Extracted

Extracted

• • Target

    FINAL.exe

  • Size

    13.2MB

  • MD5

    8c9180cfa2862e68b9beaf9b9e14a1c2

  • SHA1

    09011f6b0b5d48e9bb61e65f10872fe4b344f66a

  • SHA256

    b8e6b01b8e7598bd8b01bedfe1232eb936a12f852a90a3a545bc2af7e4667c43

  • SHA512

    4657b171e3594370a8c9086bd2436b5ec7deaba73975856baafce4391582c6ce45d0820922706e0de3346bb85ffe8854fe419baa88a6cca83b94d67214bdf6c3

  • SSDEEP

    196608:7+ww4z5xjkyIte8YHX0QoLPT7M18ZKhib/sV83V+Uj3iI9NeTA4cxXD4JF:7+x4FSyI88Ekprw1/f8R3roTAY

  Score

  10^/10

  limeratquasarrevengeratwindowsfirewallransomwareratspywarestealertrojanupx

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Nirsoft

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2