Extracted

Extracted

Extracted

• • Target
    Flash-USDT-Sender v2 (2).zip
  • Size 808KB
  • SHA256 8018d4a6776fd432ea3d84c4c5cd576894362ef2212f66ec5c4ce6964a78016c
  • MD5 4bb7ac8ea49b5948185e362f618b8407
  • SHA1 e5d5decff83197c68de9690e73c67d50eced279f
  • SHA512 5f65bbb607782b9f68e16d95c10631b4ebad87288a325bb27ffe8226204ba2c6e94b67b392a8ecc1a922084e6125904b127aed65d723a2d225d313972dd3ea15
  • SSDEEP 24576:NyyLFbP2sJSzQOUMfLVDw6DsJar6QPTc10:dLFSsJSzzzVNDh+gwq
  • TLSH
    T1C005236DED1452CF0B0B1BA5A6ACD72D29822B23E901CA218CEA49F1531F57D3F35DE4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Flash-USDT-main/.gitignore
  • Size 430B
  • SHA256 29a3db423bf9d10e68f8950af557ddb891f407d262a8286511fb22df48ef458f
  • MD5 97a40190cf692d26a40878c675a54049
  • SHA1 12ac538031aa43ebb2fa6c7c7db3ecec528fdad1
  • SHA512 546326d29f96daad767190d05485c3358272f62423ccf5ceb27dbce605ff376ab66875aff138caf7a1699cbc1123121b8ab8c9da2d22183f39305231dd3f4308
  • TLSH
    T1AEE023E405FE9D47343578C181CA74C9DED569F66001651059FD118465BF8BC108A7BF
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral2
• • Target
    Flash-USDT-main/Flash USDT v2.exe
  • Size 918KB
  • SHA256 5c9d92a9fc8a5399e2dc146af2c5dfbfdbbf94cd11ea331e9422626026470279
  • MD5 e45aa1c8df8c2e551cbb12eb60d45862
  • SHA1 cb00e3e6bd28bbef0899c7e470e82f4e5f5dc13b
  • SHA512 ea77a19bc7d76c821082d9f2a14b6e818f28b98aaea9f923767d86d96e8db1a64ddcc56d7cfbcce41c06bd195b8afef4ed4f4dfc1e3543df0e5de4b6aa3af069
  • SSDEEP 24576:1Gz1TSpONGTQ9dokTpIG/2KPJ8r6oPNYY:1o1SpONZ9dokTpIG/Y+YN
  • TLSH
    T121151266BD4C0C18C5570ABD89E99048613E3E49DAA4C867F0947FE63E7FE0A9C3794C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultoffice04defense_evasiondiscoveryevasionexecutionasyncratquasarstormkittyvenomratxwormpersistenceprivilege_escalationratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Quasar payload

  • StormKitty payload

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral3
• • Target
    Flash-USDT-main/LICENSE
  • Size 25KB
  • SHA256 20c17d8b8c48a600800dfd14f95d5cb9ff47066a9641ddeab48dc54aec96e331
  • MD5 1803fa9c2c3ce8cb06b4861d75310742
  • SHA1 b386b371ce94933e63ced1052aa72a60da5485ff
  • SHA512 dec798f85edac11b3a3f4bb1f309397719dd4de04f66357a5520b23e758cba757c9c7bee87bdbae2a5f936368cab0670bbd3395030393c029d68d0e72fcfba1e
  • SSDEEP 384:LE56OuAbn/0UVef6wFDVxnF+7xqsvLt+z/k8E9HinIVFkspWM9bc7ops08ZuQa:LE5trbernFCL1leSWmc7ksNZuQa
  • TLSH
    T1ABC2953EB70113B206C206905A4FA4DFE32BD07932675964749CC15D23AB93543FBBEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4