Extracted

• • Target

    4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

  • Size

    660KB

  • MD5

    54a315b26c66694821fb2091ef865f7f

  • SHA1

    9f79ec5e7845bd33a58124fd3d10637a20630bb5

  • SHA256

    4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef

  • SHA512

    625e851ddedd83103d1b27c25bdb8428e8aab9321436d48668112dd887f9ede5655b4f5b13d69e656bae522951c50cedd53426de725788ba5697089e81156814

  • SSDEEP

    12288:nBxT3SKVIC9HdFEtttJl3Mob+60MCV94D0cIegdu1oeK/lGRgOUqmq9kR6lhKXhh:BxT3ZVB9HdFQPl3M06MCV9k0DegduieE

  Score

  10^/10

  netdookaevasionloaderpersistencerat

  • NetDooka

    NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.

    loaderratnetdooka

  • Creates new service(s)

    persistence

  • Stops running service(s)

    evasion

  • Checks for any installed AV software in registry

  • Suspicious use of SetThreadContext

  behavioral1behavioral2