Extracted

• • Target
    grger/Anarchy Panel 4.7/Anarchy Panel.exe
  • Size 34.0MB
  • SHA256 0e3f65457656e1c83c76cf2838bdf6aae294157a4cd7141fdea868b5724a75a2
  • MD5 309d8906e1e32e2a0c1db6310da96d73
  • SHA1 e6141cbe0a7095260b41553281fc547191398cf4
  • SHA512 f207dc50cf5aa452b7fd802087b0569b82bef7ac3110e71186b2c4de2a7bd213e0269dc4b4ca1c0aecddd488d7508515716f731a471e79b31b80ef16b3c81e67
  • SSDEEP 12288:hQXqRba8sXrA1gqWVOmw0dKcaJzkVCp4Lkuc+tSV1pH16oG8HCdIfe+:hQXqsi1OOYdKcoA5kp+S/1JGvdIfl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratdefaultdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1
• • Target
    grger/Anarchy Panel 4.7/BackupCertificate.zip
  • Size 1KB
  • SHA256 ccd0799092fe1e044079faa06fd4a671da251891f8db9690bd129ff9ed136a7c
  • MD5 8da0fbaf4f6b8f458035f236ece7b7ca
  • SHA1 cc143922fa39226c8b35cbdba0d8d021b188f2ae
  • SHA512 25c5bb6dfcc1ca5bf18196e8a79038353c262d6fa562b0b7e559e0937adb29591f377737c4a8cd0516f2508f044f1e8cacff155e158c923cdddd89ed7438fc2a
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral2
• • Target
    Usrs.p12
  • Size 1KB
  • SHA256 d6bb01668b946fbf19ab99771d942a96cebcbb98d521722091e17d98925fa2cd
  • MD5 2a180e4131ced95c6586902e5c0a471a
  • SHA1 dde87d3d927ebc294854fc0f7eaee7a1735fb729
  • SHA512 d936e546114af9f1ce6de1163eea8a40f0f8c15c5bd8f91488e72bb2ac541a0920061fef252db6c8b3c12598b5c75e3522b08b6f47d57e1ad3f0f7c060a7c979
  • MD5 SHA1 SHA512

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  behavioral3
• • Target
    grger/Anarchy Panel 4.7/Plugins/0guo3zbo66fqoG.dll
  • Size 78KB
  • SHA256 9661b1abc9a3e95e591c49c3838a64a066a2ff3c6de08d8aa7b541c4a75cd8e5
  • MD5 e4ebcf76ff80ef398d3ab77d577f4c08
  • SHA1 cb9e6b30a63d50ae87610f6855b64abfb25691d2
  • SHA512 8f37cedd987dd14181fdfa861b8a95271868dac21aa9df80bd6daa831ae20f4b4965c8be3e36f32aa220bd37ded11a7568ae237c9c9641bb4fc087f6fe104b01
  • SSDEEP 1536:+gqK9OLThWUkwSOykrJROOwj5vCSnVcnwwxu8NMsuS73O4VKid/:1OBX/xFwj5vCSnSwwjNH3O4xd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral4
• • Target
    grger/Anarchy Panel 4.7/Plugins/59Zp7paEHDF7luJ.dll
  • Size 4.0MB
  • SHA256 5db4c26057a05bb75ff7892fb60fd76620fc2228811d913d152a0aa4ec9db7a5
  • MD5 15e3d44d37439f3ac8574ac1c9789ec2
  • SHA1 bb3ef30e9f4496198f412738579966210ade36e0
  • SHA512 ff358c9896792017ff7e91f1dedffd9d75a099c5b852da19599799aeca20b6b269267ff7c12c918a2530fe1a79a12bc8796c4eb3914c97faba3eba27388abde1
  • SSDEEP 24576:L2RBtpr5ljLyeVKbed1BeaPc9oFf/V5V4IeDHRbtg58jVh6zBRkM8eJkhjpSLZFb:L2jXr5ZtVKYzX/LV4k58M8eJkhj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5
• • Target
    grger/Anarchy Panel 4.7/Plugins/CjETR6GpGXqM.dll
  • Size 395KB
  • SHA256 13db80a0211ba9bf59a1e43bdb2fffa91de5c7f38bd469c4824b5e06245a0234
  • MD5 b0fc0ba80f8ec9586ff397412c512d9f
  • SHA1 0f6051b71b715a47be1fa16683201413905629a3
  • SHA512 222a365ae567c6c773ca2b99b82795916839cc5c9ba8eb019bf6713108720c2793303ef6612b64488f4584602cec84c0b48a02fe709db0250bf377d07e002d7d
  • SSDEEP 6144:BH8ns56MGHSsdqjJiulCcVWiUpG9kxwrIfUKa:kjjSsAjAuYcVWxpG9ia
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral6
• • Target
    grger/Anarchy Panel 4.7/Plugins/EVa7gBMKoaHmLC.dll
  • Size 170KB
  • SHA256 6ea1ae7ab496666c0117fc20e704bfb6104b13cfb0408073a09689f863fa64b1
  • MD5 64a3d908b8a5feff2bccfc67f3a67dbd
  • SHA1 a17d7e5fa57c99a067cac459cb507b625dac254e
  • SHA512 66374d720230799bea6ac6cfe3faadc37fd775a49d40c04facae1caf1ec658956bbda54ba75287d7128b19b97971bd933a64469da8e0884225c5a8d8b9423ccc
  • SSDEEP 3072:/bFHKx2Vpgdk6BCNs19kPVoPsb7oR4ZkvEfxMxf4t8BkVb0Uc:/TVpgdkpNs19I6Pe7oR4ZAEfx+LiVb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7
• • Target
    grger/Anarchy Panel 4.7/Plugins/FBSyChwp.dll
  • Size 170KB
  • SHA256 0ea38d0d964815e2b84748a78bd5a829ae01586478e5f17b976f1ae763c8dec3
  • MD5 0d41ccfaa8e7ef96248b8270d1a44d08
  • SHA1 6ee22bdb91d3a18e0b45b6590eb69bc9a0b02326
  • SHA512 a0f236f6dbeb1763fb1c198616de65b907a3a5edf7ed9435c2ad0b5826d84e9d2f25e96aba4e8b681ef495612cf0e04e929427a92d332164ace89e797bcb0e0e
  • SSDEEP 3072:OXwOuoHBhyYr+x5IA+1gUtaEKJ8px4e1hkamm9RyxLeN/dIfMU+:awOuYr05T+KUtaEKJ8px4e1RmqRydeNd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral8
• • Target
    grger/Anarchy Panel 4.7/Plugins/G3nl0mDcABnDuZ.dll
  • Size 177KB
  • SHA256 060d467cbeb0a58696287c052f3dd9b3597331b1c812e3e2882d6c232f8511de
  • MD5 97b8bec4c47286e333cc2bedacf7338e
  • SHA1 764bbd0307924b71ca89538b42996208d10c9b91
  • SHA512 a40970622a594533349e75fc2022314ba21f05fc82709d6eaba82f4a2bc343c960029ad2825cfc034ce82622722127d149993bff88982f02d6dd6b5b1fb60fbf
  • SSDEEP 3072:EaEk8xLhWuo2alMFVxzPUBvRNHosrO0/1gRR0foQPssGeWSz89:EaEk8PRo2al0DzPUxvHtrN1gROffPfGl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral9
• • Target
    grger/Anarchy Panel 4.7/Plugins/KNTmoSnG.dll
  • Size 670KB
  • SHA256 300a5551f7be89c5f03c0b70fa7dafb7f84c6394dac68bee95169e985e7786f0
  • MD5 738c096a9bc38e21a9aa59ebc356c80d
  • SHA1 139756ad201a537461a6bb8524a4b89a63b1b1b9
  • SHA512 294c34f0716861fa67ba571bf7a8614613a1746e9f2935ba0c86eb1897dff858ea1f7fb44f1b6ec87cc709f4933a912dcd3eadd5d0b208c72985aa47e1f214f2
  • SSDEEP 12288:SMmHl7LUg++x95WlkM9qgrXCEhUhWiUQpTQCyXZj3vlDV+z9BI2NHvfJa1tzh66w:AHl7LUmx902M9qgrXOUQpTQC1m
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10
• • Target
    grger/Anarchy Panel 4.7/Plugins/PK0TcnqTGFagQTS.dll
  • Size 174KB
  • SHA256 991fc53fa1aa7b5cd0b6e19dab536873d68e4413fd55b533601a3a2582d38a49
  • MD5 fa90a2aee0d172000257c4faca31237c
  • SHA1 b317281b4acaaf1d7b7255c5e92887322abae892
  • SHA512 b05c0b52e011089258ad31dd23a1f8a0cc8145b202e42e2a9d4fdf892c12d4a7b5843cc7721041295ab796e8bc98747b9e321c4e54bfd1a7c9a02dd2796fc405
  • SSDEEP 3072:Z60dHpQssTFrcpvZFlOJA3YCVbbME5f8YpIVbltkksqBRbRw:xPsZcpvZFlOJA3VVbbME5f7pIVbTkkZJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11
• • Target
    grger/Anarchy Panel 4.7/Plugins/RssCnLKcGRxj.dll
  • Size 181KB
  • SHA256 e204d15f0e7269d364157aaab265a5dfbe7e76c9f6202bf90998f0edd77ca248
  • MD5 f6808c4fbbe0275db03b2cc5b4c2bc0d
  • SHA1 e40b61c64c68f72fc5144f5057d54229babdecf8
  • SHA512 f077c49f6943d0e40799b3b42d1e11f50dabca48305c36ef2acd3258c990e0e0f982fbb0c27b1243aa15d2ed7b398b70f07dddc9ba76ff032ba74a24c8e08fb4
  • SSDEEP 3072:P1F3B6k7/u/cVnvqtXEIGyv5LBPcwk4V9KIgBH/cNw5/UzUYNv:P1F0kDu/+WX8yhLBPcwk4SIgBH/Yw58P
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral12
• • Target
    grger/Anarchy Panel 4.7/Plugins/WkUP83aP9CABpi.dll
  • Size 86KB
  • SHA256 a74b74f463d567c1f0505bddcd49ed23700f9ab7dcf4b7f46435723258c5a7e2
  • MD5 8dbfb67c059aa59f7c53e20ef6740363
  • SHA1 3de96e7f48ee7647f5a7c2efb68cbd914bc78364
  • SHA512 70aed01375416e2be63d676bbdba58c12ba5f50d406d1fe252e7a66b901d32e0705007dbf465193de51663174c1b53bdb980890d8b2e6ce641dd16a200e3440d
  • SSDEEP 1536:ulBCsewAj5RhvBY/0g/+DP0yUXEVg+g6SAKJMT05eUv:6CsewGdvBsjmwj6g+g6SA+MT05eU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral13
• • Target
    grger/Anarchy Panel 4.7/Plugins/eMTYbTz0gueNs4.dll
  • Size 1.1MB
  • SHA256 929e5f15e9ceca03c80b2d174283cb25bf47adfe4693f5c01f622416c9f6d03c
  • MD5 5dfbcfbbf9e2ae7db23e252808699ffb
  • SHA1 a1d429292fe73aeb5abab10304e1ae8c1262b26d
  • SHA512 9ee63080781577e0d818a27d026024f96161bb7b132dc0c130fabbe2d6c3b7758868fff5a4ad68efeb4d08f964e2f69417022751880a443f7f920aa4f40f5c09
  • SSDEEP 12288:s9StwoSI6P2FNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbS:tZSFPMWOe0jywNMB9ccFd7mZg4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral14
• • Target
    grger/Anarchy Panel 4.7/Plugins/fzAgyDYa.dll
  • Size 79KB
  • SHA256 f855353a618af8a53504b5188c05d3a09fb1ff85763e0cd15c53dee82d7c6119
  • MD5 a5770798b7a6465f5b5a8c19d7d707ee
  • SHA1 ca67e9591d2f757cbbfacb55f27aec6485b10ee6
  • SHA512 64da7687e83c6ff4d1c1cdc644ffff53333f745e82f169beb529d55ec5be6f21658d27c6e01744147c00f834978260e86ea627a5f2981f27305afb69a7b467dc
  • SSDEEP 768:VARgmh4b8mzujnHzq+pu57BSsdIPn7rDVNS5z4TyEWkZI9aJ+G247U33fEqtHzWT:VogClTToxxeq6ZXwvEqZaXcI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15
• • Target
    grger/Anarchy Panel 4.7/Plugins/mGWHaG2Jn.dll
  • Size 81KB
  • SHA256 2bde0293c982fb6266c683ecaa2c90372d26d9a2786726874a2cfb89dcc68324
  • MD5 8f98206f577160f950d456d1190c8d32
  • SHA1 defced38fce00775c4616b420fa674d77f946eff
  • SHA512 432c2b6759701754616273633c966332e718dbb10a9a7eab0d7c57ffdc9be95b5e1b16b6e291301ac7aa6d1de48a46d30f08729e45d6634b1849f41c78e92d91
  • SSDEEP 1536:xDj7e8U5/QWCwxi4ao02nK20TSMErl4D/D:xDj7e9/xxi4ao02nK20TnErl4/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral16
• • Target
    grger/Anarchy Panel 4.7/Plugins/mML6WKMqdxjDGA.dll
  • Size 173KB
  • SHA256 778877431354a9584325dadb663be077f757227eaae8bcad33e4bf26efd6b965
  • MD5 e03b206eec8a7efbd1a47909071226e5
  • SHA1 21163989ea524920e874bc7932adfcd5e94f854e
  • SHA512 831ed74419f1b4c3250fbff20be16ed7058a851d7168a17e8a4dcf284a19412feee42a8c198af34b37571de33a80c48ac855f5d018ea9e2cfdcd846b832155ff
  • SSDEEP 3072:5nkYlKsdY6RwiYNF7Bs2GEEg+9D8RZW7iKcnQy/dh1CWMEPrhBSepT/9HxW2Je:5nkrsdYUwiYNF722GEb+uRZWhcQy/71H
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral17
• • Target
    grger/Anarchy Panel 4.7/Plugins/oYsKwDG.dll
  • Size 4.8MB
  • SHA256 54ec206c8fe8ff27b3fb02ef892b8e6bc4b6abfff2fe08f5f57175c64f1d3220
  • MD5 a718955297276f2349b7644447736e08
  • SHA1 377388d115b77aff357dcaf92b6aeb6286b1460d
  • SHA512 a3c2ded0cdc4e62adac92a569d6cd4db0c3647e663700f019a9de27e738eb2672e5cccec19af15633a3cd25a882452ff5ce39c17f67dc3ed6653b9e0ad063641
  • SSDEEP 49152:LOKHt76oI7m3G7WdJh9BUJYzGH1y+Lwo4AeXIGZl4k9uncQZGaV4p5Gi6g:6434edFu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral18
• • Target
    grger/Anarchy Panel 4.7/Plugins/rNXXgmX25s.dll
  • Size 1.5MB
  • SHA256 b93374fdfd9af786ff20597ae0e242b81373984ba5718194f9e57feb231c52cf
  • MD5 050f07b46987eaf152aab521c0112fc4
  • SHA1 2d2c0943ce9c10ba09b0d5cca54c2a88a1e61e95
  • SHA512 a27c370e40ec126b6b9f3ab7d603378c2b629ec752aa8fc57a10e3ef58c0b701a5d1b4903a17ba180c4e73e76b54304f0868c474eb60e671562d0deed83a18c8
  • SSDEEP 24576:Ji2Q9NXw2/wPOjdGxYEfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnq:YTq24GjdGSCw+W7SCRnVQTEQ/BA8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19
• • Target
    grger/Anarchy Panel 4.7/Plugins/sJ88z8tsg5XzK.dll
  • Size 172KB
  • SHA256 6eaf5744b8ec91312e1c6be83d852627e5204b3b64a1932e60e47438d73fb6bf
  • MD5 b3fa2c3d50057ddd2c9579dc0aef1590
  • SHA1 88a1f57b9177c95a2e095866574639b09d5f310a
  • SHA512 0d1b8288cbc1c206029fe2f9b7366b2f8b49158e4c9643e453111ceb90fd77af903533c64f6ede351755414c9e7daa926704cda6f1953be79e1adc7aff515508
  • SSDEEP 3072:8SHb8GZKzU95JXku/dIvjVWE6jZJjnnpnSY1DFb109H:88ZKzU95JXkodIbVWE6jDjnnpnSY1DFZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral20
• • Target
    grger/Anarchy Panel 4.7/Plugins/yL9x34D8X3oO2P.dll
  • Size 180KB
  • SHA256 0e9733277eac197c4eaf40fb0eada0907388222ef21843488a8e591149768301
  • MD5 38502e61cc1d39095a12c1883551ad9f
  • SHA1 135c9cad9e6d54bf66a1cee5c99ba510102623b0
  • SHA512 cd67a63ea954a4db8c8dfadceb2822b447d98c2c43a8f9c6901d0fce3230605a0416395b92caea6ac08348d5f6b0e1cb052b24cf90829602b0a5b0652b8a2600
  • SSDEEP 3072:lq4bIABl7xQ6himcU8wzHQzvDk7r1OzArhb6lDWyITJeO9pKb3tO:4LABl7xQ6himx8w7QzvDk7r16whByITO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21
• • Target
    grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS.dll
  • Size 106KB
  • SHA256 9e82bf869638f8118f47f3870b1382401e42912cefcc6a9890489af5bb805c7e
  • MD5 a267a675b7243d9152c7b8e3e261d64c
  • SHA1 9a0277095646e2a773e8a04a7913ce6a56cf05b5
  • SHA512 0dae32c0c0fbf6918779a5e9699cbef27572458a5cdc7119298abddb6a597a0017fe33af06c02abe0c66f3cd490f6955bd7c65470ed3e31338d28575306c04bb
  • SSDEEP 3072:KIgH2nCuMdPPgwP1euMwUiVD4WUMIoF4unE6r3Ic83C:XgH2nCoSeDzAVUMIoF4unE6rYc83
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral22
• • Target
    grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS1.dll
  • Size 234KB
  • SHA256 98eb518c9785f988ab1dc0752e0ef6d23f171134e60187c621795d6877940f99
  • MD5 4f2fb621cbea3cafb7a041c9b3c115a7
  • SHA1 137502326e0126f372586d157e51a1416146c3be
  • SHA512 22171b9ecf1fc99b7aaf4e73c4d164cedcb503e83021f36a9cec673ff327f83a6c7568e22a7329cc6fc7ef3d6ff79d5dc6c88a8784e58401b884920c5ba2ac9b
  • SSDEEP 6144:yMc8IVeK18Kv42lIq94yFwT6J9Kfgn4670g/Pgtb:yFeK18Kgohey2T6J9KfgnX0Ag
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23
• • Target
    grger/Anarchy Panel 4.7/Usrs.p12
  • Size 1KB
  • SHA256 d6bb01668b946fbf19ab99771d942a96cebcbb98d521722091e17d98925fa2cd
  • MD5 2a180e4131ced95c6586902e5c0a471a
  • SHA1 dde87d3d927ebc294854fc0f7eaee7a1735fb729
  • SHA512 d936e546114af9f1ce6de1163eea8a40f0f8c15c5bd8f91488e72bb2ac541a0920061fef252db6c8b3c12598b5c75e3522b08b6f47d57e1ad3f0f7c060a7c979
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral24
• • Target
    grger/Anarchy Panel 4.7/bb2.exe
  • Size 54.6MB
  • SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
  • MD5 94bac1a0cc0dbac256f0d3b4c90648c2
  • SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
  • SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
  • SSDEEP 786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Loads dropped DLL

  behavioral25
• • Target
    grger/Anarchy Panel 4.7/bb2.exe.config
  • Size 3KB
  • SHA256 49648bbe8ec16d572b125fff1f0e7faa19e1e8c315fd2a1055d6206860a960c9
  • MD5 3d441f780367944d267e359e4786facd
  • SHA1 d3a4ba9ffc555bbc66207dfdaf3b2d569371f7b5
  • SHA512 5f17ec093cdce3dbe2cb62fec264b3285aabe7352c1d65ec069ffbc8a17a9b684850fe38c1ffd8b0932199c820881d255c8d1e6000cbbe85587c98e88c9acb90
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral26