Extracted

Extracted

Extracted

• • Target

    DoomRatBuilder.exe

  • Size

    13.1MB

  • MD5

    5a25fdddbf9c2a2108d6c70478da999f

  • SHA1

    d9c9aad0605a76a443ec1e13fcfdbf2f67e667a4

  • SHA256

    64dbef2a82943ec8cf9ad97177cafe53808586e7a3b39984a1bfd9f5c9b76ea5

  • SHA512

    47a8b80758dcec95671dfd72e41fccb78f9ed04f17f7c7a5089d3237f7094d5029bc10b853da97d6c2e8b5de8bcba09618821e2a4d5d2ae15b6b8e9e6eebe191

  • SSDEEP

    393216:7GV21SQhZ2YsHFUK2Jn1+TtIiFQS2NXNsIX3WabTToj:OFQZ2YwUlJn1QtIm28Inpzo

  Score

  10^/10

  ardamaxberbewblackmoonmodiloadermydoomneconydneshtaurelasxwormbackdoorbankerdefense_evasiondiscoverykeyloggerpersistenceratspywarestealertrojanupxworm

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax main executable

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Detect Neshta payload

  • Detect Xworm Payload

  • Detects MyDoom family

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • Neconyd

    Neconyd is a trojan written in C++.

    trojanneconyd

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2