Extracted

• • Target

    aaf528c6e9dcc6876871abd209ae90a8.exe

  • Size

    3.8MB

  • MD5

    aaf528c6e9dcc6876871abd209ae90a8

  • SHA1

    9f6392d28cdf543b5508ce7e86f0dc26df53cc0c

  • SHA256

    3d464460a5eca975b045bdf92d3cc2952047279a06a7d618c6ea2c8b66ddce2c

  • SHA512

    11452d10f571800290880696695f4cadcf979558dc096df25f3b2f57622a62571b8836780c48f00989578c1d6ad7ee9f77dd7485115e7e221f5e245b43ae34ca

  Score

  10^/10

  persistencesuricatabitratxenarmorxmrigcollectionminerpasswordrecoveryspywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Detected Stratum cryptominer command

    Looks to be attempting to contact Stratum mining pool.

    miner

  • XMRig Miner Payload

    miner

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2