Managed XDR

localfile (Bozok, NetWire, BlackShades, DarkComet, Remcos, NanoCore, Vertex Loader, Poison Ivy) — malware analysis report

File info

Filename
localfile
File type
POSIX tar archive
File size
13.7 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
e934272963b48b8d41aeb3ec3ddc4815f17f1e9e
SHA256
d3cb604c28cd5319c63771392faefd980739a660e165bcaaf528b8cba2f9fcc6
MD5
8fe859f0c03316315cb84ec704f9367c

Malwares

  • Bozok
  • NetWire
  • BlackShades
  • DarkComet
  • Remcos
  • NanoCore
  • Vertex Loader
  • Poison Ivy

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1003.001 yara_rules: Static rules

Other

many_files_in_archive: The archive contains more than 5 files

Related reports