Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    クラック.zip
  • Size 13.4MB
  • SHA256 67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03
  • MD5 6c5fc1a3ba386a83c87700f54d62a96f
  • SHA1 a05f08de3e4f218ad2567a2695d0ca500fb48ecf
  • SHA512 0a2573e40287c35c5a05c9b84fd5fd41bacc16c1bb565ee823ff6a42610c151f460a4be6d7009f0a70b648234aa998af27769ae667f4649c223c39c07449a098
  • SSDEEP 393216:T0Wxsts7B2+qq0a1n5Gy0vdymghya/2yswYpmTg:wGg1+0a1nYvvJghD/2yMM8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratdcratnjratremcosstormkittyxloaderaugust crypter toolz grace stubdefaulthackedkosomk 555pukedeidodefense_evasiondiscoveryevasionexecutionimpactinfostealerloaderransomwareratstealertrojanupxvmprotect

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1