Extracted

Extracted

Extracted

• • Target

    DDOS TOOL.rar

  • Size

    5.2MB

  • MD5

    01abc57a648bfe6c15d0e60cee8df24d

  • SHA1

    6879b1d3f182d046297a5a51e4629ac79e8eb9bb

  • SHA256

    cc955efc8aaa3c26caa9b57604ee3bb2aa4039b946b8c2aea8e7d2579dab18c7

  • SHA512

    9776436a6f4d0a61ee92d12955263ab6a7d40e86e79929956af8e314cb34a262e32efc46a2f11d09815dc8ed64d1fdda62cc42bcb526dc8dad2c5fb4ae0002e6

  • SSDEEP

    98304:c+D78yvHmfPHf5ra0SobmnJolavV9sR/1ZfoW5Uxx5gw:c+TPE5rT6nKlS9E9a5gw

  Score

  10^/10

  njratumbralxwormhackeddiscoveryexecutionpyinstallerratspywarestealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Njrat family

    njrat

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2