Extracted

• • Target
    smbhotfix.exe
  • Size 3.4MB
  • SHA256 28ac0f48db3ef1c64101a6ff179c2296c78dc081e3359ad1543005b50d757f3f
  • MD5 b7a46fe39906e7310f6469144ebedd1d
  • SHA1 a4d401384678e5c765d114c13d1647061f8776dc
  • SHA512 c8baa14401309782d9805f910315fd38611adfe71fe18b57bc390ee2907bb9430701b487983e49aa0118156b1b553cf960ab22f0a7bf3b2ce874c434bc75d9f1
  • SSDEEP 49152:Q8p2jDNpdrfz+SG6F5yEDowjQYe6RmIWtNOdFqM9a2PQA1efgKsualXW8s72X0St:QDVzlysowjQ+IIoNOdFDa2PQorFts7M
  • TLSH
    T160F51224E5A052FDF166C274CE83A523F6B2B4492364A9DF03D189B52F372E14B3EB51
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarkcorepersistenceprivilege_escalationratupx

  • Detects DarkCore RAT

  • Family: DarkCoreRAT

    DarkCore RAT is a modular remote access trojan sold as malware-as-a-service, written in C++.

    ratdarkcore

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1