Extracted

Extracted

Extracted

• • Target

    RNSM00452.7z

  • Size

    154.2MB

  • MD5

    a51b6e3f4c11032eb72fa4919ffd361b

  • SHA1

    5dcce1b18af81a7a29b78d42c0a7fa4aa6c76d59

  • SHA256

    f4a36624bc6e4f44a63cea12250bf3e1d076ecd34c6e40db1637dd35b43e4fce

  • SHA512

    082eee741b2cd19ea7a22a709b2f211bf9395867481b50c7c7931be35bca5b220a3e2f6d1398dcf7d3a260b002736b588070d5f3c60ffcb6ac1eed368fe03667

  • SSDEEP

    3145728:da7Y6grXgeK+IDG8BTMzDTKhBK4PnNgsSeSX/+Zp1o7ll5et8lmShOr:gY6okFBKDKP8eSP+ZPWllsuq

  Score

  10^/10

  agentteslachaosnjratgrandhackedagilenetaspackv2discoveryevasionexecutionkeyloggerransomwarespywarestealertrojanupxvmprotect

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • AgentTesla payload

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1