Extracted

• • Target

    Amnesia-Tron-Brute-Force.zip

  • Size

    44.2MB

  • MD5

    c00cd547d7ea265d9b2e94b828561ef5

  • SHA1

    7e925b5234e65328f6718aa2d476acc1f8ec1494

  • SHA256

    c51d575a8c3d2cd41342b65788922ae5c17463104bb85f69905067a81da233ba

  • SHA512

    2a30027812057ecbd06fe56e650a45bc247a968df5f50715d90366610d432cc8cce3291fab214d74fc25410d958c04cecb8c9bb2883f4e3be41594d961f9f754

  • SSDEEP

    786432:Q8esY3XliX8OsYwDkaJPO82DIc7/WyWGmWvta8fcgzxLuaTMh8:Q8et34X8OtwDksGb0mW1Gmp8xxygMW

  Score

  10^/10

  gurcumilleniumratdiscoveryevasionexecutionpersistencepyinstallerratspywarestealer

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat

  • Milleniumrat family

    milleniumrat

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Contacts a large (5331) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2