Extracted

Extracted

• • Target
    Unconfirmed 139577.crdownload
  • Size 8.9MB
  • SHA256 dd54ce0ce897705d1737595441c15da0dbe8875c18595c185f4d17637188d8c3
  • MD5 32e28c7c21e18f295275af8f37dd9a9e
  • SHA1 f702f5e00cd30f88655cf7d9131466107580da7d
  • SHA512 82cb823abb3a6bae4cd4187c7c7640265b3e4b288a42317c25cdbf7834f49f12fe7037549c322fe774b2b9837f5bc04d10a807ffb34a312abdce5e9d60db4c55
  • SSDEEP 196608:9gnY6qd7rwxKyuu2EQyTnJhlZ4v6sUTvZf7V9BaR7UoUld0MRiwOZ9o8:e5qiAsJQyTJX2PORX5dgwv8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Reaper/Bin/FpsUnlocker.exe
  • Size 488KB
  • SHA256 d0685e397486bd9f54eda33133e87e3970dedf5038ef0e4d058de34d796d72ac
  • MD5 52f46ced3b06b19eac3369fbdb4ee2ee
  • SHA1 1bc549fa770b1bf3925248a3853a87af9948381f
  • SHA512 d65a7f73a497e18d0123306c3e940cdd5b22f61ad88fcd9a334c95bab0db665a8e61d11c9c78a656cbfdd7a691e782351fa712aa97c6f38f1d641ae91e3d23af
  • SSDEEP 6144:9nsLTb6hU1R1IDT3nn/b10WyIZUdA8CQ3mAg0y0Noh+p9NWRzbX:6TbgrDT3n/b6qiA8CQqvYogp/6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4
• • Target
    Reaper/EasyExploits.dll
  • Size 10KB
  • SHA256 23312041ffa8628a7f89a21ba72af853cb90f26cf134d456656276930b26c1ec
  • MD5 1c5ffe214040f00ec898bd3c5110e8b2
  • SHA1 4abfbf2bcbcb742b4c4bbb11d21cafeeb93cf8bb
  • SHA512 682e5c06b1d26bee3f8d5cab9ff9c70908906c20b28ad7e022c37ce3b62b9af5cb1bf39734f387353566b45f5cf9f7c879c3d0a32c894168e6fe64ce7b80bd36
  • SSDEEP 192:3U601DPhhshPYSndK+HiGcIa6Hp0+L2Ae:3T0pJhkP5dK+C76K+L2v
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Reaper/Reaper.exe
  • Size 8.4MB
  • SHA256 a8e3cbf1921a2485a307ac0ff2536accc77bc17db386a00e8d67c5537613b321
  • MD5 caa418507bb991b91bbfa3e52623c2f4
  • SHA1 9e1083e019ca8813024e1e58eac193d7a83b4b48
  • SHA512 84e57b9c0d88e67c2ebb3ef89df82b33b4d466b663fa1b43dd0c050b140fbc986135169c8840b4d91ed5921379579a85e743cda27184172a7a7eb87156c61684
  • SSDEEP 196608:SRyi9wysiM2+eLNxHPZe/eAwfPjprt/VU3jZoAp/aOROsEh/cH:SRLSIr+eLDvM9YBNMrQsh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratxwormdefaultrattrojanupxspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral7behavioral8
• • Target
    Reaper/Reaper.exe.config
  • Size 158B
  • SHA256 7ffc94d139bfc1b5cf222cdbdfe0bf53d665f8b6806625dccc6183a626a0433c
  • MD5 505c30296417920ece68a4b1e0aae738
  • SHA1 08fed3e09735b7e6df067c53070592338a6770fc
  • SHA512 eb095d1ad332869547f948fda262f8d8f71ab7183782e9105ffd75d3e5c81ec4274f79b6c7385db3eb5e8e212aff003a7ccf16712a8e2af52e769f5a310f7f93
  • MD5 SHA1 SHA512

  Score

  3^/10
  behavioral10behavioral9
• • Target
    Reaper/Scripts/Aimbot 3.0.txt
  • Size 98KB
  • SHA256 81fe4c1f8cbcf06e43a347fd8c39ceef960995031ae71db385c28636dfce3ec8
  • MD5 a026af0c23f83d6ec3ee17a4453c7dcf
  • SHA1 e707b0ebf1eac194e90c70767ee29a1c37e1a4a2
  • SHA512 9817501504aa1b4777f8d0b10c9776d224e0aa38e9ca91a6c80d472d5b5ceafac2e507c335a2bd9959073d74912825e1361bae699404b8c3bcdd9306b85c1b79
  • SSDEEP 1536:3N+t5Lq6w48qJ4UJe6wyG9EeG251GX/J3GC1Zqn+MVpx2RnB:kt5L0UJe6wyG9EeG251GX/J3GC1ciVB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11behavioral12
• • Target
    Reaper/Scripts/Aimbot.txt
  • Size 30KB
  • SHA256 d33d3205288b776d977ad0047647bc8d40b83bc7d4f190f86f1011c8b417e983
  • MD5 3ea5f844c18f550a3db09193c56594e8
  • SHA1 389968ae4228908180ba68ecfab2ddfabeb0966b
  • SHA512 8af81e52e74950a1961ad004400140386b0ad3d49d64e9617ad12d4550a4b1699eddf8e79849a32cdbdad034f25ee535430de9bef0513758e48b29a54d52b440
  • SSDEEP 768:DW6T+ELiUI29j8vVwP8UkSVDYtDkYNighmLlmyEDKtpWpJ7xwrs5SwG1NBbp0Bwh:iYTEK0y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral13behavioral14
• • Target
    Reaper/Scripts/Alt+Print.txt
  • Size 276B
  • SHA256 1be1b505588a0ed63863a78daa2612cce59870c83476753f073ee7a09baba5e2
  • MD5 c6cdc67c078c06a89efd33b7fcaaf583
  • SHA1 516c7475d780dc4754da8da0cac8acb3f8d50e40
  • SHA512 97877203b02bb7c8ad67cf8c6c81246a73dca1f25fcf054f95f51ac21f97b86ac13a91bc2070da0cecc0125370a9500ed5eea66041672f9d7fabb214e1aa07b0
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral15behavioral16
• • Target
    Reaper/Scripts/Arsenal Kill All.txt
  • Size 987B
  • SHA256 3cb65764ae9ab02061f27376b6787d632982f5451a37a335b72623b81f3fa44c
  • MD5 a96d1f0df7da446554d12790571a5bac
  • SHA1 f93fbe8b45db5c650324f616236b9e95d5ebc053
  • SHA512 f20f8c801272fd8f306130fde838643c8a9173c06644fcf6b9adfeaf0c6969234f1d109e0f1079eedf49d0cb2460aa5dc4fc66c3c4638154e475bb9bc170b0ab
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral17behavioral18
• • Target
    Reaper/Scripts/Arsenal.txt
  • Size 69B
  • SHA256 65a807665ffc96aafdd6e399814055ebf0f613510227f121a384a6ab88cebec5
  • MD5 19b3e51280884baabe42b4e1bb0fd1dc
  • SHA1 7bf1131d600c540261088a1e59018eae4bf12538
  • SHA512 7c64b132f9ccc7e563d199c3d4bd95841ccf39b2c2deb9f82ec4eb81a36de369242f14b6f0f5140aa05ad8a05a2dc0edea0c30328d0358280baf8b5d8209f673
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral19behavioral20
• • Target
    Reaper/Scripts/ArsenalHitboxExtender.txt
  • Size 1KB
  • SHA256 69077cd20bebad52854212dc80143d6cf992d18bf483b7f4f3f8647dd90e8759
  • MD5 df741fa99fcd0c4058511dc255dc8f83
  • SHA1 b80d29505729f8ed7ed9b56c8c7b5dfe11618f66
  • SHA512 425ff3040bed913407fa6af5c01224876b284bbd94c26f1b890b00bc44e5d478c837b40ce2cb88d53beadb20b3a976f1b8c7a960dcf13a6ced72c1070db641bb
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral21behavioral22
• • Target
    Reaper/Scripts/BRM5 Tp.txt
  • Size 12KB
  • SHA256 c0b8392007d433ba2b0f760e5d59a2f8ed40521ba82f2eaf3f271ac060ced99b
  • MD5 64c5fdf6ed4fa35a7f6b21ba28bded7d
  • SHA1 5c42f811fc3baf6fe8152aac8a2f7ad1fccb1db4
  • SHA512 24ae504c2ce9db408b3c5bd23795bc46dea3a6b0102607896dd0b05875d6ab77f52139cd0e79f9d7c6e363d6bbceb47a0356e7d382072c1cf2f7db28bb6a1426
  • SSDEEP 384:DLvDRcNwiuHiWVwVpE5ZqDBqT5gCzRGzV9IuFufuDja/Zjv/XIbmwzLho2+7dUJ0:DLvDRcNwiuHiWVwVpE5ZqDBqT5tluDOJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23behavioral24
• • Target
    Reaper/Scripts/CC Aimbot.txt
  • Size 23KB
  • SHA256 54cba20aa0213ce83ed348763db0b17a55e4f39fbeae2ef0535ccf76b95bf622
  • MD5 3ab630b89a082862b82b552185ea4f84
  • SHA1 703658e38cb131e6e53491f437a2e7e80a19ba82
  • SHA512 9c290dd73db4425643f52f5f72c9c4d55666071141f3efd696e4b757b46ebf9fc6bb964ed61f3d9e3ddcbdf4073850041a43b9df6dbf50fcace9382d875fe77b
  • SSDEEP 384:vP89lT07hqwp4EfExaDMluPQhKj8NTtXNKCkqJKcGfOtCZukLQKfb/eo5H+mYxsa:vP8XT07hqwp4EfExaDMluPQhKj8NTtXR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral25behavioral26
• • Target
    Reaper/Scripts/Dex Explorer v2.txt
  • Size 632KB
  • SHA256 5573cc6f439511c5ec73b0c88af87bce49cac37475aa32da5b75b931f632a3dc
  • MD5 317fec7c823a6ba4ad613220b587a0e8
  • SHA1 3884e8a9a9122e7912c76c919f20c1b9d274f505
  • SHA512 d5adc2137051ab321197d0a2261ab991f5bf16e0271485c64b66679d863efb58191fe269fc40aa39feefd380b28d33168a6910b7ec40dedd2974e6d1d2db0bad
  • SSDEEP 12288:fyXiPr7Gja8LsZuN6nQRXONQDKZsjOCBkVgfgLcbVgBe28Vk9Gm1OvClEjmD1Szi:fyXiPr7Gja8LsZuN6nQRXONQDKZsjOC0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral27behavioral28
• • Target
    Reaper/Scripts/Mad City 2.txt
  • Size 266KB
  • SHA256 629a0b979031a8b94d19e55cc1974c1361b491b005ca6b2f849265c5812b39f4
  • MD5 1f2e26cfc004bdc2f2de0679c8ff2568
  • SHA1 82f610d4b99fd08b52ffdd7d23b9f036bdcf27ba
  • SHA512 155fd7696881f01e401028f39e123a3023d5f84dab1a41c8b0440587b00aa8d4bab6654414c6e5a49ffae69734cbf2f0dac68cb1106a717e4216c69ef762103b
  • SSDEEP 3072:VS2T6iABa4FZmn//HRR4OhRUU8EdPpES4xFdbIy91oH34O91N8sh/:VVTPzYZmnnoOLUzEdR34xFdbIUoXJisB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral29behavioral30
• • Target
    Reaper/Scripts/TopKek V3.txt
  • Size 81KB
  • SHA256 c40fe38b134a8484794b773a363377ec8b37ed8bb5b5c88e182f4f7acc60b4c8
  • MD5 9e488b83078daf39e6f15f90c8d689cf
  • SHA1 8602a9d4ecb5c4ea52f096e60b72607731c62277
  • SHA512 a86b60e792572ecc512ffad6eab8c271da206fe108d03c9c0156b5eea7a889c61943e88480a14f51ca787c79d084bc099cd3b01e7b5569e6149b3b079a45839a
  • SSDEEP 768:l9dGinWaivTGFMoN6x94g+SnITXinAUJj0WFtdefC3ELZ7KhJDr0RzKokMy23ckW:Y3sr7b8W2PSh0gpNtiVtB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral31behavioral32