Extracted

• • Target
    Cherax.rar
  • Size 2.8MB
  • SHA256 88f10e2520adc4cefb0bfdba56c6c2710eef48acbd4407e0ce07cdb9dd1169a9
  • MD5 567b9b85be25353eade3a23b80d8a7e1
  • SHA1 8657195fc0900e3eb44bd1170b208867eaf0b877
  • SHA512 ad2971f8d97b36b76f44a780fa2274e7b924feb4142b35e46d6dda19efa3725614d008daff1dbb3cd57b6e213ee34e984d352aa8487031143b3915c614ca703b
  • SSDEEP 49152:qfLZ1dzv1bmQaRK8NIy5ZbWgEnBTLG7/bJ0o8mTnWk72GslMVW4fonefGv6Z:CLdRH+FDUgEBTAbuHm6k70lMY1efGv6Z
  • TLSH
    T176D5336427F9BBCE1DF7C480FF1A4F6456E444C63568602C3EAE7D806A9AE41C76B903
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1
• • Target
    Cherax.exe
  • Size 3.0MB
  • SHA256 fdb00ca04a2241daf3466fedce4c2db0bf6d28b265af97da3f529375498c34dc
  • MD5 100c32831ca00f7d57be7040c30f3ede
  • SHA1 d6a172780c250431ef1bf2fcb90299a5ef143ee8
  • SHA512 470c617f25a13de919583a3f207ad50f7ed1ceff63691f8500716379b19982b11ada1b5415b173e3f3d3773da2eb1bfec04d481a317cf693b810ca4e9b3c2d78
  • SSDEEP 49152:SDojF499D2ZG/TVdFyWgZRlnqri9Yr5RNwowxk2doWN8Qsh2r4dxwO9LMgwbiRzN:S0NS74pTei9YP172SW2Qj4dn9L3wuT
  • TLSH
    T1AEE52319E3E804F9F0A7B6B8D9564902D37B7C4A0771E74F03BC45592F636A0AE36B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydiscordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral2