Extracted

• • Target
    cracutor1.0/cracutor (1)/ICSharpCode.AvalonEdit.dll
  • Size 606KB
  • SHA256 bf15ddb6056e9654ad66641752f8e7cbabf6e0171ef3c671cd70d844855e9d62
  • MD5 b017eb5c0f851971f9ebd816efac43cc
  • SHA1 ca1ade1b09f1667963242f49f2b97feaed76ce08
  • SHA512 ed03fabe2701f5648d7cc767be059b0ffc3f2824475963c49b8ac68634f0b5cdde8dc15d3f02a39c61f85736d607598e2bab8e39c065a6476879ed4729e9c930
  • SSDEEP 6144:QxYTpmH0OfxomgEFQP2fEqnkCOx7G0h7vcThz52gkjNuY+535n+kUXjWUUK8tKNz:QKTpmH7CJxiaeN2gkUn5UNH/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    cracutor1.0/cracutor (1)/Neptune.exe
  • Size 2.0MB
  • SHA256 255834540df95d84167a197acc6e70d9b80baa5dc15ddb16060508be498f1e78
  • MD5 03d0c69e31fd77718e661722361c0a5c
  • SHA1 04e02539771963a628477f6546be48d2d912a612
  • SHA512 94ed7ee2ad72a4b80fc9121483c5b95ad2a1036b3a20f60499d59cc1255635bcade467952b828a3b27415ddd799c8b3a89476bc0f34726292f6632249fa0d986
  • SSDEEP 49152:DBg2KouMMLSgIOiJgX+JvYLF1ESGbYGcJcDKbw:djKouMaXc4F1cmuDKb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4
• • Target
    cracutor1.0/cracutor (1)/RuntimeBroker.bat
  • Size 1.4MB
  • SHA256 5edd619490ce715b05fa88acb9865fa2c290949483b5813f70083d4480e4bf05
  • MD5 5f2ca709edfb4aab62c0d293fc078a8d
  • SHA1 e0ee77775465e261c7e0f48643c6d66af21841c2
  • SHA512 833edd2aadcd390eeb9e264bdcbb790fa013b3141a5e092ed4f23b819903f6fce0edd68e337dd8801bc3529b80521b2aeddf06f245a6df37d1a3b2af97d41eaf
  • SSDEEP 24576:Jo2hIxM0iKuWJzW21FPYEbTT9bLZfSRAHRtaBLmc2ZlzLMLM1XwXuV:s++iu3b15f7t4l0LMLM0uV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionstormkittyxwormpyinstallerratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6
• • Target
    cracutor1.0/cracutor (1)/Scripts/Infinity.txt
  • Size 431KB
  • SHA256 dd9e7382501343c4acdb40a13d55dbfef9f10fb6adfb3664be404ee2a11cc663
  • MD5 9ffb895c478c5c4ac3d0d3137d3843c9
  • SHA1 f7562a1a7af6267d13436f1a4a64decbd9eb9635
  • SHA512 dac83ec892c3e9a07a1ef809ca7ad2eab017c8c8349240878ee6ce2dfe7a350f9849af70bd3fbba8e476edadb98aec80d967086e4a4fd8b0c23c3450da02d028
  • SSDEEP 6144:Gj/ItvuAewoSbr8ATyFE/T8Nm8TjmniX+1lpk0GWC8BwxA3PyTeD+z:Gj/Itvvbw6yFE2SniXmD+z
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    cracutor1.0/cracutor (1)/cracutor.bat
  • Size 1.4MB
  • SHA256 b1a9d16d628c1d565fa577310ea64da8510ecd7f55e83e7de46c28c1c7b186f4
  • MD5 000a836508cfa074075fa018fdb42d5f
  • SHA1 e7690ef953435c37959639a579aee9fcc911b90e
  • SHA512 9899da986961105d6d6abe83403ff471d338fea3335b0df5e005db61429c7db843633a66e45cbbbfd8df82e37147816090eabae97747aa75df9495848d333863
  • SSDEEP 24576:PSNWms9W6b/wu9Fs1i2sBLr3O39YEraFMcNg8K0C1yywyY9+iWBxKXDcungX94uO:aScQ4CfF3OL8XDCyn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stormkittyxwormexecutionpyinstallerratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral10behavioral9