Extracted

Extracted

Extracted

• • Target

    DoomRatBuilder.exe

  • Size

    13.1MB

  • MD5

    5a25fdddbf9c2a2108d6c70478da999f

  • SHA1

    d9c9aad0605a76a443ec1e13fcfdbf2f67e667a4

  • SHA256

    64dbef2a82943ec8cf9ad97177cafe53808586e7a3b39984a1bfd9f5c9b76ea5

  • SHA512

    47a8b80758dcec95671dfd72e41fccb78f9ed04f17f7c7a5089d3237f7094d5029bc10b853da97d6c2e8b5de8bcba09618821e2a4d5d2ae15b6b8e9e6eebe191

  • SSDEEP

    393216:7GV21SQhZ2YsHFUK2Jn1+TtIiFQS2NXNsIX3WabTToj:OFQZ2YwUlJn1QtIm28Inpzo

  Score

  10^/10

  berbewblackmoondiscordratmodiloadermydoomnetwirexmrigxwormbackdoorbankerbotnetexecutionminerpersistenceratrootkitspywarestealertrojanupxworm

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Detect Xworm Payload

  • Detects MyDoom family

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • ModiLoader Second Stage

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1