General
-
Target
CraxsRat_V7_full_Cracked.exe
-
Size
253.2MB
-
Sample
240723-smwm6awfrq
-
MD5
c3fb7b9a4e10b298766f4785f8876db7
-
SHA1
5e7a25c30991d965c72e6d0d371e5054ecd9f8d3
-
SHA256
3628884c6e416c323fe229db235f9c8324089b939b74bcfbcf6c48b85d4451c1
-
SHA512
fddeaa4bcf8fe9beb171184de44fbd80388466830df4729f71f36175fb5f2d7779a75b0aa97f53ab3d10d3994ffb9c76938069dcec51df9407ef1e084b20dbb0
-
SSDEEP
6291456:0nctxbO2gvzvK59xHWf1182E+cJ3MLOEIiMENIvZSTvLwaD:0ncnbO2gvW59xHIXhcJcLF/gx4LnD
Static task
static1
Malware Config
Targets
-
-
Target
CraxsRat_V7_full_Cracked.exe
-
Size
253.2MB
-
MD5
c3fb7b9a4e10b298766f4785f8876db7
-
SHA1
5e7a25c30991d965c72e6d0d371e5054ecd9f8d3
-
SHA256
3628884c6e416c323fe229db235f9c8324089b939b74bcfbcf6c48b85d4451c1
-
SHA512
fddeaa4bcf8fe9beb171184de44fbd80388466830df4729f71f36175fb5f2d7779a75b0aa97f53ab3d10d3994ffb9c76938069dcec51df9407ef1e084b20dbb0
-
SSDEEP
6291456:0nctxbO2gvzvK59xHWf1182E+cJ3MLOEIiMENIvZSTvLwaD:0ncnbO2gvW59xHIXhcJcLF/gx4LnD
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-