Extracted

• • Target

    Win32.KeyPass.zip

  • Size

    1.3MB

  • MD5

    f831ffa7faa4da66482aa252536e1b0f

  • SHA1

    aa305bd6962ebf06e26462d25140691585f85341

  • SHA256

    8f8f3834abab12ebd792487a89e45bdb8c8f41b51f232dfb3edb8e8140c9ff8f

  • SHA512

    3bf39aeb6c52de76aa864fb7d810cb4adbd2c7e0a2b91e8b6865967843044d628ca66a4531c720e5cd75dfb82a371e467f823819c0d9d559bd371efeec1d962a

  • SSDEEP

    24576:k5yq9y9qttzFVPyDcYwohuvh0GsGkjHkevwLfK4uiIP/nMPbcdKK:cH3FVP8hphuF2Hk1LfK4InMLK

  Score

  10^/10

  revengeratrmsdefense_evasiondiscoveryevasionexecutionlateral_movementratstealertrojanupx

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Rms family

    rms

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • RevengeRat Executable

    stealer

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Path Permission

    Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Stops running service(s)

    evasionexecution

  • Modifies file permissions

    discovery

  • Uses the VBS compiler for execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Gatekeeper Bypass

    Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.

    evasion

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Password Policy Discovery

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3

• • Target

    Win32.KeyPass.bin

  • Size

    2.8MB

  • MD5

    6999c944d1c98b2739d015448c99a291

  • SHA1

    d9beb50b51c30c02326ea761b5f1ab158c73b12c

  • SHA256

    35b067642173874bd2766da0d108401b4cf45d6e2a8b3971d95bf474be4f6282

  • SHA512

    ab883364a8907636c00a4d263670cd495d0e6c521283d40c68d47398163c6ee6647cfbbc2142005121735d9edf0b414ddac6ea468f30db87018c831eaa327276

  • SSDEEP

    49152:0u1ImfQE5L1PtWHeHoQAOs1dKvHHg/o2S1pj798JGKCO8C/eZRwCr:dzV5JPtWHeHoIs1dGHHx2S1998JGKCOC

  Score

  10^/10

  credential_accessdiscoveryransomwarespywarestealerpersistence

  • Renames multiple (9818) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral4behavioral5behavioral6