Extracted

• • Target

    Robokits_USB_BT_18_ServoCon_Setup_V82.exe

  • Size

    3.1MB

  • MD5

    e0017606ff7935c846769b617a522c90

  • SHA1

    ccbc102781a64f7936310e8f25028101ac3ff353

  • SHA256

    0226f723ff835d0b46269c1b896fa18fef0a8ed24dc3c72872dcf4cb45be90f9

  • SHA512

    b904262e8eea28f2229f6b670cf0240314626a8736aa90ed86f7c254cbe461190f1ba0976794b08dd11242b577c29bf3b2d5d767d910ad48889697a0e0cc34c5

  • SSDEEP

    49152:sN26FOnzGn6LJvqkwnpC+mWd6uIcc+vo7dP6dF/WPxDz0peWUiz8ahxkYu:s06FOznLo0+Dd6uxc+vqYdF/WPxDIXxI

  Score

  10^/10

  azorultrmsaspackv2defense_evasiondiscoveryevasionexecutioninfostealerpersistencerattrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Hide Artifacts: Hidden Users

    defense_evasion
  behavioral1behavioral2behavioral3