Extracted

• • Target

    CraxsRat V7 2024.exe

  • Size

    246.8MB

  • MD5

    24b827932180dada3df8f7417a91a5c2

  • SHA1

    ba92d8de3343b485a3ae1befb0d489f6d9dd0f54

  • SHA256

    9cb983375ea370f0fa4fec1c0a9bc651061f06dde45913975a7cc9f2a8a9f3a6

  • SHA512

    9d67fdd28ef8dc24d4b4a446c023013fd6f48df745b6baf01a0c24d7aa6dde6a9c81e5261c72d5432938b34e0dd63393d284d030058acbdf20056f305ae023c4

  • SSDEEP

    6291456:hihtoRlGsLH5Lk1bjt7hPNMTl9bCWbolUwy/lZs7UUDdluDdjt:hizKjLZLKXthPNOFCxl0lZs7U8luDRt

  Score

  10^/10

  nanocorexredagilenetbackdoordefense_evasiondiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2