Extracted

Extracted

• • Target
    file.exe
  • Size 1.1MB
  • SHA256 5bf9af4450ec63c2b592f054ba876cb40b96678363d8bdc49455e9a7dd3bfcd9
  • MD5 d51b75c305cc4973d2e01fcdccdb0939
  • SHA1 0945c3389051b0e611ccb02c9c3f95ffc51053fb
  • SHA512 b82d1f7adaf8060bc3feede871e99112ebf08f08ad0f98f771033ad374f7050e0064b2ceb10fec9892cead3ee603ecc78255e7323e204e668951c5055d08c159
  • SSDEEP 24576:h0Qx7HwX7mGrp9vajbcqALziBDEfEcbOmS6nh/FaD0J9c:Oo0C8rmAHd5bOtqh9kr
  • TLSH
    T15E357D22B291D83BC273067CDE5BA2A998757D105D2CA44F7EE84F4C1E35A813F391A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydarkcoregcleanerloaderpersistenceprivilege_escalationratspyware

  • Detects DarkCore RAT

  • Family: DarkCoreRAT

    DarkCore RAT is a modular remote access trojan sold as malware-as-a-service, written in C++.

    ratdarkcore

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2