Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    DoomRat.exe

  • Size

    13.1MB

  • MD5

    6edaf9dbb1f9426909264824021cba05

  • SHA1

    24bd6481d35ec036a487d3da299f6ce3b417a511

  • SHA256

    e7723e324e357744eff9f182753e352845687e6fd3d1e9ee8eb6655fe8283cd4

  • SHA512

    9deaf0c6dfe74e3f155798bd66830e0dbbc9cc4d389518ae64b64712a78780e728a4c613c60775a1afd52216299f91f77c7609693f6a7631da39b607a3734d28

  • SSDEEP

    393216:uGV21SQhZ2YsHFUK2Jn1+TtIiFQS2NXNsIX3WabTToj:5FQZ2YwUlJn1QtIm28Inpzo

  Score

  10^/10

  ardamaxasyncratdarkcometfloxifgh0stratlatentbotmydoomneshtasalitystealcxmrigxtremeratdefaultdomahfaspackv2backdoordefense_evasiondiscoveryevasionexecutionkeyloggerminerpersistenceratspywarestealertrojanupxworm

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax main executable

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Detect Neshta payload

  • Detect XtremeRAT payload

  • Detects MyDoom family

  • Disables service(s)

    evasionexecution

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects Floxif payload

    backdoor

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1