Extracted

Extracted

• • Target

    ff8addf2b89de210fa350138a30eaa67a5772f59dcd0480ffc9d339e7cdd266f

  • Size

    2.9MB

  • MD5

    01fc40917e3e56267e23bbcc3225d6d0

  • SHA1

    68a8782da431eddcf7ad88699580a7f034fffbe7

  • SHA256

    ff8addf2b89de210fa350138a30eaa67a5772f59dcd0480ffc9d339e7cdd266f

  • SHA512

    33d394bc795b96f815d47df8a382d720bfbb8b2d5e9288c868d83ff25712cd32737f1bf868f9ba238e72112b0cc425af538d3bc226267b38213fb364998b344c

  • SSDEEP

    49152:cu3XPRmBGiOoYcCeQE7Wq58ctIgktXub5PnyzMezAvKjGM76bfvgAz3:NXPR5JCyq5ptktgdn2RAvKjV767vgAz

  Score

  10^/10

  njratredlinesectoprat544363603hackeddiscoveryevasionexecutioninfostealerpersistenceprivilege_escalationratthemidatrojanxmrigminer

  • Njrat family

    njrat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Xmrig family

    xmrig

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2