Extracted

• • Target

    Morpheus Crypter.exe

  • Size

    1.4MB

  • MD5

    1aa43e7d7e2e812792f06312db0757d8

  • SHA1

    606a3060aac710287dd02b36b2999fecb9e67932

  • SHA256

    894041eeb6bf1a9b30e3492c7effef36c7e7fe4c6369f52893ccf12cd01362ff

  • SHA512

    8c148a5627e57e89209c17c96377d74130f3f780008830e0ecf75cff4666701d0521c8f3bcefd44148d564fc26f56ff39e794863d54af899fdcf935dea713121

  • SSDEEP

    24576:ovtzecScg7UdHaebuoXlXNPiCXaRt1CGgJs3bO0Yts0POvlNQFfokUolc8VB/w/c:6tUEaSsf1LgJue0l8/w/c

  Score

  10^/10

  imminentnjrathackedevasionpersistencespywarestealertrojan

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops Chrome extension

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1