Extracted

• • Target
    patch.exe
  • Size 509KB
  • SHA256 ac1f7f8efe964b1ce0290441d794446be7545182203cfae9030bf2f504d5787c
  • MD5 9b164a0c4e4e7a743f41c08088d57760
  • SHA1 2eaaaae91f034e3e74b6fe0934be424f9f21d5b4
  • SHA512 21aceb62e1122a84bd33d42cf95e6c235d2c2b02b6a18d1e8c6037752ebcfad5ba4bba32ca69205e1b5a045ea8ab3f27a9cb94b4cea7cc356ce802218e2d3fdd
  • SSDEEP 12288:fhoUZeviEqMeV89bROjl/1yJIRHqPuCA6H4pD0ai95WQHlT2:iUkn7eWBR5JIRR16zxvWaT2
  • TLSH
    T154B4AE2573E80E54E2FBDF78A4B171014ABABA4AD927DB9D1D0420CE0973B45EC91F72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasioncrysomeratprivilege_escalationrat

  • Detects CrysomeRAT Client

  • Family: CrysomeRAT

    CrysomeRAT is a Windows RAT written in C#.

    ratcrysomerat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation
  behavioral1behavioral2
• • Target
    aforge.video.directshow.dll
  • Size 35KB
  • SHA256 60d7636c14e8574666cf827115f0ec2992fdd172d04901c05d81a9a95f07b6bd
  • MD5 ae99fa6ea74b0b0ca54bd4db9a1276ca
  • SHA1 cb56cbea98bbd03236c0038b33f99a0bc27cf826
  • SHA512 f1594a03f08ab57cb80571aaa0bf51ef2d03311c2fd77dd267d1833596f16f27cc57f42b44e134545826d1dc85e1bc09fa466212f13d05fb7049e2f3e28c27d3
  • SSDEEP 768:u/Xil9fEWM0yVnO9Y5UTOSsxrC2dkbpN+fMvkYD:ugM0G5UTOtubpN+kMYD
  • TLSH
    T11FF23A6263B8D63BE99E4B78A5B71F000B71ED05A323E75E4AB9821D7C377900B50367
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    aforge.video.dll
  • Size 16KB
  • SHA256 388848e13ff369f90530d0cf7df05a71f14e0862c78f0e33264d101b771f67e7
  • MD5 59b29df41ae478399c554c5272c7585f
  • SHA1 31ab152945626d6843ed7647c2f3ef2dcf4969a0
  • SHA512 4e8087f59e18f19d4b9c08e0c29a6936df57692220d3dcdc5c05072d6f8ef035352eee680b271c663adac133976377c3df93b81bad4b8cec1c114e103d22db82
  • SSDEEP 384:vTJd+C0VUZpdoXAlFMJtirnLiDl1i+yf06B:zqalLiTi+y8y
  • TLSH
    T12B72E90DC7AC8A3FCAAE47BEE859432102B0D3856692E79D9CDC9495BC133954A037DF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    costura.dll
  • Size 4KB
  • SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
  • MD5 501981c7fc457d59238eb99780efb615
  • SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
  • SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
  • SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
  • TLSH
    T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    costura.pdb
  • Size 2KB
  • SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
  • MD5 34b42a5776a3ad022b429124d55e576d
  • SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
  • SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
  • TLSH
    T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    microsoft.win32.registry.dll
  • Size 22KB
  • SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
  • MD5 da40f3db8b34571684c0cb5bcecd2a79
  • SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
  • SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
  • SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
  • TLSH
    T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    naudio.asio.dll
  • Size 33KB
  • SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
  • MD5 eb254b04d63a9f03b77563243805f68f
  • SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
  • SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
  • SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
  • TLSH
    T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    naudio.core.dll
  • Size 183KB
  • SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
  • MD5 48867f392b8e77dc06c062638c6fbd36
  • SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
  • SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
  • SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
  • TLSH
    T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    naudio.dll
  • Size 7KB
  • SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
  • MD5 c583aa3819b16ae53859f728f59ea9a0
  • SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
  • SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
  • SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
  • TLSH
    T14AF1D729A398C676CA674BF1A42703400339EB40EA57CB2D0D9CA59FFD133185AB27D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    naudio.midi.dll
  • Size 45KB
  • SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
  • MD5 3f5c79100f4f7902114c3fcba275c606
  • SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
  • SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
  • SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
  • TLSH
    T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    naudio.wasapi.dll
  • Size 175KB
  • SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
  • MD5 278ebb79da14ecf8e0559530c2fda076
  • SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
  • SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
  • SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
  • TLSH
    T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    naudio.winforms.dll
  • Size 40KB
  • SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
  • MD5 be8205f435b2afbfd178960c46310c17
  • SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
  • SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
  • SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
  • TLSH
    T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    naudio.winmm.dll
  • Size 56KB
  • SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
  • MD5 faf1ba532964984a34d60674fbc7a5a7
  • SHA1 0999178949de510a47d87de3b8a117a003c572ee
  • SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
  • SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
  • TLSH
    T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    system.diagnostics.diagnosticsource.dll
  • Size 34KB
  • SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
  • MD5 8d9df432109f1cfdd86723b5f171e3d7
  • SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
  • SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
  • SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
  • TLSH
    T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    system.security.accesscontrol.dll
  • Size 30KB
  • SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
  • MD5 2d3e0b4ddf8628b41057b2aceef296eb
  • SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
  • SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
  • SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
  • TLSH
    T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    system.security.principal.windows.dll
  • Size 14KB
  • SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
  • MD5 b40bda63658a012d46f930c243b77056
  • SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
  • SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
  • SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
  • TLSH
    T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral31behavioral32