Extracted

Extracted

Extracted

• • Target
    TziChecker v1.8 Cracked.zip
  • Size 42.7MB
  • SHA256 360f9c8242799f5c12b882baa0fee57ae508c017383d6fd519ad06dcc5e07066
  • MD5 6f627ff1e705473b8e2978f595145bd8
  • SHA1 b5d70a86d58105d8fe1b01ea612524834c571d44
  • SHA512 9df01c17c830f591a5a337b05a7cd5ed7248221a5c81c096f503f1258668cef586e1cc2c6e9e20ffb78e012c9fb748885c6a461dab9012f2c047e86fc4358bfe
  • SSDEEP 786432:ko0+gp/WZMJZ9n52jSCdRnrBVJMkggT7YI2R9is0KI0IqxYMHav:kqgpueJZK/dRnrTHYIm9N/36v
  • TLSH
    T10CA733CF94016728AF73AE1DCD17EE948DAEDA9352BD625C08603C248C419146B9E7FF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Tzi_Microsoft_Checker.exe
  • Size 42.8MB
  • SHA256 b7caf454b53aa9d4cb5be659f58ebac4a508eac71669fca4f9dc8f02a88a6a20
  • MD5 04812e5b5d5a00ced6b07d764b70265f
  • SHA1 30aac55bbbac8ca245476024117938f84cd8cdc9
  • SHA512 40ebf01ace15ef43f1016f392a62a90baeecd726793b361e28ff96f0171200084e086826f4b548d4843aceaad19b993abdcc3be66ed4cfe2821050d4eddba6ba
  • SSDEEP 786432:SogW6v/sRIjDNdVkD4YBJBDNdVwCuYDHQ4MVDcyOkGwo0n0cPa:Sc6vkijDoHBJBDPLQ4aD/LXi
  • TLSH
    T18EA733CE9401A268DF73AE39CD16DE448DAEED5392BC221D08603D244D719116BAF7FB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  droppeddefense_evasiondiscoverydownloaderexecutionamadeysolaris_loaderstealcsvcstealerinstallerloaderpersistenceprivilege_escalationspywarestealertrojan

  • Detects Amadey x86-bit Payload

  • Detects Stealc stealer Version 3

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    config/bip39_english.txt
  • Size 12KB
  • SHA256 2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda
  • MD5 f23506956964fa69c98fa3fb5c8823b5
  • SHA1 b2d5241ae027a0e40f06a33d909809a190f210fe
  • SHA512 416c71ba30018ea292bb36cdc23c9329673485a8d8933266a9d9a7cc72153b8baed3d430f52eab4f5d3addf6583611b3777a50454599f1e42716f5f879621123
  • SSDEEP 192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
  • TLSH
    T1E6421A78A360353BFACB5A8FDC983F51DA444E336E0264E4F66D5645184BC86CB28D2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10

  ransomware
  behavioral5behavioral6
• • Target
    config/config.ini
  • Size 1KB
  • SHA256 6ede5455b5b86966c1c48ae7f2ce874b966d225f02d3340e2ef394654ba7d7f5
  • MD5 36487bbda11f6bbf264785e0e8ad2efb
  • SHA1 82e7ede02e7bccb5e138833de3bc2591b957a5a0
  • SHA512 b530249730d6d44ed3007dbcdea63df88c9a36b494111939c0cf73f89166561752b773365f1be064371e1a3146eb46efaf9d45eff7b93c8ecc8a6b06a43efd66
  • TLSH
    T16531BB34DE96E46EE2763A54DC87FD1330AABB935A0FEA14F3945005F84FBC2816B018
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral7behavioral8
• • Target
    config/notification.ini
  • Size 969B
  • SHA256 d2ef02f22f0d071fdb571575879a820f4874e1886d75587658d98963e5e76568
  • MD5 f547c3dcaac290b463f596791d3ed119
  • SHA1 e66edc33ec5d88c2e6bbd9d611ec9581701759da
  • SHA512 b28ac403b5240e07994fd58e88b7efe12aa0704194e0404aac2b48ef6c472f61069b3b13240e55f35dc69748fda998b17805c990e6fb00def533274771cefebe
  • TLSH
    T11111A3221F187ABFA19E7E022D77F783115178A4422FA536F27014F97941740EF48A4D
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral10behavioral9
• • Target
    config/sukimc.ini
  • Size 77B
  • SHA256 647bc18bb6f4661ee98d0087531e7f7849efa0b2be118247f2e81c27bfead591
  • MD5 8f119fac55706e172a1206287b8665d7
  • SHA1 02db52b30fc866a532a00174377284b013db7ce3
  • SHA512 685b7883f75ae03fd6ce85b0703e9d48ef5a63bce5b06808dc0b830837f6bc06af7efa4f9ad63b486ab77cf786643255b4f66144e68f64ebfd0d1ab8536ecfbf
  • TLSH
    T1F2A0041D5D554C5C4C155055DCD7D45701117D15451F1547F751DCD4F041C75D715741
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral11behavioral12
• • Target
    proxy.txt
  • Size 14B
  • SHA256 dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
  • MD5 44fb3a27ed30ae5193ebd879ca2cf039
  • SHA1 70bacfa8e44a0929dddd31d0b9d78164e8cbfba5
  • SHA512 29ca1df582d8a73d5f9e0d91911093ad4932eb0a5c848c3168ebc34e6172f864979f5123d51256e425bafde34820ddd144ba94df8a5e0b6a70f0994baa454081
  • MD5 SHA1 SHA512

  Score

  1^/10

  ransomware
  behavioral13behavioral14