Extracted

• • Target
    HELLA TUFF COMBLOX SCRIPT.exe
  • Size 594KB
  • SHA256 bb16f0869b3244e5d9963accd9bcf2e19bf2f64aa5a946c817138dc5e159fc9f
  • MD5 5bfad3c8bf84aa396b5243d1baeeb261
  • SHA1 3d027907df69ae65219d8a0b2fd5ef5c3def5ab5
  • SHA512 4a8944f4da0c98cefda671267e86a051d7f5206371fe8484603e5e911c5ea224529fbec069cc41316d23f3d8091edf235da62f4ff6cbdbade1e72acd48fca17f
  • SSDEEP 12288:eBaR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIZ3g:LL4kkA7lXkXDDuAOFhWSApi7
  • TLSH
    T18BD40204B7BC3715F7BE8B3E59F090480F72B2A38A20E25C5D83D4A91675B429D64FA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradefense_evasiondiscoveryexecutionexploitratonratpackerpersistencestealerevasionransomwarespywaretrojan

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Renames multiple (136) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Possible privilege escalation attempt

    exploit

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2