Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    bazaar.2020.02/Backdoor.MSIL.Agent.jdt-72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491

  • Size

    89KB

  • MD5

    f54eea2b9a7c0259b87a5303a526d818

  • SHA1

    641fcc96b0e288f7c5b1d0b94d6be1be2939e38e

  • SHA256

    72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491

  • SHA512

    36d1fb8553f454b1edbd719d4805e3d120b243960fb82ff640e52e3d3c9710a8761128079f981da011ad931c1117c0d7317f051bd4fd71a5bad93b7862dafde5

  • SSDEEP

    384:W8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZVPe+8tp:AY+sNKqNHnSdRpcnu+REgTK

  Score

  10^/10

  njratdiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2

• • Target

    bazaar.2020.02/Backdoor.MSIL.Agent.jdt-aa918b196328f1fe341b5b48cb5d28f31a94b92b279fcf36baaea55a0a8886f1

  • Size

    23KB

  • MD5

    a5c91c0df00109626c011eb185e94138

  • SHA1

    d79d3612639318cf0e9d8fedd9529dd1017863b5

  • SHA256

    aa918b196328f1fe341b5b48cb5d28f31a94b92b279fcf36baaea55a0a8886f1

  • SHA512

    65d929307e1266ec6bf40e8b979e39a1ac867c27f094a4e987e469a176819e4efb6904826f57938be993a5c9b674b0ee440b4f62d9254f6cffd43f4787efadf9

  • SSDEEP

    384:n8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZPb6:rY+sNKqNHnSdRpcnug6

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral3behavioral4

• • Target

    bazaar.2020.02/Backdoor.MSIL.Crysan.acs-d8e091f7e30656be6ba24890a96982b3a9def6123597c0b5ea740f8560ce45c1

  • Size

    46KB

  • MD5

    1aaf59f55909d4a71e391fe83ab33646

  • SHA1

    6087fb94d8e84397f52b433f6d4593a8351d5649

  • SHA256

    d8e091f7e30656be6ba24890a96982b3a9def6123597c0b5ea740f8560ce45c1

  • SHA512

    300b5ea3f87f468db10fd28cee729cac80fd59441420e446e5c8336d3e62d0d9f8e88a62f7be55bd47b6422da9c9242a8663bf98bcfc929d15ad94fa7ecac76b

  • SSDEEP

    768:bqXwHbXXUIbphkOicvHk3eHlWMPbPgF0qp9NwEBNYFVYI6OCy2tYcFmVc6K:b5bphXvZH0ub4FrDNZBNqz6O3KmVcl

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  behavioral5behavioral6

• • Target

    bazaar.2020.02/Backdoor.Win32.DarkKomet.aagt-4c1b6befb06152412567869f27c006cba39f4ac3b1c5dbcf8694a65367444df5

  • Size

    251KB

  • MD5

    b7b88850bc66c349bc02f81a3b443f39

  • SHA1

    4c4fe6f2dc874ca6c3b1d117e8da00e7114860e0

  • SHA256

    4c1b6befb06152412567869f27c006cba39f4ac3b1c5dbcf8694a65367444df5

  • SHA512

    47c7cd05d6716eaefc1a4305f227e9f95423ede5bb991135d6839c0d1f4b65d7c204bc9c07696ec5d4f71214adc4d6b0976d2fe03d2434e68fd8637a40dad282

  • SSDEEP

    6144:QcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:QcW7KEZlPzCy37

  Score

  10^/10

  darkcomethackeddiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral7behavioral8

• • Target

    bazaar.2020.02/Backdoor.Win32.Delf.aecw-a2f4d3da25e52d88eafb7a7da242e9bb507fe4626af58ca3b8c1a13e391c2000

  • Size

    253KB

  • MD5

    94d715c76354182482dcc8fb446a1be7

  • SHA1

    3d6497669c371e33c2e4055f9eb8c00dc5104387

  • SHA256

    a2f4d3da25e52d88eafb7a7da242e9bb507fe4626af58ca3b8c1a13e391c2000

  • SHA512

    e85e1ae231318c403a3aea0af312f587abbf55392fb8677543e363d9245054a939ad635a0094c0884b01f2e0171eb2919b43c556b472724bb103637cee206965

  • SSDEEP

    6144:nD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZbNW:nl8E4w5huat7UovONzbXwg

  Score

  10^/10

  darkcometmikel_04discoveryevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral10behavioral9

• • Target

    bazaar.2020.02/Backdoor.Win32.Delf.aecw-fa3981228b5b124a8b51fa64f8b6d5d05899165647dc50322b717d7ab63d4997

  • Size

    350KB

  • MD5

    7705cbb21d01877e944fda88286ac48a

  • SHA1

    c994c00fbd6b935f963be4bd548a202bda50cb07

  • SHA256

    fa3981228b5b124a8b51fa64f8b6d5d05899165647dc50322b717d7ab63d4997

  • SHA512

    88cf000b606ea0f7d8ef12da9b9a609468e674c37af679f15ae37ddc5fa416319d739d99ce139436d5ff3da3d00f15343be5f4bcc19beb3d06c92d550f0d9345

  • SSDEEP

    6144:WD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZODavMMV3:Wl8E4w5huat7UovONzbXwtEMV

  Score

  10^/10

  darkcometmikel50discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral11behavioral12

• • Target

    bazaar.2020.02/Backdoor.Win32.Parazit.aw-4f54c2e0def0a2a5b478220b3ddbccc3ee2a7302cddbfe0e8e1d394587589d88

  • Size

    48KB

  • MD5

    d52448cb39e67d27dae28f60906affcc

  • SHA1

    803c032ddeb9bcb46d828cf6bdc989d1a25cc660

  • SHA256

    4f54c2e0def0a2a5b478220b3ddbccc3ee2a7302cddbfe0e8e1d394587589d88

  • SHA512

    f5b9ada70e56f1e95dce6b95a612bf1ebef301be79328b802a7bce1e225ba78eabbaf825d8153215460625c1e6432add972f9c597a9d318973338a1a7895740d

  • SSDEEP

    768:ULvM+2O7Gel5quISq41ET8n7efFKuaAu4ycpV0byA8Bw4/xv5fS5:cCvel5HnqDY6f4vBcpsraW

  Score

  9^/10

  discoveryevasionpersistence

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral13behavioral14

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Agent.gen-0eb3ab9e4c6bc5903674d8f9b36a1a59825fa4e1c2d7209be4d7a0c16dc6168f

  • Size

    23KB

  • MD5

    f2e6febd5ac77954b3c8f460d5fa2598

  • SHA1

    7d7cffc86d330242f7f966d24dfd0605e2d21a23

  • SHA256

    0eb3ab9e4c6bc5903674d8f9b36a1a59825fa4e1c2d7209be4d7a0c16dc6168f

  • SHA512

    68c92f47c337904aa58b3c64a0d3513e005e48bb0b9b0cd90b30cb2c31be6b54e1ba3a961af7f3370cc6fbb38ea66bde91d509988023f5d0912420fa6800b135

  • SSDEEP

    384:xMsmCsg/EJHOzt+Z7SS1BEd1ng6Jgf24tfZVmRvR6JZlbw8hqIusZzZF/:trEi01jyRpcnuS

  Score

  10^/10

  njrathackeddiscoverytrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral15behavioral16

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-0a276fdaf3367ca3fd4cf90eb338dd3d0575ba3979f1bd609ce58e13e2aa0a8e

  • Size

    46KB

  • MD5

    b36ed4b297c327eb67746e85fe4434f4

  • SHA1

    7f24843a465e1e811b82a79ced5b071f7350155b

  • SHA256

    0a276fdaf3367ca3fd4cf90eb338dd3d0575ba3979f1bd609ce58e13e2aa0a8e

  • SHA512

    d7002fcabec0e34f5200df23e1ba2b9b840ed502f7b22da9c231613092aa853d8fa1b76b6e934947c13ffbfab5ba49be1c057944c726f9b9cb565470c22c2cbf

  • SSDEEP

    768:YCqJlzbXvMdSXekOicvHk3eHlWMPbPgF0qV1ZGF4G1Pc1pBSDHLw5YI6OC22tYch:YCjCeXvZH0ub4Fr/ZUdW1/uHL06O7Kme

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral17behavioral18

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-0e7c56b00281e18e385042a28f0e6202fbe39f3cdb219d17489799fca09b6550

  • Size

    46KB

  • MD5

    36959ff8dbe435a6d48ca9c3c6699a27

  • SHA1

    55ebd85589544886920b51779d36336f38ea9781

  • SHA256

    0e7c56b00281e18e385042a28f0e6202fbe39f3cdb219d17489799fca09b6550

  • SHA512

    42207753bdbd3821532685fa5870384ac4fa450baeacc99e5764401caba94e41b0df0ee0bd85ad597176902db20ccc6d93d47243300bb3d128adf26fc31df758

  • SSDEEP

    768:9qXrebXXEF5STUkOicvHk3eHlWMPbPgF0qtL+A03byeRThjYI6OC32tYcFmVc6K:9Y5STUXvZH0ub4FrtL+A03RTht6OyKme

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  behavioral19behavioral20

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-0eeb561ea16bf80e301847add0363445976f5ab518d23e499cbf1f7ce9e6fc59

  • Size

    46KB

  • MD5

    34dd1859e3b572cb15c85c7255d1a2dd

  • SHA1

    76f166cef6f5a11d45e5d0cbc53c40b8e89ccb73

  • SHA256

    0eeb561ea16bf80e301847add0363445976f5ab518d23e499cbf1f7ce9e6fc59

  • SHA512

    2373268b5da51e3f8ca0eb6f8fefa5e801c7c4494944296cf1ab4df7c9f5c274cb6a6ae3ef972ddb065d078d0954324a3651ade4f7725ff71e474958e2932b90

  • SSDEEP

    768:o+qb/VbXngXB6XqkOicvHk3eHlWMPbPgF0qk86nFVS3pALZtYI6OCq2tYcFmVc6K:o+joaXvZH0ub4FrktFVS3pid6O/KmVcl

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  behavioral21behavioral22

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-0f268e9be95d203c8d5cfa33d50ad7f623f13746bd97ec24703959dc08d97a9b

  • Size

    46KB

  • MD5

    305a2bab3acfb2a2ddc57f06a4b64471

  • SHA1

    357f18e24572b55b6270db3485f39b3a06278fd7

  • SHA256

    0f268e9be95d203c8d5cfa33d50ad7f623f13746bd97ec24703959dc08d97a9b

  • SHA512

    49be514325a15e7e132a98309f8645083d30d23ba4fb05b6487f691c3ee1336dd007d88b2ea644875b96bc8d725792c341ccf062485099a5e7243084e19e7b82

  • SSDEEP

    768:xqYVNZJrbXvkjjVKLUSQ1PkOicvHk3eHlWMPbPgF0qR55nhbej574rYI6OCu2tY:xkjV2UdXvZH0ub4Frddejx4l6ODKmVcn

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  behavioral23behavioral24

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-2b70dd97d36efbbadd5f63afc22e28dc53d26302bae846b4f4e49e27cf95a70f

  • Size

    110KB

  • MD5

    8944e61729e65362b848dcc0268e9ddf

  • SHA1

    b29fd4c60f312d89ee4d87deb2e0a72e7384d8db

  • SHA256

    2b70dd97d36efbbadd5f63afc22e28dc53d26302bae846b4f4e49e27cf95a70f

  • SHA512

    dc50237c10e07f708125e27da1206caa9051b06e55ff0c7dadf4d7ddad3ef1580a91c9d2fdcf48c4e57101ab5ee9574a515a062e704205b5339c4e8e6ea0298f

  • SSDEEP

    1536:FZ3ObRIV3YMZQNbmrC5ByUv6OthlDevOpzLNWQh2QIsexEFHk15Z4vh6fNzxF0gd:FobRIVtZQNbm2fyaosrU8UZ4vQfp10z

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  behavioral25behavioral26

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-4ece7a3cd6313c022ce3d30028a8af4f4f4da6a35efcddb8136b4bb5520fdb21

  • Size

    79KB

  • MD5

    e9e80e0e30405fa4d559d5303c72bf8e

  • SHA1

    b6f3e43efc6ad94f87a36d25d4aa9f495a3af0f7

  • SHA256

    4ece7a3cd6313c022ce3d30028a8af4f4f4da6a35efcddb8136b4bb5520fdb21

  • SHA512

    ceba55d8cd62855d1254257f2c250150b3e08edf0260b907e80b45b5b2891bd9185d0290b945314fcf04c047bcbe1b94eb8a4f753cc7ee1b51575c1afd093215

  • SSDEEP

    1536:3VZUzbOcyyPYvkx1ocD6v4cUqBYZDZ1bXgYqEiR3DY3:lZOtx1ocDncxYZl1bXgFEipDy

  Score

  1^/10
  behavioral27behavioral28

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47

  • Size

    46KB

  • MD5

    ceef7b8296b733da0be864ccdf41ce77

  • SHA1

    c66de07f66ace03ef1e140c8e46525c27df94b04

  • SHA256

    5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47

  • SHA512

    62241a9b37933edd4c751316c9cc8a8b195766d81baab7d5b2ef3a532c464e6d76fe9d781ac94c1aff587052a3d9e18478e509e51313656bc2db2b38df792c70

  • SSDEEP

    768:vqdwSbXx6csbXkOicvHk3eHlWMPbPgF0qybI6QolYI6OCC2tYcFmVc6K:vJbXXvZH0ub4FrybI6Qm6OnKmVcl

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral29behavioral30

• • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.gen-5be5dbcf6753c5607b5c95bf93e71f1d71fcb2c6ff691f949e237bc6df77a34a

  • Size

    46KB

  • MD5

    b0ccfc015178530287777e5feae9a884

  • SHA1

    4b688412891cd85a7dd507134e8d5f7d81163ab9

  • SHA256

    5be5dbcf6753c5607b5c95bf93e71f1d71fcb2c6ff691f949e237bc6df77a34a

  • SHA512

    c837315f3481636872bf642729ebcc9b286fb834099ef488dd8f1f4f5cf589b9a8ca18718ff4a14d1c4ff95c33e29239475dace168156125fdaf85da3b737f15

  • SSDEEP

    768:8qLytbXZ+uuTkOicvHk3eHlWMPbPgF0qoW/0aYaMtiYI6OC62tYcFmVc6K:8HuTXvZH0ub4FrlMaYaMw6OPKmVcl

  Score

  10^/10

  asyncratnullrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  behavioral31behavioral32