Extracted

Extracted

Extracted

• • Target
    17033faffac3c967a6bd8ef494191a293a3782dbf730a040c4da52f66825d2b0.exe
  • Size 1.1MB
  • SHA256 17033faffac3c967a6bd8ef494191a293a3782dbf730a040c4da52f66825d2b0
  • MD5 7dc955e36585912dde86ef26931e1e74
  • SHA1 766f8032347ecfb5ee0479e96ba8ff0def5b9a4b
  • SHA512 a60ae1db726bae806cb07f68be352e3486fd67be71f78c663f9c4daa70c529249d843bafdc269e30972c130a294d9c28a4ed10e84123fae85ed784ba276e0452
  • SSDEEP 24576:g7/1/Dg46gFT4B0nYOWbLp9FX6nh/FaD0J95:sNgDlxbFXqh9k2
  • TLSH
    T193358E26B2D1D83BD673067CDE1BA2A898757D105D2CA44F7ED80F4C2E35A413F292A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverygcleanerloaderprivilege_escalationexecutiondarkcoredarkvisionsalatstealerpersistenceratstealerupx

  • Detect SalatStealer payload

  • Detects DarkCore RAT

  • Family: DarkCoreRAT

    DarkCore RAT is a modular remote access trojan sold as malware-as-a-service, written in C++.

    ratdarkcore

  • Family: DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

    defense_evasion

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2