Extracted

Extracted

• • Target

    dontrun.exe

  • Size

    10.7MB

  • MD5

    5520edc0639334d87e92c2b53e36803d

  • SHA1

    3e7c547fd3f437a7fe4c09c8767dbcc5118d3dcf

  • SHA256

    4a1ed7a206b3c4aa83b3c38f9a8f68cb5b875702afdb240b7b307616519bd0e9

  • SHA512

    0824441ad3fd96aef8dc14ba89cf1d1f8ca6d513b89181b8d4b00803d2b64462c1da66ff52ce2a1e6726e80845e29c6694149a1c1a3d0177b99482056dc5b1dd

  • SSDEEP

    196608:rqzv86gV6rbQQOOl2szsHFUK2r7UyTAdQmR8dA6lS8Qnf2ODjMnGydS8LrBOCRWs:yWVehZ2YsHFUK2JAdQJlaF3MnG38LrBR

  Score

  10^/10

  berbewblackmooncobaltstrikedcratfloxifmydoomsalityxmrigaspackv2backdoorbankercollectiondefense_evasiondiscoveryevasionexecutioninfostealerminerratthemidatrojanupxworm

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Cobalt Strike reflective loader

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detect Blackmoon payload

  • Detects MyDoom family

  • Disables service(s)

    evasionexecution

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Detects Floxif payload

    backdoor

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Stops running service(s)

    evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1