Extracted

Extracted

• • Target

    lol.exe

  • Size

    20.3MB

  • MD5

    1da87056da8166d6ed5e04d81aa5522c

  • SHA1

    f3f81e8e0b116627682ae03ed6f004b2ac46f464

  • SHA256

    7bfea7f092cf7638322f351474791f12b66ec22c66f0872f3488256839bc4c45

  • SHA512

    cd9e5b62cc6918cc496dec0ab610a2d00c88d7e8285521730faecf881892070886c91ef9e0930f579e26d1cae20d09e0b233b365cdeabab4c29957c28e0e1b0f

  • SSDEEP

    393216:PzuEpuRT4xFrlZfl23p33X55EWheYkv8LlCTe2x:v4RerlLa3nTEwrkACTec

  Score

  10^/10

  njratquasarumbralromkadiscoveryevasionexecutionpersistencespywarestealertrojanupx

  • Detect Umbral payload

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • UAC bypass

    evasiontrojan

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Windows security bypass

    evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables RegEdit via registry modification

    evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1