Extracted

Extracted

• • Target
    discord_backup_codes (1).txt
  • Size 246B
  • SHA256 13ea8f098dd1022638e9e5bbebb88bed19b02359bbb748bd2e1f37710ee876c3
  • MD5 1c46d9916258dc5f2659ffe3d9574d8e
  • SHA1 a3d8e163bfe0e7fb0b4835910cadfef2fd09cd7c
  • SHA512 b000fd867c64318505f9b25f4ba5807c19ec00154964df73734e2181654c67b1af7090136146d06a6a084ed8eab2bb38fa86b7de5739122f5b328ed39d4745d0
  • TLSH
    T188D097168A8E681C8A3F624B3C32E88FFB4E49E23BE0CC388C249582A1807011118E5E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  adwareagilenetbootkitcollectiondefense_evasiondiscoverycrimsonratlokibotnjratspysheriffpersistenceprivilege_escalationransomwareratspywarestealertrojanupxevasion

  • CrimsonRAT main payload

  • Detects SpySheriff adware

  • Family: CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Family: Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Family: SpySheriff

    SpySheriff is a Windows adware written in C++.

    adwarespysheriff

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Enables test signing to bypass driver trust controls

    Allows any signed driver to load without validation against a trusted certificate authority.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2