Extracted

Extracted

Extracted

• • Target
    EldoradoLauncher.exe
  • Size 74.5MB
  • SHA256 b28c9ec504df39a3607245ee20e9aebbdcea79ad4ef87e7ee12bc1815981defb
  • MD5 cb1382aced3e3dd8876eb6820d1a763e
  • SHA1 9d903894b0e89a8346210b7da0fe656aadabfaa7
  • SHA512 08deb7beb1abdb9429eec39c484b53703c0cfabca92aaeb574e5303439ca254f20f721ea40a8d06e9d58d1b81209db4633e9ed49a71cd696656efabc3a6e50f9
  • SSDEEP 1572864:0bwJrNSakN74Ut8xpeotJL2Fx/k3uQIOTX55PWoEr/GUECI/Jqk:0ybkNXAEotd6xs3lD5U/0lBqk
  • TLSH
    T1BF08339A822E0511D64736BF923800B7451CF2B5E807B9BD56D08F558AB211F0FFDBBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarkcoreratonratsiriusratpersistenceprivilege_escalationratstealer

  • Detects DarkCore RAT

  • Detects RatonRAT payload

  • Detects SiriusRAT

  • Family: DarkCoreRAT

    DarkCore RAT is a modular remote access trojan sold as malware-as-a-service, written in C++.

    ratdarkcore

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2