Extracted

Extracted

• • Target
    SSTool-main.zip
  • Size 13KB
  • SHA256 88d1218fdccba9ff8e0ef91397059b2f78f8495fbba365aa95d5acb10aa6d5c1
  • MD5 33c3f3e3b04e2341b80acf191efa040c
  • SHA1 39960b765daf8727821aef2a9369a4d2df18d741
  • SHA512 b666d2fd1dc187b6a2ca67acb52951a8ed8046b2061e46119cd39c0ab3c8145936518bd96484e8d7a93cb6d4c6ccc5f869c77a6706f542e626633cc49bcf689c
  • SSDEEP 384:/Bphy5tCzUsSnTaqEXkwceeAO+mC4/uMVCLXvLEa5wjzxKjN6:pphyASwxeATweDjp5wjzxKjN6
  • TLSH
    T19152BF626FBD08D7CB0851F9E05775D7D322EB8AA6B06B63640614E10EEE90E270B09D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  agilenetguestdefense_evasiondiscoveryexecutionhiddentearrevengeratwarzoneratinfostealerpersistenceprivilege_escalationransomwareratrezer0spywaretrojan

  • Detects HiddenTear Ransomware

  • Family: HiddenTear, Cryptear

    HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.

    ransomwarehiddentear

  • Family: RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1