Extracted

Extracted

• • Target

    luxurioux.exe

  • Size

    6.5MB

  • MD5

    e43f5a6b060e95078d1bbab95dbf7a67

  • SHA1

    5f6c18308a96a1c750d6f4e8b22dd7bec701f105

  • SHA256

    969182320bfbad6534c5180717656b2bc2f09e8180c4b6f826ee2e63b9210027

  • SHA512

    d40bded7052153008bbe5847133b06d64ab4ae3c28bd207a3f4f353babede35782334286c44465c76eb862e3d63b4752e772fb22a45d8f99f9dbb637caab07d8

  • SSDEEP

    98304:gXc4No+9i3kwuwmX2qaaDvcrOobV1023br5I5S0fmw0NKg0yMgiPNIy6Ygl3qjZB:A/7+uSqa2dQBV+0ATPNO3EZ/zEM

  Score

  10^/10

  asyncratbitratstormkittydefaultpersistenceratspywarestealertrojanupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Async RAT payload

    rat

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2