Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    brhu.zip

  • Size

    5.2MB

  • MD5

    b4beead5a110d9ce24b1c26fa41e3e99

  • SHA1

    b2e873487c4d90447d923b3b6b89995ffb456b8c

  • SHA256

    a1356c9f60766482ea7590a16225a6a13497387345741da43d7cd5f33ab47576

  • SHA512

    8f701a85322980c28f0742ff6b4ba549eef93c0462cfc27d56517d1d210c4016ebbe5ef064fa5346c65119dadb2916de04e5be4f689f4c2f68a949f2e9bd617b

  • SSDEEP

    98304:taptf7h03fmRwldsRLvP43G9B7JgnZX0XRBx9dLCHi3mKJ2cWTju:tGf7jko4olEZX0L7dL2i37ncu

  Score

  10^/10

  darkcometmetasploitnjratxenoratguest16zula hackbackdoordiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Detect XenoRat Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies WinLogon for persistence

    persistence

  • Njrat family

    njrat

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1