Extracted

• • Target

    f4a8b76c1fd70abbf8f4d9197317feb964891c1f656cb28ed6c8f6fe79fb650b_JC.exe

  • Size

    1.4MB

  • MD5

    ea04e601cbced54cf7ebe9a0c52813a6

  • SHA1

    cf41f1ae7522e65f128a48ba6c1a1b5d49a98f25

  • SHA256

    f4a8b76c1fd70abbf8f4d9197317feb964891c1f656cb28ed6c8f6fe79fb650b

  • SHA512

    5e3796b24c8a06216e642afed1b19b18a732b2dbc7d7b420fff152f1d91ad20fedd71a14d5bc304e8a2cfa9c99767b1cba8c9e23ae50b7db4b4363d55e14fce7

  • SSDEEP

    24576:iYfuzMVr9WZNNw/G2l8nRIe0IY0mwFKivSeYYdwDuoEd+Hv18ovh9F+28FA:NVxWZEus8BH4ReYYdwBEdMt8IhnKA

  Score

  10^/10

  originbotnetkeyloggerpersistencerattrojan

  • OriginBotnet

    OriginBotnet is a remote access trojan written in C#.

    trojanratkeyloggeroriginbotnet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2