Overview

overview

7

Static

static

7

craxs/Agil...me.dll

windows10-2004-x64

1

craxs/ChangeLog.html

windows10-2004-x64

1

craxs/Crax...xe.xml

windows10-2004-x64

1

craxs/Crax....1.exe

windows10-2004-x64

3

craxs/Drak...rk.dll

windows10-2004-x64

1

craxs/GeoIPCitys.dll

windows10-2004-x64

1

craxs/Live...ms.dll

windows10-2004-x64

1

craxs/Live...pf.dll

windows10-2004-x64

1

craxs/LiveCharts.dll

windows10-2004-x64

1

craxs/MetroSet UI.dll

windows10-2004-x64

1

craxs/NAudio.dll

windows10-2004-x64

1

craxs/Syst...le.dll

windows10-2004-x64

1

craxs/Vip....on.dll

windows10-2004-x64

1

craxs/WinMM.Net.dll

windows10-2004-x64

1

craxs/mscorlib.dll

windows10-2004-x64

1

craxs/res/...-1.dex

windows10-2004-x64

3

craxs/res/...n-2.pl

windows10-2004-x64

3

craxs/res/...n-3.pl

windows10-2004-x64

3

craxs/res/...-4.dex

windows10-2004-x64

3

craxs/res/...-5.dex

windows10-2004-x64

3

craxs/res/...n-6.pl

windows10-2004-x64

3

craxs/res/...n-7.pl

windows10-2004-x64

3

craxs/res/...n-8.pl

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    craxs.zip

  • Size

    199.1MB

  • Sample

    230313-skvcbada3s

  • MD5

    c38e56224b78af16d8028803bab8fedc

  • SHA1

    d5095f9524defe57c7e3bf9926b2752d6a3f50f7

  • SHA256

    977ce36a053ed9f0a1bbf031f81629e1c7c8bc864e8255e25ca15a7eb625930a

  • SHA512

    9c3288a08c326f16300200bf4eb777a729736b6ea7793a34c8b42e1994933096cb618bf3a6db9f60c371880d034449d7acaa5a6e31efa8496344003deb3949f7

  • SSDEEP

    6291456:SWD3joLK7XD9TkAm2/kdWYfg6Nw3Shp1KurkXH:SWD/7zSikdZUkp11ri

Score
7/10
agilenet

Malware Config

Targets

    • Target

      craxs/AgileDotNet.VMRuntime.dll

    • Size

      51KB

    • MD5

      06f3445fea4baefc85e9bd8132c08340

    • SHA1

      016aff2a392a4c5b63d74ec6e3bc0f85ac1a067a

    • SHA256

      fd186283d8b31a7605004a4c85ea25042126b8f4bfcb2acf092d9974a647be97

    • SHA512

      3eee5f645f1791b82d7baa278dd64911870fed5afc2f4c4044953bed9e0a5598fc8e4339d7e254ad268d72f424b83998902102313c1b08c18962ab4e6ea45507

    • SSDEEP

      768:d4gOx89KEARw2a11HI+bvY603JLw8M2DaUBGhvbOikA+4LC/+3oGH:d8EN24HIwQqbvbOikATy+3oGH

    Score
    1/10
    behavioral1

    • Target

      craxs/ChangeLog.html

    • Size

      1KB

    • MD5

      e13a142fd65ba98dcd14acab49b75f5c

    • SHA1

      5259cc36a8473edab4b5328dd45ba2c0579185cc

    • SHA256

      adedda589be1f4181787e5f3453ca48f74f950ba7628099ba217d89fd9eb7f73

    • SHA512

      10dfc63549eb15d2bd787f83e5da43a9a2eb34fd9fbc22d10b1015eb0869c3e323db1d49c7338a567105fea9139a04294a51a9f44e2562b703c5c10e07685004

    Score
    1/10
    behavioral2

    • Target

      craxs/CraxsRat.exe.config

    • Size

      7KB

    • MD5

      dd5a0508827ec5ef25064c18fbd73c79

    • SHA1

      32f9a8803107d28418437312fd0e52e564f0f753

    • SHA256

      fdd077b07e6edd22678b2a29beee104daffdf56d545bbae1f39c632208a61d74

    • SHA512

      6fa7e2407b412e471c42162d460625e17a7dc7b76b0a236db1746645f75cf38806026f1084b254da204ce149e960da1a7897e472c58fe71151435fb94ae012e6

    • SSDEEP

      96:ur71tp7K0rjtHyZ90nDP9SbujEBKgFAnuAnznVuupxZAEcHn4abLQAntYIWVv/xb:ur7rp7vrjaHyv

    Score
    1/10
    behavioral3

    • Target

      craxs/CraxsRat3.7.1.exe

    • Size

      66.7MB

    • MD5

      5c2c62b358dbe25728a5868b66bb87a9

    • SHA1

      4aebe8e52701529be67930024dcf131dbfe0564b

    • SHA256

      50681ebff635c53cf55cb01a229ee0b70e600e31c4d53cc27adb51499a2c4ce5

    • SHA512

      9551c54113ecdd735c7c1ad3de555e266180f25929b2a06004f2aa9960e02d1ed069fcfcb4d5d0c637098bb59d3c886a78c298ccf3b652949643b357e7962111

    • SSDEEP

      786432:Sbj7Ad4+fseiTkO6W4qt+90qaZrNgb9BHGI+fseiTkC+fseiTk:JfwTkiFGaFeBBHGZfwTkzfwTk

    Score
    3/10
    behavioral4

    • Target

      craxs/DrakeUI.Framework.dll

    • Size

      1.6MB

    • MD5

      0562b4c97f643306df491a938ae636da

    • SHA1

      0807c37b711374ed4814a9518c9e264517de89a0

    • SHA256

      70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80

    • SHA512

      c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf

    • SSDEEP

      24576:nYyUyUxws47SDJ+wfa3ZsacYwzhmT5LOMobxqFFnM9Pv1w+Fus:nYyUyUueD001YwzhmVSMoNqFF

    Score
    1/10
    behavioral5

    • Target

      craxs/GeoIPCitys.dll

    • Size

      191KB

    • MD5

      c070f2421851420e832e4f5989a775a2

    • SHA1

      d6af3c48ffbe0fa1e0e54860836d3bbf374b8b46

    • SHA256

      d54fd6c5903eea49a75d620d4ba232f8effb1863f5f9c974e4ac0a8fb1904131

    • SHA512

      75c3edeb4c16d8e82eedc5595b9c3fde4cbd4a3e9deae1967ad513474920a48e4e9275fdc76f44032b1be570a4ece1a6393c4680af8989f67bcdec039d06798e

    • SSDEEP

      3072:87IcHKc0TwY4O6BlLiJxTmd9h1+fJ5uJnjpUoh/ht21hYvpMaoySJHPc8E:8dHV0Tn4pox6d9G4k

    Score
    1/10
    behavioral6

    • Target

      craxs/LiveCharts.WinForms.dll

    • Size

      19KB

    • MD5

      76c775d09b24798f6923452e920979b5

    • SHA1

      3fe2c79512a0d1153fb07f6640b27106c90d333e

    • SHA256

      a5b61c1726304e6b72e09a0f35ddbf52f89a75a4e28e6ed098c8d1df6081b4ad

    • SHA512

      eacc093f8ac9401f617df7e07fd68a8a0f1f03aa150283de67ad8c338fcb1520b0f07335547cf533a646ff95f239c92b029f952a706e736bcd9508817c9be0f9

    • SSDEEP

      384:F5gNA4m0NkdPbJfGZLifwdNqF8vLvTjzHEhZFUPOxFBVGquJpQ76RqMm:F5gNnrNklJfGZLiAw27jrEhZFyYMm

    Score
    1/10
    behavioral7

    • Target

      craxs/LiveCharts.Wpf.dll

    • Size

      212KB

    • MD5

      e924f79f0b5f3e79c98477d75831813d

    • SHA1

      64f71e20e1953b13c771d8a8e63549ad6d64216e

    • SHA256

      1bdbb1b5c1a50653e5c26161e9b7c03edc518721a6e10ea180a84049d967106b

    • SHA512

      063e9bdbdaf0accb46cef5fdb98b30a97b8a6ba097a80d43a9799ff73e820d1c56d41ca9f71d94497736e3def7fbd0109db4000ab1d9e46cdc96357bf3e15fd1

    • SSDEEP

      6144:d/vd0eaDQcUc0GkiTV3bkACA3AloBtefVt+aA2xgKPo1zlW1w:vaErjGkiTV3bkACA3AloBtefVt+aAGBF

    Score
    1/10
    behavioral8

    • Target

      craxs/LiveCharts.dll

    • Size

      148KB

    • MD5

      9642899636959b7fc89bf34a8b998a90

    • SHA1

      479a0254d1c9e5565c7d861bb77f54b7eae50c96

    • SHA256

      9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca

    • SHA512

      435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2

    • SSDEEP

      3072:saegvMNVoz3Vlw6/R3z3MV1IdJJGVKWHC2KdxFFT9lzo:VFJlwYMVWY65z

    Score
    1/10
    behavioral9

    • Target

      craxs/MetroSet UI.dll

    • Size

      444KB

    • MD5

      d99a97de55b2561e57135433b44bb786

    • SHA1

      ab588b8d36683b52adcb32c03a9859b884838f29

    • SHA256

      6288e559b0f34d56ab4601ffb2ba2289001c77cf7351d135dd93915034c56bba

    • SHA512

      7ef95cb161265fcf110ba843fe3af5e6cf6d47465e17a10c742256bebd91c128df2cfa7d21696d716bfa861c952d6fad445912f8cca9da9cb03d780211b0545c

    • SSDEEP

      6144:PTJ1DwrSfCmrB0O1SIai39IkRetlJT4ihPrsAgbP2UiuE2Bnw7M:rJSpmaxIephPrYDK

    Score
    1/10
    behavioral10

    • Target

      craxs/NAudio.dll

    • Size

      498KB

    • MD5

      6ca17abccae3050f391401b2955f9333

    • SHA1

      0975b039a793accb58130d6639262cd291d80d5d

    • SHA256

      3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c

    • SHA512

      c08f366aae9baf0e7762f47a2f79d0dee5187a1d7631e5838590b7c12911bdeb6247e0ff860ade36e04f1d6717f919ad98df6d3a1a556bff4b8994db9616ccec

    • SSDEEP

      12288:MnXnae2TPlr3zvzar5oRDaw92wP6mai9gs6C:K8lrT+r5ADakP4i9gs

    Score
    1/10
    behavioral11

    • Target

      craxs/System.IO.Compression.ZipFile.dll

    • Size

      24KB

    • MD5

      dcda916372128f13ada8b07026c1b3e7

    • SHA1

      99d6c187de8510206a93d2eed9c65e65e0c86e72

    • SHA256

      b5c12e9099643e2eda9b49edd0d98bdaed153c72a7e8e6235d8e78714402d16a

    • SHA512

      d66de5d61cf7090ce2e11ca8064723a44c2fdbd7ed937f1cf4198ebe13083037941b816ad9022d332bbb853666785600fa8b1faca94c498d2f82de73fe1e42f9

    • SSDEEP

      384:dK8Y54xRiW3mWeW+mWE3rq0GftpBj52ERHRN7dldBopPI:dKfemqiuEBHoa

    Score
    1/10
    behavioral12

    • Target

      craxs/Vip.Notification.dll

    • Size

      17KB

    • MD5

      a292d382f369373d6a925fe5907c69c9

    • SHA1

      7336065527d93566f79121c478545ae86ba8bb2e

    • SHA256

      ec7dc8e7890b3881e0a6f8616c7363d4fb43b9c5af2c090b08bbe0275031a6d7

    • SHA512

      9f45240686f506b11dbce466dd8b843683e09ff3896bc6563a6580d531898f60523614295c62556a5e058af5af18c3e98e80b3f0642f49f07dd2dc44a181dfdc

    • SSDEEP

      384:EDkSAZXF8SniyHUX4ICx3Fs9SqVW4z5QdfVASCFCDOtfgTuokwuwAqu05yokwOwG:ED8fR4tQsNFLfgvuPIOjk7ch

    Score
    1/10
    behavioral13

    • Target

      craxs/WinMM.Net.dll

    • Size

      43KB

    • MD5

      d4b80052c7b4093e10ce1f40ce74f707

    • SHA1

      2494a38f1c0d3a0aa9b31cf0650337cacc655697

    • SHA256

      59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46

    • SHA512

      3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450

    • SSDEEP

      768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv

    Score
    1/10
    behavioral14

    • Target

      craxs/mscorlib.dll

    • Size

      5.2MB

    • MD5

      de1475423d203585d982164f47765f20

    • SHA1

      05697ebff7cb77d2ae523382c6132c53ca6aeff4

    • SHA256

      964e7c0426d50550863629b252dd4fbc1f09c432f624e47c66b753afa55f7240

    • SHA512

      0a83384ccf020e82b551ac09e6c807d3ee72f6d703f8634f3af509e06f34b20e4c994831df3dc2affe8fb65f059d82b87b70f0d22d1b15d8719197b258e80e29

    • SSDEEP

      49152:rMr6BNLlYUvUVAXnwVc4HF/vXEYAVKxXQ0NmRj23uF92j9sk/IRUnAXuauXcf:uu0UvUVAXwVRF/Ec3guTcf

    Score
    1/10
    behavioral15

    • Target

      craxs/res/Plugins/Android/gen-1.pl

    • Size

      7KB

    • MD5

      effbc10b41f027e5c2130835d524c99d

    • SHA1

      affb65361d7a36d00e402ad869696578b5ac3259

    • SHA256

      566fb91b6bf186c05c4ec051aa2e2802961cbb158df24a8fecaa0678febece84

    • SHA512

      b2ddd0142a80663097e9b71d8d654d88382ef8f765c92f0c8fbf600f1174cb1b1e9e61088f954e609e6d2402fd4750b88945af7c1080018b991f2e6e6d9ad52a

    • SSDEEP

      192:q7h6D7OqRtGUGEEzEjkM1aiS/2Ii6sl+4J:i6vRrGUGJzEjkolS/2ILslH

    Score
    3/10
    behavioral16

    • Target

      craxs/res/Plugins/Android/gen-2.pl

    • Size

      4KB

    • MD5

      0037f9d6a388db91c980351af4c03b2f

    • SHA1

      9384a65d636944e42c0e93310dacf68dfe016782

    • SHA256

      f0326ad672ec2278750232cc920769710972da0594f45641441a4327a555cb8e

    • SHA512

      6ae67ad4d61ffd437c7b5b6044c6cc2c99b47619e0a7d3338322e3df1181dc66bed393a2466953e5b4eafb8d4b2fd7864e61b04479e74e0ffe1fd8d1cdc6d57e

    • SSDEEP

      96:2Pm57RfU5dE1Yn8RA9O6vUfXDmzWyPVEjCjpHY0e3/:2O5lw8RAU0UfXalNK0xYD

    Score
    3/10
    behavioral17

    • Target

      craxs/res/Plugins/Android/gen-3.pl

    • Size

      5KB

    • MD5

      a03b010aaedc90001f105b4858a4e8d1

    • SHA1

      44191d7dfea55cf37b6b14193801c90741ebb8cf

    • SHA256

      42c8d417fcc509864d08d42ef61a4926a17010abce6c1f06187acd931a9eeaab

    • SHA512

      8769d8329172a6d95b99056bd0b05ccab41c9b4b9b7efe16f2fb22a3f8acbab98d273a3c6bf2e845934ed58e95a08229f0fe27f78f057ca2c3f2ad547f863145

    • SSDEEP

      96:2Pm571ukquJN67N72vNx+y/NeFyocWiBhpWKvgnJyC5a4h7Ybt:2OauuhI9/8/X+pRvgnJR5a4h0p

    Score
    3/10
    behavioral18

    • Target

      craxs/res/Plugins/Android/gen-4.pl

    • Size

      28KB

    • MD5

      9506c5cbfc8e3e59fe9b9d52bea1ddd9

    • SHA1

      b7ff5d775666cd07120ea14569dc00527cc53d1f

    • SHA256

      725cce101997a2608c3a1b51de805caa6cfd7f9c8c84420d4b68135227b49edc

    • SHA512

      44445051d25ab0188ec7233c97680a279c2d717a436966d8cd90153747a7dfafb7d39c5bda72acfafdef9f674e2de500723134c08cde76d885cbeab69bca89e0

    • SSDEEP

      768:xbks1Qm2jDSqKIRexBC+H587KAGyC+lb2rvNu4:ys1QjDWZ87DC+l4A4

    Score
    3/10
    behavioral19

    • Target

      craxs/res/Plugins/Android/gen-5.pl

    • Size

      21KB

    • MD5

      9c6503eafa45558f1eb5f125c542bb0f

    • SHA1

      c8b67c7a056b96a7916fc97a597bff934e972fb0

    • SHA256

      7406077989fdcda2109ab3e591efc15fabee97109355d94c09dbc0e951a191c4

    • SHA512

      8234eab43a65e8714605541b3f970a4fc784b301e3c49a062d5f951a78135c98574d8c09419412187bcc4a5d8091d82889a4df7eb066db482a0fd87cfd36d0dc

    • SSDEEP

      384:ShRE8fQwsA9mfrxgXKAAtlwA0gnsQC1sPFmiOoVWhxNkbzU8DHiaIz:eD5Ez6aAAUDgsQC1sP3OoaNGzh2aIz

    Score
    3/10
    behavioral20

    • Target

      craxs/res/Plugins/Android/gen-6.pl

    • Size

      7KB

    • MD5

      d324afb827bc0410b7387f2f22d14242

    • SHA1

      bc8e494e86e41bee2ce2add6d0fe8919656a7102

    • SHA256

      69572ff59d2f8b428fa2e5fad4c6abfaa78813b889740a0b17c3bf4ff522f2c7

    • SHA512

      c337ade6028a734922d91e96abf87f889d57ebe825ab0a4c0d927cffb26e38558fc1c3f61ee042f423e639e60637b4b41cd436aebc054df2196868d58bcf428b

    • SSDEEP

      192:2OkFCNbNbSdOYT7Ax0xrUhmE7OH7Vgpet+gfLTkRQi33o+:2pFCNIdO24gr9EiH7V03gfnkq+

    Score
    3/10
    behavioral21

    • Target

      craxs/res/Plugins/Android/gen-7.pl

    • Size

      5KB

    • MD5

      a9f48543cf1571322f575724a0e8de35

    • SHA1

      edaaf35c07045f0d0376202700d1d3213e42c246

    • SHA256

      3a36e9b32c7bee100d590a31b8e622a229c6168e2fcd95dbd9fa934025e6787b

    • SHA512

      0b7f72c4b68e78f2c73485387a3d6e0d2dc92a2298bf0f737ccf1d4bf508db1e96a164550ed7a3a0a74f99cc89d989e1d28ecd986c4f164a0b22e9760dadadc1

    • SSDEEP

      96:2Pm57cUV8+pZmIjZ9gZdXarsspyqU0H16DN1kvZFgfqYTfTvPNLMrnSkCXeYH/:2OduEmIj8ZdKrQ0HkzkvZFO31YdCuI/

    Score
    3/10
    behavioral22

    • Target

      craxs/res/Plugins/Android/gen-8.pl

    • Size

      4KB

    • MD5

      767a048eec9220ff6d1434f8a6e6bcff

    • SHA1

      c328487ea7944dd413e6675065a4f22a8b0835eb

    • SHA256

      ed866f146cc3cec59e01c9ec18aa62d25590c9f789ec127c4c8d29350970edeb

    • SHA512

      4bc516c28b4d701153fec415c666f466f21aa095f6ab396cc98f84dadfb20fc60c47a6d6fe52ec43e964bc38fd1ac779e512171c6435f261710f53bdd3e7aa3a

    • SSDEEP

      96:JK+BK+W8yWwp+sT+YEIjxVuakCSq2z50gcBXfj8dPaQnmeCwKGS4AE9Wq:YAK+DrOfOIV7kx/cd8U5e0rZlq

    Score
    3/10
    behavioral23

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

9
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks