Extracted

• • Target

    calma.msi

  • Size

    4.6MB

  • MD5

    27708977fc83f3b70177d6cf68900eba

  • SHA1

    f679bb77e2876b17da2276017df6cf252aa5bd22

  • SHA256

    ec3ca0877e599ae9c40cbcec51a9a4718114e33d9e2d9d8c72f5f24d7cebdcbf

  • SHA512

    831ccd1e4fdda16ff7cd16096e3291b9fa986f814e56aec9d8d0c6a36ae402002940a9d9aa7c1c5c8cf1b8e65c2d9ee529956f9cae3832e513a37bff3839c8ac

  • SSDEEP

    98304:HYVK/AKIN29ryVzg+Vho+5d67amiFP/0hnJRZuq2sDSq5Fwfp:G29W5jmih/0xXLFm

  Score

  10^/10

  discoverypersistenceprivilege_escalationbruteratellatrodectusbackdoorloader

  • Brute Ratel C4

    A customized command and control framework for red teaming and adversary simulation.

    backdoorbruteratel

  • Bruteratel family

    bruteratel

  • Detect BruteRatel badger

  • Detects Latrodectus

    Detects Latrodectus v1.4.

  • Latrodectus family

    latrodectus

  • Latrodectus loader

    Latrodectus is a loader written in C++.

    loaderlatrodectus

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2