Extracted

• • Target

    DoomRat.exe

  • Size

    12.1MB

  • MD5

    0cf5c5253e621e56587ead9ccf6fc23c

  • SHA1

    0f3d67f82bf309ac7ac3df68a78be948c12a0cad

  • SHA256

    2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404

  • SHA512

    6fcf003361c4e53eea1ff32304ad765e76d92e613d94515008e3dc291008fcd76809008f1436dbe202bbebf762286551b001e534c6626ba0dc9062758a0c8ed9

  • SSDEEP

    393216:tGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:0YQZ2YwUlJn1QtIm28IKzo

  Score

  10^/10

  berbewponybackdoorcredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceratspywarestealerupx

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Disables service(s)

    evasionexecution

  • Modifies firewall policy service

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  behavioral1