Extracted

Extracted

Extracted

• • Target
    DELTARUNE.exe
  • Size 6.8MB
  • SHA256 f34ff5e4c668fc88f322a280d03c8447f949429ab1b40b651bfe9f9c2d3f05b0
  • MD5 019a08d754b45df69b2efc4f4521f45d
  • SHA1 1ec372b4f05de9493401a463034003c64c274eb2
  • SHA512 f3c526b704c368217a60151f5928c24862354f22678fb6584df6fabe052fd5cd497c0706af002460bc0525e26590225b5fbad2aacee9cee826256ab181630018
  • SSDEEP 196608:6uD0CEec/64GYIqHlHFSpKvLHMgpYovPylGNuDHj7OuMa:LEHvLsU064DL
  • TLSH
    T1C0765B863665C1EDD1278038C54696FAE2713C41CF5197CB2AA47F6E3F33AD40ABB621
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker2002crypterdefense_evasiondiscoverybabadedagoziwarzoneratinfostealerinstallerisfbloaderpersistenceprivilege_escalationransomwarerattrojanupx

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda

  • Babadeda Crypter

  • Babadeda family

    babadeda

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Warzone RAT payload

    rat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1