Extracted

• • Target

    点击运行转换中文版3.exe

  • Size

    101.3MB

  • MD5

    8508b8d8c7f18a83c3273962015c4801

  • SHA1

    376250d1eff8073cdd8a675e0611f3cae24f5197

  • SHA256

    0bd10f7f1910e9b5d5c6dd6bffbb479ea636d86cc4d99a5cf24640cf9b83cdac

  • SHA512

    26b84e4463d1170a76528c9719366a7205c62370ff4f9e191b47f35f09b45db66753a3943e8cba7eb7fb257ff8ac44282468f5da3ea18523e57e2aa715e90a5b

  • SSDEEP

    3145728:G7kwwuE7sMxfyADRgk1I/uQ9kodzNI3b7zN9:l7sAJDFMdkcNqLN9

  Score

  10^/10

  persistenceblackmoongh0stratbankerrattrojanupx

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Modifies RDP port number used by Windows

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2