Extracted

• • Target

    aquatic/crack.dll

  • Size

    5.1MB

  • MD5

    fe7dc4218e47f5c31e7a2db9b2e55ddd

  • SHA1

    6d30688097e87755b5d59429e5dfb9ce0562f931

  • SHA256

    1cbaa9f954edae2e9a6ccac8e0119ff533ee01b42b1bb24fa10adfa80064b780

  • SHA512

    922048e800411cb7f21618647b88b0d8b5c98aa45a55eb8ab66a838f3900bed6e03cd247e27af0b304bd4b71fa6402d1b88aa320aa4c23a42088a1617dac73c7

  • SSDEEP

    98304:ZvNYCYPKFV3CIz5igBo6qO90Pqp8YVH/6yG/fdmjLdGGf:ZvyWLNia90S7iyb

  Score

  9^/10

  defense_evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1

• • Target

    aquatic/loader.exe

  • Size

    5.2MB

  • MD5

    c136329a989aad9543c913f9197a01fe

  • SHA1

    0b3bdab50947cf330243938c9ccb3e685c43457b

  • SHA256

    9b802ef1b1e58a521a45dbd45c48c75c5b7f9ac53b273d6d2cf868c1f6d46885

  • SHA512

    fa7a7efa10b4da760b7d281aa235fa4bb4ce28d12796f28632fd653ae184a6f09bc796c18ba1aa3253f713af0334d97f040dc762a8a1d25352dc7308d49b8590

  • SSDEEP

    98304:fKYhdZRJ8os9WXz/DsEAE4SfTQ3+5wJCn9cK4KwrUWxeNVSreDGknLjiSXBI:CYhdo0D/D1J8+mM9Y/gNIsGkLj

  Score

  10^/10

  njratumbralxwormdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Njrat family

    njrat

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral2

• • Target

    aquatic/main.exe

  • Size

    24.1MB

  • MD5

    c4639a9dd4fa418a1e2e5537b9a53bfe

  • SHA1

    9fea0f4615170667aa59dac92f6d424455b5fc54

  • SHA256

    6548853e51522d28bc2d4ee6dbecdfe7be496462cb87f26587f830374ce07ec7

  • SHA512

    2e5f53a2d4bae0028ecb715485327db9da7aeb45176e7e54db039516dab6002f41b5f44ae728f7752ee840f34b14ac78698cea3bc4cc2d00ea815873bad6b692

  • SSDEEP

    786432:8Ljr7FsBzlI0ecXYc1xk/cBFG8zv7NRDZPA:oezlI1kLxJBFGu7HFY

  Score

  7^/10

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral3