Extracted

Extracted

• • Target

    f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04.exe

  • Size

    2.5MB

  • MD5

    411c2e3611e8ee701918cfe17399da79

  • SHA1

    a01d2ceb1b9d0e002eb67a00fbac9238285dce85

  • SHA256

    f0ebd23eac064a10da288dbf3b9db45bdf5e107c970e57f7974710cad01aed04

  • SHA512

    c68a62e0342cdaaa23a8ad385551dff3d7f60e34c28c63797ef8d5969e714df6b0f7fa66a8904aaf65c034c26860f21453434e8678a48d149b2137054ee57b50

  • SSDEEP

    49152:YBO8QRm2I9bC9hY8PU5sevK7F6wd0HL5xRpMrpaKE9eFodKe/HT0:Y88QRmVluhnPyhyx30HlUpaKpodtHT0

  Score

  10^/10

  remcosxwormzgratremotehostpersistencerattrojanchaosransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Xworm Payload

  • Detect ZGRat V1

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects command variations typically used by ransomware

  • Renames multiple (202) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2