Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    クラック.zip

  • Size

    13.4MB

  • MD5

    6c5fc1a3ba386a83c87700f54d62a96f

  • SHA1

    a05f08de3e4f218ad2567a2695d0ca500fb48ecf

  • SHA256

    67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03

  • SHA512

    0a2573e40287c35c5a05c9b84fd5fd41bacc16c1bb565ee823ff6a42610c151f460a4be6d7009f0a70b648234aa998af27769ae667f4649c223c39c07449a098

  • SSDEEP

    393216:T0Wxsts7B2+qq0a1n5Gy0vdymghya/2yswYpmTg:wGg1+0a1nYvvJghD/2yMM8

  Score

  10^/10

  asyncratdcratnjratremcosstormkittyaugust crypter toolz grace stubdefaulthackedkosomk 555pukeddiscoveryevasionexecutioninfostealerransomwareratstealertrojanupxvmprotect

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  behavioral1

• • Target

    クラック.exe

  • Size

    17.8MB

  • MD5

    61bcb94052e57f07e8c662a80d8c29c1

  • SHA1

    db9d2e9e37eddedc1722727e8ce5a0a242a9ff10

  • SHA256

    3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6

  • SHA512

    7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1

  • SSDEEP

    49152:U6m1Vv6+nTCnjhT5iD1hTIUGzVnDk7Q3xCDza91PU3i/hv/kklWHvv7vTRZOp6/u:Um

  Score

  10^/10

  asyncratdcratnjratremcosstormkittyxloaderaugust crypter toolz grace stubdefaulthackedkosomk 555pukedeidodefense_evasiondiscoveryevasionexecutioninfostealerloaderransomwareratstealertrojanupxvmprotect

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • System Binary Proxy Execution: Verclsid

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  behavioral2