Extracted

Extracted

• • Target

    WiseCare365_Setup.exe

  • Size

    41.2MB

  • MD5

    a054cf67547476c2ab1b4d8e66bff7b3

  • SHA1

    b1b29a1ce3b6ee3bbea3ef30c36d7bd0f0935699

  • SHA256

    8baf828cdb482e769c87e58d47782100ebce01c9039a670b154d0f8eca958948

  • SHA512

    f672dcc0e190b22664770c2ce151a384e5bc06bce98e9f71e8f4a7eb480c08e5c15f14cdbc8a141599c854a5bfd0edecad63795edf388a752259855fe90c135f

  • SSDEEP

    786432:QsCKwcgE6McNv4noJS8nqOkx1Aiwn6QB3bwvNf1soEZLM/1A6LAVByFkWOOrHSPb:JChcgEFc/AnxlCboZ1dE18Zk0kWIb

  Score

  10^/10

  discoverydcratsystembccollectionevasioninfostealerpersistenceratspywarethemidatrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2