Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged.7z
  • Size 328.4MB
  • SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
  • MD5 0c22c97e5f0c0cd86a1daeff10d51581
  • SHA1 9f760e31fc9f4763cc04716e669d6ddd547f9fd3
  • SHA512 e31ee3466d4be1b660c73917fbc3ad288974316f4d8e92f8d2e8520c4c805ceb3b545bc1fda47a67563301aa4f2d12c8685818653e95d28fd5a8387154d9c833
  • SSDEEP 6291456:m3tJGUA4R5hz4EQLvSkRNLF9lD7C2GabF9sV0c3V+5ZcqAgZDFvVCG9KrGpUQXKz:cIqmSkRL7D7CBabqhGsuF9C3rGUQXKz
  • TLSH
    T1FCF833E898E71050F222D1A80DEAEA021F4D98D4B66DC4D32E652FFB5CEC2FF85B5055
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  tag_150adwareaptbackdoor5f3e2ed386ddeccffbb4e34c56fc2efddefaultmayo24neufdefense_evasiondiscoveryexecutionacreedcastleratcyborggh0stratmarsstealermetasploitnanocorenjratpurplefoxraccoonrevengeratxclientxredinstallerkeyloggerpersistenceprivilege_escalationransomwareratrootkitspywarestealertrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Detect XClient Payload

  • Detects Acreed Stealer

  • Detects C variant of CastleRAT.

    trojanapttag_150

  • Family: Acreed

    Acreed is an information stealer.

    stealeracreed

  • Family: CastleRAT

    CastleRAT is a trojan available in both Python and C variants.

    trojancastlerat

  • Family: Cyborg

    Cyborg is a ransomware that has been active since 2022.

    ransomwarecyborg

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Family: Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Family: RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Family: XClient

    XClient is a trojan written in C#.

    trojanxclient

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Gh0st RAT payload

  • Renames multiple (176) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • RevengeRat Executable

    stealer

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1