Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    New folder.rar

  • Size

    6.9MB

  • MD5

    27f8ef3eb1c6fdbe295174f4fa4ea19c

  • SHA1

    4e5768610fd41604c906729f866d4b97e7dbb276

  • SHA256

    a86957ee594e57dfdf8ffdee89b6ad7465212c8724f5cf524983bee81ea74506

  • SHA512

    94168abe57cf20fb20c17ca1d24aa1395c06d3eb1582f490d967b84b9b025d0613474b0878f375f7d75aa76ba876bee3fa285916090d108ad8324da44bbbab4b

  • SSDEEP

    196608:fYlj8zcAEYvZ4qhytYPoURanwftLalial8:fwAdB4q0WwKanwhaliR

  Score

  10^/10

  asyncratbitratneshtanjratredlineremcoswarzoneratdefaulthackedhackpacknyan catremotehostdiscoveryevasioninfostealerpersistenceransomwareratspywarestealertrojanupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1