Extracted

Extracted

Extracted

• • Target

    DDOS TOOL.exe

  • Size

    5.3MB

  • MD5

    4356e6504e19b8a4014dbfacbc89493f

  • SHA1

    a4078eabcc6760e184259d694b7251b89569453a

  • SHA256

    e3a9ffb17c734d02950cdfcd38592549181d9f95220b8aaae69d6091480a8d42

  • SHA512

    83949b7422c6e2efcf6888e5c324ee8d536716f571156bdb4672e989aa68a1be5b7e6f0b5024e7c47af3f16ef0667045fda050f5dbc1272a491febdd249b7fe3

  • SSDEEP

    98304:9fIGp26lE8kKlr8iRqJxf+n/FHkLUfzv3QtRiBNyZWa8QEHE:9lEWrct+ntHkQfzPlpaz

  Score

  10^/10

  njratumbralxwormhackeddiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1