Extracted

• • Target
    ThirdClient.exe
  • Size 70KB
  • SHA256 cf27cbef76ddf911ee4cf376d1107d1f12a5d4b5e53f5505a73cde10aa88ee5f
  • MD5 86f5c9f6f869e5fad799af8810c32ae4
  • SHA1 b793c88b2154499cfe2acb1e4177b0c885340dfe
  • SHA512 6f9fbda5f583e64be5efaa43f1e3a14bebc19c8f2ea26403969c85f2c6f68e17edab62bc9b232d908339a3ba19b11ca735092d3a3102549f7034b4bc1a74d375
  • SSDEEP 1536:PUUIQSq+B91N0e8OxyDd0RKtocT/yim/1yD:PUU9+n1N0eJyDY7cT/yjgD
  • TLSH
    T14863E053E7F140D5DAA39231ED679353EEF030D91A3A66EF254869E62F737003A0A721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitthirdratdefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistencerat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Disables Task Manager via registry modification

    defense_evasion

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2