Extracted

Extracted

• • Target
    shellcode_pack.exe
  • Size 50.6MB
  • SHA256 70bc7c91943ed1f012ce4aa7918afd3a62379403e8920c24d065e981e602ce00
  • MD5 b2495fb69439d9a61559d3501bde29e8
  • SHA1 0a19d148a730f205b5f880ba4225650b295c1a3a
  • SHA512 b0b9322b9edea0bb8019de73213b28c77efe97f0ae517f8a3eb569d095c22f92a00d21b5917875d55ab9681f059508c54bb067836a440e5522457cab80185f51
  • SSDEEP 1572864:0szLx1qY//O/a4C6Q3aVNsCACzLx1qY//O/a4C6Q3af8NsCAo:0KfqAbk0aV6CA4fqAbk0af86CAo
  • TLSH
    T1FFC73347FE904444E1F4B33260256A749D77383E57AE653B8F2EB062988F36C0DB5A72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefaulthackeddefense_evasiondiscoveryexecutionasyncratnjratshellterpersistenceprivilege_escalationratspywaretrojan

  • Async RAT payload

    rat

  • Detects Shellter Trojan

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Shellter Trojan

    Shellter is a dynamic shellcode injector used to hide malicious payloads within existing PE files for evasion.

    trojanshellter

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2