Extracted

Extracted

• • Target

    CraxsRat 4.0.1/AgileDotNet.VMRuntime.dll

  • Size

    51KB

  • MD5

    06f3445fea4baefc85e9bd8132c08340

  • SHA1

    016aff2a392a4c5b63d74ec6e3bc0f85ac1a067a

  • SHA256

    fd186283d8b31a7605004a4c85ea25042126b8f4bfcb2acf092d9974a647be97

  • SHA512

    3eee5f645f1791b82d7baa278dd64911870fed5afc2f4c4044953bed9e0a5598fc8e4339d7e254ad268d72f424b83998902102313c1b08c18962ab4e6ea45507

  • SSDEEP

    768:d4gOx89KEARw2a11HI+bvY603JLw8M2DaUBGhvbOikA+4LC/+3oGH:d8EN24HIwQqbvbOikATy+3oGH

  Score

  1^/10
  behavioral1

• • Target

    CraxsRat 4.0.1/CraxsRat 4.0.1.exe

  • Size

    3.6MB

  • MD5

    c03340af767421ec0ee35c378bbf3edb

  • SHA1

    63060366f0bf2b4dcff3974deffca94b472b8773

  • SHA256

    1dd45e5c7521156d2ca52d7aa5024e9fd3580ff6814a4b79161d7d730ecdb7ab

  • SHA512

    70863a2729baa254fc5d0b92a8631e98596bb2ad497a5e607328cc49e32e254ec1f4309c8c085983cd70e2141be09d0429568f2aace061644c3d2d59ee39ab7f

  • SSDEEP

    49152:7WsTEkwghTKv4jysGUqgCoOtt1JKsgGViSe8KuAfG9b/KMA:7FEkwghTKv4jysGUqgCxttdX8v/Ee

  Score

  10^/10

  hawkeyecollectionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral2

• • Target

    CraxsRat 4.0.1/CraxsRat.exe.config

  • Size

    7KB

  • MD5

    dd5a0508827ec5ef25064c18fbd73c79

  • SHA1

    32f9a8803107d28418437312fd0e52e564f0f753

  • SHA256

    fdd077b07e6edd22678b2a29beee104daffdf56d545bbae1f39c632208a61d74

  • SHA512

    6fa7e2407b412e471c42162d460625e17a7dc7b76b0a236db1746645f75cf38806026f1084b254da204ce149e960da1a7897e472c58fe71151435fb94ae012e6

  • SSDEEP

    96:ur71tp7K0rjtHyZ90nDP9SbujEBKgFAnuAnznVuupxZAEcHn4abLQAntYIWVv/xb:ur7rp7vrjaHyv

  Score

  1^/10
  behavioral3

• • Target

    CraxsRat 4.0.1/DrakeUI.Framework.dll

  • Size

    1.6MB

  • MD5

    0562b4c97f643306df491a938ae636da

  • SHA1

    0807c37b711374ed4814a9518c9e264517de89a0

  • SHA256

    70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80

  • SHA512

    c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf

  • SSDEEP

    24576:nYyUyUxws47SDJ+wfa3ZsacYwzhmT5LOMobxqFFnM9Pv1w+Fus:nYyUyUueD001YwzhmVSMoNqFF

  Score

  1^/10
  behavioral4

• • Target

    CraxsRat 4.0.1/GeoIPCitys.dll

  • Size

    191KB

  • MD5

    c070f2421851420e832e4f5989a775a2

  • SHA1

    d6af3c48ffbe0fa1e0e54860836d3bbf374b8b46

  • SHA256

    d54fd6c5903eea49a75d620d4ba232f8effb1863f5f9c974e4ac0a8fb1904131

  • SHA512

    75c3edeb4c16d8e82eedc5595b9c3fde4cbd4a3e9deae1967ad513474920a48e4e9275fdc76f44032b1be570a4ece1a6393c4680af8989f67bcdec039d06798e

  • SSDEEP

    3072:87IcHKc0TwY4O6BlLiJxTmd9h1+fJ5uJnjpUoh/ht21hYvpMaoySJHPc8E:8dHV0Tn4pox6d9G4k

  Score

  1^/10
  behavioral5

• • Target

    CraxsRat 4.0.1/LiveCharts.WinForms.dll

  • Size

    19KB

  • MD5

    76c775d09b24798f6923452e920979b5

  • SHA1

    3fe2c79512a0d1153fb07f6640b27106c90d333e

  • SHA256

    a5b61c1726304e6b72e09a0f35ddbf52f89a75a4e28e6ed098c8d1df6081b4ad

  • SHA512

    eacc093f8ac9401f617df7e07fd68a8a0f1f03aa150283de67ad8c338fcb1520b0f07335547cf533a646ff95f239c92b029f952a706e736bcd9508817c9be0f9

  • SSDEEP

    384:F5gNA4m0NkdPbJfGZLifwdNqF8vLvTjzHEhZFUPOxFBVGquJpQ76RqMm:F5gNnrNklJfGZLiAw27jrEhZFyYMm

  Score

  1^/10
  behavioral6

• • Target

    CraxsRat 4.0.1/LiveCharts.Wpf.dll

  • Size

    212KB

  • MD5

    e924f79f0b5f3e79c98477d75831813d

  • SHA1

    64f71e20e1953b13c771d8a8e63549ad6d64216e

  • SHA256

    1bdbb1b5c1a50653e5c26161e9b7c03edc518721a6e10ea180a84049d967106b

  • SHA512

    063e9bdbdaf0accb46cef5fdb98b30a97b8a6ba097a80d43a9799ff73e820d1c56d41ca9f71d94497736e3def7fbd0109db4000ab1d9e46cdc96357bf3e15fd1

  • SSDEEP

    6144:d/vd0eaDQcUc0GkiTV3bkACA3AloBtefVt+aA2xgKPo1zlW1w:vaErjGkiTV3bkACA3AloBtefVt+aAGBF

  Score

  1^/10
  behavioral7

• • Target

    CraxsRat 4.0.1/LiveCharts.dll

  • Size

    148KB

  • MD5

    9642899636959b7fc89bf34a8b998a90

  • SHA1

    479a0254d1c9e5565c7d861bb77f54b7eae50c96

  • SHA256

    9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca

  • SHA512

    435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2

  • SSDEEP

    3072:saegvMNVoz3Vlw6/R3z3MV1IdJJGVKWHC2KdxFFT9lzo:VFJlwYMVWY65z

  Score

  1^/10
  behavioral8

• • Target

    CraxsRat 4.0.1/MetroSet UI.dll

  • Size

    444KB

  • MD5

    d99a97de55b2561e57135433b44bb786

  • SHA1

    ab588b8d36683b52adcb32c03a9859b884838f29

  • SHA256

    6288e559b0f34d56ab4601ffb2ba2289001c77cf7351d135dd93915034c56bba

  • SHA512

    7ef95cb161265fcf110ba843fe3af5e6cf6d47465e17a10c742256bebd91c128df2cfa7d21696d716bfa861c952d6fad445912f8cca9da9cb03d780211b0545c

  • SSDEEP

    6144:PTJ1DwrSfCmrB0O1SIai39IkRetlJT4ihPrsAgbP2UiuE2Bnw7M:rJSpmaxIephPrYDK

  Score

  1^/10
  behavioral9

• • Target

    CraxsRat 4.0.1/NAudio.dll

  • Size

    498KB

  • MD5

    6ca17abccae3050f391401b2955f9333

  • SHA1

    0975b039a793accb58130d6639262cd291d80d5d

  • SHA256

    3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c

  • SHA512

    c08f366aae9baf0e7762f47a2f79d0dee5187a1d7631e5838590b7c12911bdeb6247e0ff860ade36e04f1d6717f919ad98df6d3a1a556bff4b8994db9616ccec

  • SSDEEP

    12288:MnXnae2TPlr3zvzar5oRDaw92wP6mai9gs6C:K8lrT+r5ADakP4i9gs

  Score

  1^/10
  behavioral10

• • Target

    CraxsRat 4.0.1/System.IO.Compression.ZipFile.dll

  • Size

    24KB

  • MD5

    dcda916372128f13ada8b07026c1b3e7

  • SHA1

    99d6c187de8510206a93d2eed9c65e65e0c86e72

  • SHA256

    b5c12e9099643e2eda9b49edd0d98bdaed153c72a7e8e6235d8e78714402d16a

  • SHA512

    d66de5d61cf7090ce2e11ca8064723a44c2fdbd7ed937f1cf4198ebe13083037941b816ad9022d332bbb853666785600fa8b1faca94c498d2f82de73fe1e42f9

  • SSDEEP

    384:dK8Y54xRiW3mWeW+mWE3rq0GftpBj52ERHRN7dldBopPI:dKfemqiuEBHoa

  Score

  1^/10
  behavioral11

• • Target

    CraxsRat 4.0.1/Vip.Notification.dll

  • Size

    17KB

  • MD5

    a292d382f369373d6a925fe5907c69c9

  • SHA1

    7336065527d93566f79121c478545ae86ba8bb2e

  • SHA256

    ec7dc8e7890b3881e0a6f8616c7363d4fb43b9c5af2c090b08bbe0275031a6d7

  • SHA512

    9f45240686f506b11dbce466dd8b843683e09ff3896bc6563a6580d531898f60523614295c62556a5e058af5af18c3e98e80b3f0642f49f07dd2dc44a181dfdc

  • SSDEEP

    384:EDkSAZXF8SniyHUX4ICx3Fs9SqVW4z5QdfVASCFCDOtfgTuokwuwAqu05yokwOwG:ED8fR4tQsNFLfgvuPIOjk7ch

  Score

  1^/10
  behavioral12

• • Target

    CraxsRat 4.0.1/WinMM.Net.dll

  • Size

    43KB

  • MD5

    d4b80052c7b4093e10ce1f40ce74f707

  • SHA1

    2494a38f1c0d3a0aa9b31cf0650337cacc655697

  • SHA256

    59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46

  • SHA512

    3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450

  • SSDEEP

    768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv

  Score

  1^/10
  behavioral13

• • Target

    CraxsRat 4.0.1/mscorlib.dll

  • Size

    5.2MB

  • MD5

    de1475423d203585d982164f47765f20

  • SHA1

    05697ebff7cb77d2ae523382c6132c53ca6aeff4

  • SHA256

    964e7c0426d50550863629b252dd4fbc1f09c432f624e47c66b753afa55f7240

  • SHA512

    0a83384ccf020e82b551ac09e6c807d3ee72f6d703f8634f3af509e06f34b20e4c994831df3dc2affe8fb65f059d82b87b70f0d22d1b15d8719197b258e80e29

  • SSDEEP

    49152:rMr6BNLlYUvUVAXnwVc4HF/vXEYAVKxXQ0NmRj23uF92j9sk/IRUnAXuauXcf:uu0UvUVAXwVRF/Ec3guTcf

  Score

  1^/10
  behavioral14