Extracted

• • Target
    HeroinRAT.exe
  • Size 1.1MB
  • SHA256 f3755d4d4fe143a1757bcadc32c848331de371dd7fa8ce3821e87a671a7cecf7
  • MD5 0bc937ca5d8fb06b292fa33717f9d8b7
  • SHA1 ad3f80bfb02ebe5d3e901144605298ba799e34b1
  • SHA512 306682235adecb69cfb5056b73d103266fe86226881d42f365ea2adcb637a8a3058a517a293e858294a5d922dd3b582b7f53723fd219a2bdbe215892bd97e4f8
  • SSDEEP 24576:UhCp9fSPEeXvwxGHMdo06UHfaeft27jm6AcpUPlvlph:Pp91+HMKxUHyNm6Acw5
  • TLSH
    T1C1352917F2A394ECC56BC0B486529772FA70B42906347E6E1A98E7321F31D509F2EB74
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionpersistenceprivilege_escalationspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Disables service(s)

    defense_evasionexecution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence
  behavioral1behavioral2