Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    DoomRat.exe

  • Size

    12.1MB

  • MD5

    0cf5c5253e621e56587ead9ccf6fc23c

  • SHA1

    0f3d67f82bf309ac7ac3df68a78be948c12a0cad

  • SHA256

    2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404

  • SHA512

    6fcf003361c4e53eea1ff32304ad765e76d92e613d94515008e3dc291008fcd76809008f1436dbe202bbebf762286551b001e534c6626ba0dc9062758a0c8ed9

  • SSDEEP

    393216:tGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:0YQZ2YwUlJn1QtIm28IKzo

  Score

  10^/10

  berbewlatentbotmetasploitnjratquasarwarzoneratxmrigxwormhackedaspackv2backdoordefense_evasiondiscoveryevasionexecutioninfostealerminerpersistenceratspywaretrojanupx

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Detect Xworm Payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • UAC bypass

    evasiontrojan

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Warzone RAT payload

    rat

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral1