Extracted

Extracted

• • Target

    search

  • Size

    467KB

  • MD5

    943dced7be9d72fc43811b8c299c5deb

  • SHA1

    3f1ce827c50be7db40402b66c3a5341814cb6e9d

  • SHA256

    9a3ba1ea02e8c045a1e94e2f81c64565122df06f4d1f11018d1902f2adf80127

  • SHA512

    d8da3ba7149277cdb90d63acd29a5f25dd308c83341c15f9b912489161f59cddac91aa66efef22bdbc4cd7d1d43dca47d97c0a833b2317980cad9b9393dd1c3d

  • SSDEEP

    12288:AJ2vyEmW0MyPu3NEl1SmNW732GGSxcbZvBQjmBL6SCuphZ3B9c1DpH4OW9:AJ2vLoSxcbZvBQjmB5CupH33MDpH479

  Score

  10^/10

  dharmanjratremcosrevengeratguesthostcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwareratspywarestealertrojan

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Njrat family

    njrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • UAC bypass

    defense_evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (661) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • RevengeRat Executable

    stealer

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1