Extracted

• • Target
    ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c
  • Size 254KB
  • SHA256 ed999c2336844e7496640b910fa5bbe256197c978744f089b6ce5f592f88c01c
  • MD5 a2d01b94b6d7cf7eb09e6c4ae853a70c
  • SHA1 470a6961cbc4eaf038aa9bf48aa1038fa0488d60
  • SHA512 4bf7431f41b7e3ac429d31bd745f4aec8ecb43a41f3c9a724b95836f646d3700e7f67167c4958ce95e134215e5bfd197cc5fc7de2c56da3cdca9750a734599d4
  • SSDEEP 6144:xfL+oqShnjsVl3dRQTLbd/z32wQxhYn9/KCg5bbiWMkMk:xfLNnjsVlNujJzicnlYbTVf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratxmrigzgratasyncquackevasionminerpersistenceratupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    ⠨/start.vbs
  • Size 143B
  • SHA256 8b1c9f37b2455175f260534847aed717824f8a1213696af8c2a0a485fb3576b6
  • MD5 1d4b27056d60880f980c362b6b4d6cad
  • SHA1 d795564ea34bd66d13f7d2db8a3bc3e86953adaa
  • SHA512 c5127a9ed85e7cbceee627a351a4a4a1ea4f908760564bb522869978dd157acb9789389c7083e0d7a0a83de004a371b1b389ec65b1844f7bf76317e62825a498
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral3behavioral4
• • Target
    ⠨/temp.bat
  • Size 196KB
  • SHA256 8df69a87548f9cec8c2086d95f1871bc9c946c0fc737cdb16e0f8bebd9e761e7
  • MD5 e8ccac423ab40141310994ecece68132
  • SHA1 f6eb963a9dc17bae65f01be4c8048da1456a1455
  • SHA512 d5791ba57b5b47d728e0e5ecca58466de03374e3e4d49eca2717259cda1d63abc4ff570413b3ae691221b55b1355596636a8fc21fda35dd4802885c158bd2aa5
  • SSDEEP 3072:fiaMR+dmFm6TTpDyJJ0j4ueDQprJyrJLFVxtJZP2rQ0TOwV9s5gKhSFRplhCwDag:rMzs6xDyluIQprSHT2JTOMs5RhSowDz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6