Extracted

Extracted

• • Target

    Titan_Crypter_Cracked.7z

  • Size

    17.6MB

  • MD5

    55a7f8f8b28c1ab8eda552de7071b75f

  • SHA1

    8da38fc369c78d2f972c599631e4c3dd1032fff6

  • SHA256

    483c6ff2b0dff0d91196eb8cdb4a4cf67d6ead53b1645bc03cf7b88f8da5e22b

  • SHA512

    010e9d7a6c012123b2c05e8bb4411e72478c05223d3ec143ac685107405dcc6db05e779799f8db691b77bf93356a2644a5ace5a06daeaf1ce5165302c20d80f7

  • SSDEEP

    393216:v1S0Cxjjva2q3vgQ7Pb75AYTSn7oQMJ08gHAyZJN1uSge:9S0gjG22vgQ7T6xn1MJdGAyZJCW

  Score

  10^/10

  neshtanjratstrratnyan catdiscoveryexecutionpersistencespywarestealertrojan

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Njrat family

    njrat

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat

  • Strrat family

    strrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2