Extracted

• • Target

    nigga.exe

  • Size

    1.5MB

  • MD5

    82acd827f36e29c05e6581558b0d76ca

  • SHA1

    bd43089a78e97b66064b37d72f086f4c042a4c91

  • SHA256

    7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb

  • SHA512

    cdf9077fb0c06a9fc38dc0aa630345adfb65bfb264d03d7b56b0961f02798f8bce49fcfa28fd40671a02e1e385ac0c4c2a3f914b1d0b64a844462be2127b261f

  • SSDEEP

    24576:f/f6OAqD+EoVeQExeVATaXAuQ5x3f3TWH5x:faOAU+M/WH5x

  Score

  10^/10

  aresloaderloader

  • AresLoader

    AresLoader is a loader and downloader written in C++.

    loaderaresloader

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1