Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00454.7z

  • Size

    84.9MB

  • MD5

    391bfe45681ded9a5a7e7e6063727629

  • SHA1

    120937367da31f9558cba1dfe7b8aea5b6575da2

  • SHA256

    f3b6d60a35a32fdd5258c1e11edc9ce65df5e892a33481dcc6c726600b2110ee

  • SHA512

    0516ccd2112ec0c160b05eeb4908be69de658d251d88eeab2b4cd753a65df5281c2e2d82ac849d17abff846081d599d6da862e4304467f536cb2133d67448da8

  • SSDEEP

    1572864:LmS6K58FcJehSSkvcD//V3XqtTCkBHkiDLkyrk38ezJ6uT5r1ZP5T5zSGj/b3hI:qSbxJUtzpQe8oMk376uTV1ZxTwmbO

  Score

  10^/10

  asyncratcrimsonratgandcrabmafiaware666njratnullmixerorcussnakekeyloggerdefaultnullnyan catagilenetaspackv2backdoordiscoverydropperevasionexecutionkeyloggerpyinstallerransomwareratspywarestealertrojanupxvmprotect

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Detect MafiaWare666 ransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • Core1 .NET packer

    Detects packer/loader used by .NET malware.

  • Orcurs Rat Executable

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1