014113495aa4bfc7
  • SHA1 0be655451b8176781e9ef2113ba363364007d19d
  • SHA512 5b26bc6c7afd2519bddfd27979ba86f55b3a3ce92af68f40f0aade72a8c245eb55cd87906262652bdb78266efde08eaa74943e69b36e3347c92829ae4cff6acc
  • SSDEEP 24576:0cnTF/fb39Z1JXJ0mO0e0v3IVSy95YYwkLjgZQzyQI1Tn:0aTBfb9ZnXa0LwXnRLEK2t1j
  • TLSH
    T14655F10617D456A8F0FE8B74A6B4006443F0F917E32AEBAF7A4841ED8E21BC5D952773
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discovery

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  behavioral21
• • Target
    Red-Flaged/2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188.exe
  • Size 1.0MB
  • SHA256 2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188
  • MD5 4eca4baaedc5d505cb65b37fbc38a3bf
  • SHA1 a5acff471d564b6cb4f532b71fd30f520500fe80
  • SHA512 a85ac18739ff798cfa89c01f29bf5a15e54c4027d43271ceefde28c4c5f6ec740e43455b6dc2aea3a92afcdbaad125777ebe52d790806bf3c56d7b7947dd019e
  • SSDEEP 24576:2pHxFRXDoK4aVRkNRjd2PyOPED2V/WAi:MXRXDUUkNRjd26OPN/zi
  • TLSH
    T186352941A4164AF6FA52CABD4936C02FEEF736050B10DAE75681B63A2F030E92F7C755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionakirapersistenceprivilege_escalationransomwareransowmwarespywarestealer

  • Family: Akira

    Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.

    ransomwareakira

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Renames multiple (10318) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell command to delete shadowcopy.

    executionransowmware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral22
• • Target
    Red-Flaged/374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
  • Size 456KB
  • SHA256 374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05
  • MD5 b855b1b7b59668ad991cf0501e4ff4cb
  • SHA1 581283899259e80b7da5d8be25f6ed1de58fdfac
  • SHA512 71e59b09678df1dca36caca3280687723406c2ccf638e2d7e57a34ea099fb269646730966c96d89dcaab23914f1915664fac4491f09bb17216ed3f3c6acb64c6
  • SSDEEP 6144:zJB0PLonpe1h5fqpErm9cRLBOtFWaCfmAU+wDhuN:zJB0lh5aILwtFPCfmAUtG
  • TLSH
    T199A45D29EB557976F2530976B600699F2C818C391293DF4AAF4289CDB801DE3F2F5327
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdiscoverytrickbotpersistencetrojan

  • Family: Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE

  behavioral23
• • Target
    Red-Flaged/3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5.exe
  • Size 418KB
  • SHA256 3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5
  • MD5 b8ea5cdd085bea860fb94bef2fecb6d9
  • SHA1 3788cec204c0f2f6fe674fba85895f99f48a1f23
  • SHA512 45dabd78a10f66209abef6446b96f4782ff7b6a20380282a5be6380f3d7e50020d171478226752659f0808f5d1ce870f617add30d132f981bbcb26347ff6a632
  • SSDEEP 12288:4r7ox3gdRAAzI+L7sCcDIg54qlcepleY:43ox3ghzHsIg2yvU
  • TLSH
    T18F94E121BA81FC71D467F07445329EF5C1AC9832E91A85BBF76DC6FB8E31260361624B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker1100defense_evasiondiscoveryexecutiongoziisfbpersistenceprivilege_escalationtrojan

  • Family: Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral24
• • Target
    Red-Flaged/3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe
  • Size 728KB
  • SHA256 3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9
  • MD5 510bb4c1b8a0faa9488ecec93909e788
  • SHA1 28a41b6374215d6eb45f19f54eff91853f62b436
  • SHA512 2ca3b551ea29b5acb939c5c96597505a7944787872fab8a9ac08e27913c8a573fa12dfe86ebb13d9ac07c8d60575d71e3a47ed030ebe77d3c95238369e97015d
  • SSDEEP 12288:MoFuMrbaBx9jqVLWsmfCrVR7PG6JZxV/LkTuuQuI5DflRWS5/1OTT7jlNlDh9FiF:nFuLx9jqc4VTJ/tkq
  • TLSH
    T1F0F4AE9C37E8BFC1D592A3B4508200D85FB55127B68AD37624B278F82D7D38BB91E847
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypennywisespywarestealer

  • Detects PennyWise

    stealer

  • Family: PennyWise

    PennyWise is a stealer written in C#.

    stealerpennywise

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral25
• • Target
    Red-Flaged/439ff2060a600d666dafcf86f7ef8fea5ee0cca7e39521c986a3181d99ede61d.exe
  • Size 10.0MB
  • SHA256 439ff2060a600d666dafcf86f7ef8fea5ee0cca7e39521c986a3181d99ede61d
  • MD5 0739c5c628cd9827ad276fcdeab6866d
  • SHA1 d35da3f4e36eebf36a130bc7e0182fc4c35cf551
  • SHA512 cbcc268a6ffd1d7da8454d9d19e5dadff2f6b82f7a24c71c600af9a1df43cd94c01189d5e6536058238ee3941cc263ba36b91bebb7cd9a46d2bc7a8af8975a8e
  • SSDEEP 196608:E41NwEkT12Yfagn1Xii8ag+1LH7oChw7nyHcJQTUqFXPRmehiK1oCu4Wm1sSS:EaNwz26JRxn1oChw7ny8JnIpmecKuchU
  • TLSH
    T104B633C873072049CC295F77E221AACAD17E7946E424E6E78020A70317FF9F9BB57652
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral26
• • Target
    Red-Flaged/MyDoom.A.exe
  • Size 22KB
  • SHA256 fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
  • MD5 53df39092394741514bc050f3d6a06a9
  • SHA1 f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
  • SHA512 9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0
  • SSDEEP 384:96ZQHXcE7hUHwT56cC9Kg65JdwGADkHw/Rjxtuu7VIGGwQWEqpD6:CavuHAUcW/ojwG6kHw/lxqbW
  • TLSH
    T134A2E14996B41DFBC08707728AB3761197551538E0F99387E73C4F9FA0762A8F74E902
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymydoomupxworm

  • Detects MyDoom family

  • Family: MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral27
• • Target
    Red-Flaged/N-W0rm.exe
  • Size 16KB
  • SHA256 fffe3c68f5caeea568830803b982c3e58ad3e101e0241614bf5e87d2c07e7ab4
  • MD5 9301efdf355b6379aef4ba98dab78718
  • SHA1 308ac5df7bf6fe34115522d685814a49778c5539
  • SHA512 6cb47cb290330ad694cd8224c518ad063db61ed530a41b3eca1f3bf5b425e7a03141e8a55f1568884fc1c7e4a2df63f82d16587ad81928bbd17081bfdba6e8f1
  • SSDEEP 384:c71T+Rh/1xo+/6KPN/FYdQ8bDKgJRaqcJl74CoBU:c7sxroXKxFgXbmVL4CoW
  • TLSH
    T1F672FA0067F98625E2FE0BB85CB3431052F5E6535A32D7DBACC850EE6863FD48602BE5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadernwormworm

  • Family: NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  behavioral28
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral29
• • Target
    Red-Flaged/Product Sample pdf.exe
  • Size 612KB
  • SHA256 7765f79c31ac9fb10bc37a24b769738c61d2f562b0758c3a0a4ebe176ae0d7de
  • MD5 22e87999f93e9368b2272cdd49cf49d7
  • SHA1 68addbfad46359c58eb68dad524db6294838e02a
  • SHA512 4fff863181463b78b11523eda50ef67b80ae0964996fe4660db31fafa22f5a203551dbd15836534c3c426d2351ca6038a0d1eaeb1833b03c2ca9eefaff00e3e6
  • SSDEEP 12288:TMF/qkQz5Vj+OMR8HnTgLJuAliyJ5/wd8ln4R0tW1cPOVk:IFvS68HnTgL4yD/wzR0uc
  • TLSH
    T165D423636330C524D6FC48749CDBCB921661BAE38863634BABB4ED442DFA1D0F1A1F95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionhawkeyekeyloggerpersistencespywarestealertrojan

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral30
• • Target
    Red-Flaged/Remcos.exe
  • Size 92KB
  • SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
  • MD5 fb598b93c04baafe98683dc210e779c9
  • SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
  • SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f
  • SSDEEP 1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6brM:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+7
  • TLSH
    T12F93C713FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA419D79892D416EBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hostdefense_evasiondiscoveryexecutionremcospersistencerattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral31
• • Target
    Red-Flaged/Rensenware.exe
  • Size 96KB
  • SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
  • MD5 60335edf459643a87168da8ed74c2b60
  • SHA1 61f3e01174a6557f9c0bfc89ae682d37a7e91e2e
  • SHA512 b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb
  • SSDEEP 3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx
  • TLSH
    T118A3E0417AE1AE3BC67A6EBA197546410BB677386030E7DD0C8250CE29E3F044A91FDB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral32