Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00440.7z

  • Size

    83.7MB

  • MD5

    075245de36e675fca5b3b7bbbe2559aa

  • SHA1

    1c194f80535d39509f318bb6cee62b904bd3ec7d

  • SHA256

    3505d0b242e1b4ffa9d11c5769494ea7314ec48dcb27b1b34900f60a10430249

  • SHA512

    052d0c44f6d618b4a3ceaae700f7d0fe4fb720965e797c210d9d1fab6e75ff0b905ca2a0dd6cb7fe2838c7f835f89e2a9b23522c7a5c5d09f531ded6f02e3a91

  • SSDEEP

    1572864:Fr0PvDw4YpeQwkYquZmWyVbU2lGzZmPA7IGIxjumOahRDjPAT60olU+SbBWvDzF9:GPrBYBYqVWyVo2lGVmAkZuB8NE6BlU+J

  Score

  10^/10

  avaddonconticrimsonratdjvugandcrabnetwirenjratprometheusthanoszgratagilenetbackdoorbotnetdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationpyinstallerransomwareratstealertrojanupx

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon

  • Avaddon payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Detect ZGRat V2

  • Detected Djvu ransomware

  • Disables service(s)

    evasionexecution

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Prometheus Ransomware

    Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.

    ransomwareprometheus

  • Thanos Ransomware

    Ransomware-as-a-service (RaaS) sold through underground forums.

    ransomwarethanos

  • Thanos executable

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Clears Windows event logs

    evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Downloads MZ/PE file

  • Downloads PsExec from SysInternals website

    Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1