Extracted

Extracted

• • Target

    file.exe

  • Size

    1.4MB

  • MD5

    d3bcc11e32d75fec333d1857c4e0a3da

  • SHA1

    bea8ba8c44766d446e264bb6d25c9f9b5158ff78

  • SHA256

    57dd76c7c512afbed21d7304a66fffd89cd904c39a47d459a49aec1f5f1d5235

  • SHA512

    300b305602265e84dab3bf2941a35a409bafb263e955397ac41ff29f01b5e9ee17b0907db39b374f8e8973c3e2200b0b9b34c2074f11e2c5a67099f429b6c73d

  • SSDEEP

    24576:nbm+AIHqd5yIfvDkTlAKot2+c3t7JVpfjfWZnHbyBrN1Rd9rmRve2GViRXUmFX:bm+Aoqd5yMvDkTlAKoty3t7/Fjs+BrvK

  Score

  10^/10

  dcratgluptebasmokeloaderpub1backdoordiscoverydropperevasioninfostealerloaderpersistencerattrojanupxspywarestealer

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers COM server for autorun

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2