Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    BGy5kEd.exe

  • Size

    5.4MB

  • MD5

    19464838112cf29d5d08f7da300d8c7a

  • SHA1

    f596316d26caeebfce3fd6a80fa8a9a6312a6a34

  • SHA256

    d64f98a27f2e885a92186590670e50dca8b2015269c28990a78082b97e274cf8

  • SHA512

    f5249c7cea306bde2ec9b4789f908253b309a4352acf0a6f920cd6e3e2864ce70762af96a83d0e46a07fe5f025c780312890775d75855d31e44500ace990a5e5

  • SSDEEP

    98304:NzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl9:NhfefPtHxcp9ym3nltDUJV

  Score

  8^/10

  discoverypersistenceprivilege_escalation

  • Sets service image path in registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral1

• • Target

    PGmbcGM.exe

  • Size

    4.9MB

  • MD5

    c909efcf6df1f5cab49d335588709324

  • SHA1

    43ace2539e76dd0aebec2ce54d4b2caae6938cd9

  • SHA256

    d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

  • SHA512

    68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

  • SSDEEP

    98304:3HYkJ28MIFQVqrcyIJhoIZ9smz/3hcjK+I67Y:3HYkJ28MIFQlHsyfhcjK27Y

  Score

  3^/10

  discovery
  behavioral2

• • Target

    Y90c9Eb.exe

  • Size

    1.5MB

  • MD5

    899ccf2aa0f1e911c267ceb7154c1356

  • SHA1

    e75ce1549f3af407692e85f35975d7681fdef911

  • SHA256

    e50431d9d07bfbe1a57c75cc446b31c2bdbecd6e20f05281aab2031251290f06

  • SHA512

    3d02e189a615c8ad4645ccc08dc04744763b3427b9fbf94dd3c659944f66ed1c5fbf22a7c2d970c6e33e6a8de2419644f52b52fe379f3c0d4d4f0f2375e5654e

  • SSDEEP

    49152:7RC46UdKYZzpLiymGyRInc93BRCFvrAkCAFpmcexX2FXe11bnCzftoB:7RC46UdKYZzpLiy+93BUsJnw811bmtoB

  Score

  10^/10

  vidar5828200e1e0f595ba667ca6d813d02c7credential_accessdefense_evasiondiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral3

• • Target

    YW2aK5f.exe

  • Size

    738KB

  • MD5

    2fcb19a11bf4d4378266ee26fec1a27c

  • SHA1

    dde109326ef7a84a7c149047681274d93342b80d

  • SHA256

    6ecab3c4dcfb64bd56c519faa1a7d91e45c7d6e378423bb4a361ac7fe4089f74

  • SHA512

    5bca2a6c8ec7fb1eca0262441322f04bc265cd43ee64185eb37591c13a3eea74d82df33818f964803b8f6048c45391cc64057b305435edb8b49f032633931e34

  • SSDEEP

    12288:lFoAt/1FZ0TMLziKR6JUNl1r4CsKrXVyTwzwq7eNKUwSHzGpnXI/h0FIOSxyspE:YAlHZ6MqKR6Jm8pKrsywq0EEYXDiO0

  Score

  10^/10

  asyncratinj3ct0r 711discoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral4

• • Target

    addon.exe

  • Size

    8.0MB

  • MD5

    0be4deb2a92d1607397aa6d4800c8477

  • SHA1

    ada53a3269dbd24de88701f88e3f033334582d06

  • SHA256

    74ecf2069bde7eef8cc74645a9521df674c919835cbf7747f0d01244834cd32f

  • SHA512

    89d6b72d2909c8c763da9f3e34aaf76a248d0ee58e3a5fd77e18a196b55f85a1d83b8d0330ce05405ed350df3f7cd3b7420e5f012874d262ca35ff0f1455246a

  • SSDEEP

    196608:aBePATQMO+N6sl+Q0FyFi8NzKEfk7ZBHBsJmnOtHypMAbR/B55:YePSQbm6u+Bwi8xOSZlxyR35

  Score

  10^/10

  xmrigdefense_evasionexecutionimpactminerpersistenceransomwarethemidatrojan

  • Disables service(s)

    defense_evasionexecution

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Stops running service(s)

    defense_evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  behavioral5

• • Target

    addon2.exe

  • Size

    3.9MB

  • MD5

    a29a24906264d01a0f3be4844d1ba848

  • SHA1

    012e351b64d55a7ce797ec21b9956c82e76dbe4d

  • SHA256

    5d8d7525e999f0836350df2e075470329c90c6cdd7626750af395a220e8b7f13

  • SHA512

    8e5585323b4bb8024712af399e383644e420070e54b1b78d679bbfa03c5cdb364d6e7a9cf66fbe14f44c57e1c42a4e4913d877c3b1a0524f515324cba71a20ec

  • SSDEEP

    98304:dS1IDL50Zr8bJePyvNC0cmKK0/GZCuU1y8:AUL5Mr8bJelNT/0U1y8

  Score

  10^/10

  defense_evasiondiscoverypersistencethemidatrojan

  • Modifies WinLogon for persistence

    persistence

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral6

• • Target

    index.exe

  • Size

    4.7MB

  • MD5

    81ecd82f3dc0a7cc7f1cdb49312d11ba

  • SHA1

    e616e615eebd89bb0f5de53cbabe71e49bed0e7d

  • SHA256

    63b7587df9ef844f3b2c4b44e2785578be97b2d3fb4f72c06daf9faa47a72bad

  • SHA512

    1c1094b2d6fb01af4612a821a9b1da52b853a6efc98c27a46e113ba357eeb35f5927d0430b077233926b40c0fa409f6ae2096a647c7236467e8d54d88542100b

  • SSDEEP

    98304:FbsOT3RTlNVRtRSQ3WT/F6Dm2rMXYbX2BrkDuTIuM2/L2yWp3:thJHtRtWT/YA9BbTIr2/i

  Score

  10^/10

  amadey8d33ebdefense_evasiondiscoveryexecutionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral7

• • Target

    random.exe

  • Size

    2.9MB

  • MD5

    0c776f504b704164c006b4ca0c185cda

  • SHA1

    9889913b50ef905893942a25dfb98f991447a840

  • SHA256

    3c3e6677a23e07cea8b6c95ce66062a8c2b6534f43de24dccc7ed6f71e4c9749

  • SHA512

    aa289a84420716e2d927f67e9c064b7adb8f9f7d455135bcb8eccdd5fe7486e2eef6e9c441abf2533835561b9ab063b8e0ef63a0133924537b9812d1b1208ee0

  • SSDEEP

    49152:Y5PC5zzLU2qt83F8+4nlKAT1PQMXNbUN6H68jdAg2gI:75zzLVqt83F8+MlKuKMdbUYH68jRz

  Score

  10^/10

  amadeygcleanergurculumma8d33ebcollectiondefense_evasiondiscoveryexecutionloaderpersistencespywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral8

• • Target

    random.exe.1

  • Size

    415KB

  • MD5

    26cc5a6cfd8e8ecc433337413c14cddb

  • SHA1

    5aeb775b0ea1de9e2e74e12e1b71df8cf459733d

  • SHA256

    e29a3db17025e34336b10d36e5dd59ff5d1ac07ada8df0cddba0d3f3db689f65

  • SHA512

    7fe6a058e5a62550ed260adc392216cd011d566aab51fd116ee7fc7d7504b72e3e0eb39c91428356b52e5c84f339258ddf966ee9d402c95aaf2328bafa57bbb4

  • SSDEEP

    6144:3iUuGdolfFd313lcnGpPpnbJoHtbspmZfkCw3uWgGUS/T+WiU+9GTA/nw4AO2Y0k:3iUuGdolfFd1lGkpbCVkCweWgB7v9j

  Score

  10^/10

  donutloadercollectiondiscoveryexecutionloaderpersistencespywarestealerupx

  • Detects DonutLoader

    loader

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral9

• • Target

    random.exe.2

  • Size

    1.8MB

  • MD5

    524d6dafedd857028f12ec9718abcd5d

  • SHA1

    ccd616817eb62ec16c337ecde54cec823326996e

  • SHA256

    69f4a0f0748f97527424de98162579bbc5b0c44c41d41308f287b3065b480207

  • SHA512

    6fa5c0ec01b1292b28100ccc70c78af4b3ca9fc7c5124f147b1763030b7fbe035b9e72c7128b3f0f66d4485f904161af06576ccce2a7b8e7a470d2ea6f77c303

  • SSDEEP

    49152:Uxw/T4jhYn9NjhVQNTzJle4IQm7aE32lVvHxADjW:Z/Kc9/4zJE4gb32lnADS

  Score

  10^/10

  lummadefense_evasiondiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral10

• • Target

    wget.exe

  • Size

    6.7MB

  • MD5

    a46e3aa0154ceb8dda4336b97cce4440

  • SHA1

    ed2610991165afc5677069372af7e900b772a94c

  • SHA256

    6136e66e41acd14c409c2d3eb10d48a32febaba04267303d0460ed3bee746cc5

  • SHA512

    a1ef21ea4b3a93fcca5dcf796d851082ea611a066a0f5b8582b4a4c63d58d8476cf859ac8f69a8e5effe68115cf931afbe26912b7043c6e4975899124fb233a1

  • SSDEEP

    98304:yM0Zkf0/+HyeCFDwWK3Cj7ZNnIz+ooye0wqeonxF3A4+7meQT:yRBjTixpDF3

  Score

  1^/10
  behavioral11