Extracted

• • Target
    7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
  • Size 7.2MB
  • SHA256 7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
  • MD5 58253bef795c914bb2dca89f74ae0aec
  • SHA1 ab517aa83178957381a9f9317c15901f4ee79cc4
  • SHA512 49b0d94812f6a0fd710db9e97fd48413b1002371358bfe3fa2b577773d4f7b9f716dc12191f3f1b76d142fa304f7b4e2a2092e3d6a67be01a546debf9ce62eb4
  • SSDEEP 49152:DCiAb9key/HOSt9/uW2P5asIOd0S0IBRQVvOIQrDMsjP4yIJgieTgueLJ93Ij/hs:DpsZZwbJFeg/3SP
  • TLSH
    T12E765B7B62A4826DC96DC33FD1E38F40D5F371B52B33C6EB429103698A068C19E7E665
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  tag_150adwareaptexecutioncastleratpersistenceransomwarespywaretrojan

  • Detects C variant of CastleRAT.

    trojanapttag_150

  • Family: CastleRAT

    CastleRAT is a trojan available in both Python and C variants.

    trojancastlerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1