Extracted

• • Target

    6520075cebaaf79e5fda5bb7d77d3a72

  • Size

    11.2MB

  • MD5

    6520075cebaaf79e5fda5bb7d77d3a72

  • SHA1

    d12f23b92be59ff0d5fea73f15330e65779269ac

  • SHA256

    493c80e25021389cf0f7c03d0ba7af14bcffd20ba1e50753eca5d69f6789f3be

  • SHA512

    3ae6cfd1bd185aecca933c01dc41d2554ada1bd6d0c7f08cba391dc51a6e154f9bd47fe19d00c8d879bdd19cd5af4ed89ef76d6a8e744b61d940883a24232815

  • SSDEEP

    196608:uhPtKEX9/rijfGV2CXBtlXu90HRmPtnHaOA9m6l/AQsscwFZ9q:uhPtljqGVLBG2QFnSFlTcwD9

  Score

  10^/10

  blackguarddcratxmriginfostealerminerratstealerthemida

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • XMRig Miner payload

    miner

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2