Extracted

• • Target

    ad616acb49d68d155b0ded0a269e9f823fda47f9a125e1a3eb8a71ffbd3d4747

  • Size

    8KB

  • MD5

    e618f84aafa47620606982c4abbc7d67

  • SHA1

    6f6e1f34130d3468da33ce0cadebddfce494255b

  • SHA256

    ad616acb49d68d155b0ded0a269e9f823fda47f9a125e1a3eb8a71ffbd3d4747

  • SHA512

    a5de82399c37e6441edbca72899588c5cbf5574968a81a2a4fe02aa5101a51a4c7b07219c92f10255005f2c8fe6abb66e1d493942e7757b6dfd0c318eb01b704

  • SSDEEP

    96:zdXT3QNm17yCqN1BN3CyvI35R0k7+AmRuPKuHVlXxdbyIzNt:xrX7yCqDyyvYv+Am4PHVlXnyK

  Score

  10^/10

  discoverysilverratexecutionpersistencetrojan

  • SilverRat

    SilverRat is trojan written in C#.

    trojansilverrat

  • Silverrat family

    silverrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2