Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    2a9bf696f1af170e0e1b5ede752a1578.exe

  • Size

    4.1MB

  • MD5

    2a9bf696f1af170e0e1b5ede752a1578

  • SHA1

    96b9f6c7398fc9c0cc44534dfabe08f0583baf3a

  • SHA256

    d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f

  • SHA512

    8236468322838e166fe46614dd0f90c576031ef55abfd79b249def9d320bd89b277bf3b7c84bf669480b0504637d1b93b565be5d17eae6065d2418604c25c80d

  • SSDEEP

    98304:alO2xqX9gK/NBJMYpntAecuJ4hLm0amUXzEnk4:a82x3KHJMOAecuJ4hLGmd

  Score

  10^/10

  asyncratbabylonratdarkcometwarzoneratxenorat2024+june1-newcrt2024+june111-newcrtevasioninfostealerpersistencerattrojanupxnew-july-july4-0new-july-july4-02

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Async RAT payload

    rat

  • Warzone RAT payload

    rat

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2