a3ecf063ef19a231915a6d72617700cb4d6a3f2742bb9ec5cf4116ab7bdf7daa

Sharing

Copy URL

Twitter E-mail

General

Target

CraxsRat 7.4 Cracked By @Hidden_Blaze.rar
Size

231.1MB
Sample

240407-plfzjada52
MD5

e962147ae0e09932f736d477cd51f80e
SHA1

b974d891470c3ec138942c1d00925964d424fb49
SHA256

a3ecf063ef19a231915a6d72617700cb4d6a3f2742bb9ec5cf4116ab7bdf7daa
SHA512

64aa95925e48f5eddd792eb08583ee2b28a601aa75cea235e1ad3f2b997f84d26b77f93f8240baa2481c319aa21fc684ae36b7e95f5ebcbd6560a0308fb834f1
SSDEEP

3145728:wn0P08VDv0bzz6qf4p88X6vm3lNHZT25OH5kN4NQ908t24lZT25OZbU3Io8Sk9:w1KD8Gvn3lN5ykkRm0yP8Sk9

Score

7^/10

Malware Config

Targets

- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/ChangeLog.html
- Size
  
  41KB
- MD5
  
  2037a83c06d4840b72dc8d6c243a3b02
- SHA1
  
  8fa8d97a2fb6cb561bb29ec365076726b4174814
- SHA256
  
  c922d1a2550232f01d151571e30827528f939c962db52bd6feb3aa51290e28ab
- SHA512
  
  1d3b91ab3988935e7716bb0dd3f550e593748a25720ff4c9a39c8ebd980ac77c94559dcf9685bbfc9e61ddde2e2401367905140dd92cf100cd4ce06182b011dc
- SSDEEP
  
  768:aXBgQlr/JTwbXwnTHWKPXpxrTpTDqR2I6YxZbAuM5RkWkFT9RurXuGPoH9oa0zz8:aeQZNwjwTnpxPpTGR2+Zbgf8wLgWzAzl
Score

1^/10
behavioral1 behavioral2
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/CraxsRat CrackedBy @Hidden_Blaze.exe
- Size
  
  63.7MB
- MD5
  
  b38669bb26cb4764ffce25c19f01cce8
- SHA1
  
  aaf8035347c044c8542705bb2d9b30f1a8794941
- SHA256
  
  f9119449e91e23dc7318b80913cc8470cf316465ca4ce5b92205a19d23063d68
- SHA512
  
  2d68b9cd20f08d852120d38bbac24fc9f9536c157c0f69aa94d0fc93b21e171a9dbe55f421e1ae2bb9ac2d1368f379489d13301472b8c7980b14cddf549edc72
- SSDEEP
  
  786432:1k+NX10EPRCGZeZLHoA5AKF7zR/t6tKF+iSFgAxTKo2:O+NX10q8GZeZBAMzttZmFXtI
Score

7^/10

agilenet
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
behavioral3 behavioral4
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/DrakeUI.Framework.dll
- Size
  
  1.6MB
- MD5
  
  0562b4c97f643306df491a938ae636da
- SHA1
  
  0807c37b711374ed4814a9518c9e264517de89a0
- SHA256
  
  70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80
- SHA512
  
  c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf
- SSDEEP
  
  24576:nYyUyUxws47SDJ+wfa3ZsacYwzhmT5LOMobxqFFnM9Pv1w+Fus:nYyUyUueD001YwzhmVSMoNqFF
Score

1^/10
behavioral5 behavioral6
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/GeoIPCitys.dll
- Size
  
  191KB
- MD5
  
  c070f2421851420e832e4f5989a775a2
- SHA1
  
  d6af3c48ffbe0fa1e0e54860836d3bbf374b8b46
- SHA256
  
  d54fd6c5903eea49a75d620d4ba232f8effb1863f5f9c974e4ac0a8fb1904131
- SHA512
  
  75c3edeb4c16d8e82eedc5595b9c3fde4cbd4a3e9deae1967ad513474920a48e4e9275fdc76f44032b1be570a4ece1a6393c4680af8989f67bcdec039d06798e
- SSDEEP
  
  3072:87IcHKc0TwY4O6BlLiJxTmd9h1+fJ5uJnjpUoh/ht21hYvpMaoySJHPc8E:8dHV0Tn4pox6d9G4k
Score

1^/10
behavioral7 behavioral8
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.MAPS.dll
- Size
  
  53KB
- MD5
  
  dfee15e4c6efa37e6645d8b47c8581e0
- SHA1
  
  876140e0855fcd15bfb590431fb7b280d1db4a21
- SHA256
  
  5b8a9a04f454a2c4da5989fa454a0138d3e5c40712816600f90111b7bf045c40
- SHA512
  
  4d0e7b0a5642b649c04e54d89e707ec00e79a0fa282eac19b6097b819652045c3e157763b5b2922a4c2252b0877059ef90eb60038280dbfbef9502f421d739df
- SSDEEP
  
  768:r4gOx89xKERw2U11HI+bZO603JLw8MOrNNLSW5/5xTcb2y1ehVHp:rPKB22HIwwFNuC5N6n+VHp
Score

1^/10
behavioral10 behavioral9
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.WinForms.dll
- Size
  
  19KB
- MD5
  
  76c775d09b24798f6923452e920979b5
- SHA1
  
  3fe2c79512a0d1153fb07f6640b27106c90d333e
- SHA256
  
  a5b61c1726304e6b72e09a0f35ddbf52f89a75a4e28e6ed098c8d1df6081b4ad
- SHA512
  
  eacc093f8ac9401f617df7e07fd68a8a0f1f03aa150283de67ad8c338fcb1520b0f07335547cf533a646ff95f239c92b029f952a706e736bcd9508817c9be0f9
- SSDEEP
  
  384:F5gNA4m0NkdPbJfGZLifwdNqF8vLvTjzHEhZFUPOxFBVGquJpQ76RqMm:F5gNnrNklJfGZLiAw27jrEhZFyYMm
Score

1^/10
behavioral11 behavioral12
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.Wpf.dll
- Size
  
  212KB
- MD5
  
  e924f79f0b5f3e79c98477d75831813d
- SHA1
  
  64f71e20e1953b13c771d8a8e63549ad6d64216e
- SHA256
  
  1bdbb1b5c1a50653e5c26161e9b7c03edc518721a6e10ea180a84049d967106b
- SHA512
  
  063e9bdbdaf0accb46cef5fdb98b30a97b8a6ba097a80d43a9799ff73e820d1c56d41ca9f71d94497736e3def7fbd0109db4000ab1d9e46cdc96357bf3e15fd1
- SSDEEP
  
  6144:d/vd0eaDQcUc0GkiTV3bkACA3AloBtefVt+aA2xgKPo1zlW1w:vaErjGkiTV3bkACA3AloBtefVt+aAGBF
Score

1^/10
behavioral13 behavioral14
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.dll
- Size
  
  148KB
- MD5
  
  9642899636959b7fc89bf34a8b998a90
- SHA1
  
  479a0254d1c9e5565c7d861bb77f54b7eae50c96
- SHA256
  
  9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca
- SHA512
  
  435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2
- SSDEEP
  
  3072:saegvMNVoz3Vlw6/R3z3MV1IdJJGVKWHC2KdxFFT9lzo:VFJlwYMVWY65z
Score

1^/10
behavioral15 behavioral16
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/NAudio.dll
- Size
  
  498KB
- MD5
  
  6ca17abccae3050f391401b2955f9333
- SHA1
  
  0975b039a793accb58130d6639262cd291d80d5d
- SHA256
  
  3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c
- SHA512
  
  c08f366aae9baf0e7762f47a2f79d0dee5187a1d7631e5838590b7c12911bdeb6247e0ff860ade36e04f1d6717f919ad98df6d3a1a556bff4b8994db9616ccec
- SSDEEP
  
  12288:MnXnae2TPlr3zvzar5oRDaw92wP6mai9gs6C:K8lrT+r5ADakP4i9gs
Score

1^/10
behavioral17 behavioral18
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  195ffb7167db3219b217c4fd439eedd6
- SHA1
  
  1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA256
  
  e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- SHA512
  
  56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP
  
  12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
Score

1^/10
behavioral19 behavioral20
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/System.IO.Compression.ZipFile.dll
- Size
  
  24KB
- MD5
  
  dcda916372128f13ada8b07026c1b3e7
- SHA1
  
  99d6c187de8510206a93d2eed9c65e65e0c86e72
- SHA256
  
  b5c12e9099643e2eda9b49edd0d98bdaed153c72a7e8e6235d8e78714402d16a
- SHA512
  
  d66de5d61cf7090ce2e11ca8064723a44c2fdbd7ed937f1cf4198ebe13083037941b816ad9022d332bbb853666785600fa8b1faca94c498d2f82de73fe1e42f9
- SSDEEP
  
  384:dK8Y54xRiW3mWeW+mWE3rq0GftpBj52ERHRN7dldBopPI:dKfemqiuEBHoa
Score

1^/10
behavioral21 behavioral22
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/WinMM.Net.dll
- Size
  
  43KB
- MD5
  
  d4b80052c7b4093e10ce1f40ce74f707
- SHA1
  
  2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA256
  
  59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- SHA512
  
  3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP
  
  768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
Score

1^/10
behavioral23 behavioral24
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/craxs.dll
- Size
  
  16.4MB
- MD5
  
  5bba6bea8e33a42327c93788643ef188
- SHA1
  
  deaa84003a8e3a915c15a5e40ebb379b32070281
- SHA256
  
  2b0a9f3e24ea4e6672d5c88148140d657ea30794893236b2d52f45a0717befe9
- SHA512
  
  3847a650db18ff93b2bdfffed4a1eb34e0c7cb93b098b1f63e69943b744ea5e5ff2dfddf54beddbf8e0091feaa0fd3461dc67164b32dc8e8fe799c7782cc5874
- SSDEEP
  
  393216:qnJG4FaCLuvqegSi3g2o56gRpJMWqOjPDWZakhwpZr:Fopsqee3WkEpFPKEki
Score

1^/10
behavioral25 behavioral26
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.dll
- Size
  
  1.2MB
- MD5
  
  34738b1b326c7f65d365a5b33e045662
- SHA1
  
  54f86f6d3b5d96584d6d2a76023f3522e09706fe
- SHA256
  
  4d61796b499a4177b03e8e36778ec57293bebbf26412c69e19d3248602a2bb8a
- SHA512
  
  134faa16f9913d4cfdfb8efdc9cdda6ff6907016e0f46e3f72792cbc183a688fab0484f251efa562639a75582e380b099481d79d6324e5aded0a8041492414ce
- SSDEEP
  
  24576:XXm+ENgUCp+R3RuC2HhS6yR1xF2rH8W7f3z9L/SDidq2:HX7cRuC2Q6S36DJuKq
Score

3^/10
behavioral27 behavioral28
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.exe
- Size
  
  1.0MB
- MD5
  
  c90af375bc40d0506c16b4ed75efccb6
- SHA1
  
  cd29f79b128ba67bc30e44e7a0365c5ffd3be376
- SHA256
  
  c6e3aa8b8b76b9e3b9df71b3f31d1b7a23f2a031099aceb68c39f38945b65dc0
- SHA512
  
  f0f9e9f6d92ebf20a5303be38e41f66fd052141f04db14ad1d30c974a4e4e70abd51340fe92658563bdb6a7587d9117883241de5bdd123a6e259123869dbabaa
- SSDEEP
  
  24576:xnsJ39LyjbJkQFMhmC+6GD9P377SqLk2JC5RzHl:xnsHyjtk2MYC5GDR77k2OHl
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral29 behavioral30
- Target
  
  CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/ApkEditor.jar
- Size
  
  2.9MB
- MD5
  
  2a86a4e2a358bdef45ebdb9b1ad217b6
- SHA1
  
  6f1474287e6e6f4b1264e48eda8b88dfb7b7a47f
- SHA256
  
  6bcda26492a031fc63b0d0f7b6b4590ef5017cdecc134ee9768521b03833fe00
- SHA512
  
  1e4eec08a13e72567bd2e565ddf08a17d098e470280a057c8d4c31cfd501482fe7e381364f456a31cad1b0dae69e85140111e776bbd4b95c0a450d7d7f82baa0
- SSDEEP
  
  49152:R5DHKV0tkwisQD+Dt+C4e/4sLbTJ8Jxi18ZqByspA7P41Mwsw3Ga:Lz00tkw9Qa+BegsLbS3ksP4Nn3h
Score

7^/10

discovery
- Modifies file permissions
  discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Obfuscated with Agile.Net obfuscator

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Modifies file permissions

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32