Extracted

• • Target

    Antiexploit(1).exe

  • Size

    4.9MB

  • MD5

    72982e4d77aaee2ef6d16876037b3dbe

  • SHA1

    bfffbe69bfc0cb1fb5e23199dba5ea69c4f3d9df

  • SHA256

    bbe1c2a2af47b4e32fa9b6e8a44da455473604bd1aae5481524403f878a86662

  • SHA512

    cb28f33f6c3acaa74ddb3e9f50922e764926fbf2b8a3d7317f13b57f6f30e259a5a8b0213c77dee27cf542ad860762909c1f46f695f2b2c45bb778de957f02db

  • SSDEEP

    98304:ubFDbY4GLfSbFqhmSPEE89WS9mi264mZAWto1pUluT:u5I4G2beL8t9WSK6Njto4a

  Score

  10^/10

  dcratorcusrobloxdefense_evasiondiscoveryevasionexecutioninfostealerpersistenceprivilege_escalationratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • DCRat payload

    rat

  • Orcurs Rat Executable

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Hijack Execution Flow: Executable Installer File Permissions Weakness

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation

  • Drops file in System32 directory

  behavioral1