Managed XDR

localfile (Bozok, NetWire, BlackShades, DarkComet, Remcos, NanoCore, Vertex Loader, Poison Ivy) — malware analysis report

File info

Filename
localfile
File type
POSIX tar archive
File size
12.5 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
da222cb9dab8bd8db5e25379d528ab0d04ab71c9
SHA256
2ca201aaed40656dd98d757b8e37146d686685b6d97e4d074c2cf74309d74186
MD5
17eb4876e4caa30181881d3048e9f2ec

Malwares

  • Bozok
  • NetWire
  • BlackShades
  • DarkComet
  • Remcos
  • NanoCore
  • Vertex Loader
  • Poison Ivy

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1003.001 yara_rules: Static rules

Other

no_graphical_activity: No graphic activity
many_files_in_archive: The archive contains more than 5 files

Related reports