Extracted

• • Target
    Exodus Larp Wallet 1.1.1.1.exe
  • Size 3.5MB
  • SHA256 a8ba25a210943ebeb47637a2cfc9f4f2ab2638506124c00e740d726b9069a76f
  • MD5 df20e28812991a3607a8e8c76d09944f
  • SHA1 4cb9812c264bc7e727d3577d4b0f5a9c50496494
  • SHA512 b6856bbdaa406e5871b7a26292c0d449e84302d7215c806434de4d1e3be54c9cb1c21e5c880bbb9f0215d19e810ea8710eaae1d27b60fdb68f290dc717153246
  • SSDEEP 49152:dmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sj:Gq0WgVUuHjkDGjYQeqpgmltj
  • TLSH
    T12206CF407BD0CE1BE19F87B6B4F2061057B5EC15A796E70B2E90BAAC1CB37445E1839B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionratonratpersistenceransomwarespywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2