Extracted

Extracted

Extracted

• • Target
    Rutarizador.exe
  • Size 23.1MB
  • SHA256 b97745f8de4db1e653b9690720916594af73f1fbf0e5e626e9f334ab18789299
  • MD5 e8ce4792fb2f03e0d26631063ed523b2
  • SHA1 8826f0365cfd88cb118bc4772a216ad2cee8ef89
  • SHA512 a71481758bea3f2b23a7f710d27f3cb596af7db639445f1e8c63575e5eb4136dfb23de1ddc5f14bfb2e708e2c9a3abaa55083b00558107e1a0677bc4450a78f2
  • SSDEEP 393216:kD7lXvH26O44cgFt1apZnf2vapDpz0zkQC59VkNwZ7uilTbPCDWqEy573X:M/W6OlcgF7abflFz0zq9V5ZCidbP4hT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  arrowratasyncraticarusstealerclientdefaultdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerratstealerupx

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer

  • Icarusstealer family

    icarusstealer

  • Modifies WinLogon for persistence

    persistence

  • Async RAT payload

    rat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1