Extracted

Extracted

Extracted

• • Target

    DoomRat.exe

  • Size

    12.1MB

  • MD5

    0cf5c5253e621e56587ead9ccf6fc23c

  • SHA1

    0f3d67f82bf309ac7ac3df68a78be948c12a0cad

  • SHA256

    2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404

  • SHA512

    6fcf003361c4e53eea1ff32304ad765e76d92e613d94515008e3dc291008fcd76809008f1436dbe202bbebf762286551b001e534c6626ba0dc9062758a0c8ed9

  • SSDEEP

    393216:tGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:0YQZ2YwUlJn1QtIm28IKzo

  Score

  10^/10

  berbewblackmoonponyvipkeyloggerbackdoorbankerdiscoveryevasionkeyloggerpersistenceratspywarestealertrojanupx

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Modifies firewall policy service

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1