Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    45503927f90fe4aeae2c91c6f13d3a647338f44565cc2ca26ba0c1d49968c9bf.exe

  • Size

    3.8MB

  • MD5

    1b018d9d77edf9c08d39bc6080cf50d2

  • SHA1

    b24d472f1cb43e0c114de888e9726a6cb8fafca3

  • SHA256

    45503927f90fe4aeae2c91c6f13d3a647338f44565cc2ca26ba0c1d49968c9bf

  • SHA512

    854a81e05309fe51efd17a49f00f2cd95a01a815923b27b055296b1e5ca8c5c718b2bbaabf0bdafce3019201c26c63ecc199a9210cacbf12d5d110b888f395f4

  • SSDEEP

    98304:rwcCJEcjXKOFlOd/iZujgERMOarjSaoYI6gYo1je:rVaawOd/vMsMOaPI6To1je

  Score

  10^/10

  asyncratbabylonratdarkcometwarzoneratxenorat2024+apre2-newnew-july-july4-0new-july-july4-02infostealerpersistencerattrojanupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Async RAT payload

    rat

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables embedding command execution via IExecuteCommand COM object

  • Detects file containing reversed ASEP Autorun registry keys

  • UPX dump on OEP (original entry point)

  • Warzone RAT payload

    rat

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2