Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged.7z
  • Size 328.4MB
  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 0c22c97e5f0c0cd86a1daeff10d51581
  • SHA1 9f760e31fc9f4763cc04716e669d6ddd547f9fd3
  • SHA512 e31ee3466d4be1b660c73917fbc3ad288974316f4d8e92f8d2e8520c4c805ceb3b545bc1fda47a67563301aa4f2d12c8685818653e95d28fd5a8387154d9c833
  • SSDEEP 6291456:m3tJGUA4R5hz4EQLvSkRNLF9lD7C2GabF9sV0c3V+5ZcqAgZDFvVCG9KrGpUQXKz:cIqmSkRL7D7CBabqhGsuF9C3rGUQXKz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tag_150aptbackdoor5f3e2ed386ddeccffbb4e34c56fc2efddefaultlimmayo24neufdefense_evasiondiscoveryexecutioncastlebotcastleratcyborgdarkcloudgh0strathivemarsstealermetasploitnanocorenjratpurplefoxraccoonredlinerevengeratsectopratxclientxredyureiimpactinfostealerinstallerkeyloggerpersistenceprivilege_escalationransomwareratrootkitspywarestealerthemidatrojanupxvmprotect

  • CaslteBOT

    CastleBot is modular trojan first observed in early 2025.

    trojancastlebot

  • CastleRAT

    CastleRAT is a trojan available in both Python and C variants.

    trojancastlerat

  • Castlebot family

    castlebot

  • Castlerat family

    castlerat

  • Cyborg

    Cyborg is a ransomware that has been active since 2022.

    ransomwarecyborg

  • Cyborg family

    cyborg

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Detect XClient Payload

  • Detects C variant of CastleRAT.

    trojanapttag_150

  • Detects CastleBOT payload

    trojanapttag_150

  • Detects Go variant of Hive Ransomware

  • Detects Yurei ransomware

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive

  • Hive family

    hive

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Marsstealer family

    marsstealer

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Njrat family

    njrat

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Purplefox family

    purplefox

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon family

    raccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • XClient

    XClient is a trojan written in C#.

    trojanxclient

  • Xclient family

    xclient

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Yurei

    Yurei is a Golang based ransomware family derived from PrincessLocker.

    ransomwareyurei

  • Yurei family

    yurei

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (184) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • RevengeRat Executable

    stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2