Extracted

• • Target

    Innovarteks-setup 1.0.exe

  • Size

    143.5MB

  • MD5

    87c8b487c3903bbc37ba9533680630c5

  • SHA1

    743d43f1d007f06de961b10ed29d861574008ffa

  • SHA256

    be1e902f9a7d42b9f38f93a96f877f4a206a823f64a6bf00f343d9cd00b981ad

  • SHA512

    5ac443a52d0d7780c6bb3831f75579fc8310629f8a906274c3d1b40d955cada2469f7f6723c4be4e8cdaa5feecafcfc34d4b0a3a5a5a6a3439854117c767d02d

  • SSDEEP

    3145728:qP+bSC++4uDXW4HTx+3MEwy+E9MPWzJUrYX5M3gbcKCXoOE23QtlV:W+2CauDXWz8eJ9LzJaYE2C6z

  Score

  10^/10

  crimsonratdarkcometmodiloaderdiscoveryevasionmacromacro_on_actionpersistenceratrezer0trojan

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Crimsonrat family

    crimsonrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • Modiloader family

    modiloader

  • ModiLoader First Stage

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2