Extracted

Extracted

Extracted

Extracted

• • Target

    TronMiner-2024/TronMiner-2024.exe

  • Size

    2.0MB

  • MD5

    15307910d7c9a3a1215e4e4e4f500895

  • SHA1

    49a7df2a0ebfb6556c1e17cc8baf8cd5756eded9

  • SHA256

    514caaa6fbcdf64af8cbb24487ba1f89d1219ac25988c51a34fc850f6bf0b8e5

  • SHA512

    9b9f339a4c7bbf1b824e2efcad3c8fb84bd47b153d29f459a9e50624a83481a81441db0aaf9fb2eae0842aa5c3358e103bad28a7a5b45f152ebe28fccbeb4453

  • SSDEEP

    49152:qoUM9eEZyfky3a7B9L787fYIdLVYZcl+:/UMHyR3sB9q7CKA

  Score

  10^/10

  darkcometwarzoneratnew-july-july4-02infostealerpersistencerattrojanupxasyncratbabylonratnew-july-july4-0

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2