Edit tour

Windows Analysis Report
Ru66o6HYE6.exe

Overview

General Information

Sample Name:	Ru66o6HYE6.exe
Original Sample Name:	0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515.exe
Analysis ID:	884341
MD5:	a8a2e3100a56c891b16cd7503e4b03ae
SHA1:	e5313848436433842b4d932e3ddfc408bb20337a
SHA256:	0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515
Tags:	exeMassLogger
Infos:

Detection

Kraken Rat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Kraken Rat

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Contains functionality to capture screen (.Net source)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Found inlined nop instructions (likely shell or obfuscated code)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Binary contains a suspicious time stamp

Detected potential crypto function

Yara detected Credential Stealer

Potential time zone aware malware

Program does not show much activity (idle)

Enables debug privileges

Classification

Process Tree

System is w10x64

Ru66o6HYE6.exe (PID: 6708 cmdline: C:\Users\user\Desktop\Ru66o6HYE6.exe MD5: A8A2E3100A56C891B16CD7503E4B03AE)

cleanup

Malware Configuration

Threatname: Kraken Rat

{"Exfil Mode": "SMTP", "From": "david@product-secured.com", "Password": "H?G7iEWK_W0R##2#", "To": "premium251.web-hosting.com", "Port": "587"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Ru66o6HYE6.exe	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
Ru66o6HYE6.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Ru66o6HYE6.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Ru66o6HYE6.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe394:$s1: UnHook 0xe39b:$s2: SetHook 0xe3a3:$s3: CallNextHook 0xe3b0:$s4: _hook
Ru66o6HYE6.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd66a:$a1: get_encryptedPassword 0xd9ff:$a2: get_encryptedUsername 0xd414:$a3: get_timePasswordChanged 0xd51a:$a4: get_passwordField 0xd680:$a5: set_encryptedPassword 0xf25d:$a7: get_logins 0xef2b:$a8: GetOutlookPasswords 0xec73:$a9: StartKeylogger 0xf194:$a10: KeyLoggerEventArgs 0xec82:$a11: KeyLoggerEventArgsEventHandler

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd46a:$a1: get_encryptedPassword 0xd7ff:$a2: get_encryptedUsername 0xd214:$a3: get_timePasswordChanged 0xd31a:$a4: get_passwordField 0xd480:$a5: set_encryptedPassword 0xf05d:$a7: get_logins 0xed2b:$a8: GetOutlookPasswords 0xea73:$a9: StartKeylogger 0xef94:$a10: KeyLoggerEventArgs 0xea82:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Ru66o6HYE6.exe PID: 6708	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
Process Memory Space: Ru66o6HYE6.exe PID: 6708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ru66o6HYE6.exe PID: 6708	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x19b59:$a1: get_encryptedPassword 0x19edf:$a2: get_encryptedUsername 0x19917:$a3: get_timePasswordChanged 0x19a1d:$a4: get_passwordField 0x19b6f:$a5: set_encryptedPassword 0x1b6f3:$a7: get_logins 0x1b3c1:$a8: GetOutlookPasswords 0x1b109:$a9: StartKeylogger 0x1b62a:$a10: KeyLoggerEventArgs 0x1b118:$a11: KeyLoggerEventArgsEventHandler
decrypted.binstr	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
decrypted.binstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Ru66o6HYE6.exe.400000.0.unpack	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
0.0.Ru66o6HYE6.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Ru66o6HYE6.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Ru66o6HYE6.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe394:$s1: UnHook 0xe39b:$s2: SetHook 0xe3a3:$s3: CallNextHook 0xe3b0:$s4: _hook
0.0.Ru66o6HYE6.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd66a:$a1: get_encryptedPassword 0xd9ff:$a2: get_encryptedUsername 0xd414:$a3: get_timePasswordChanged 0xd51a:$a4: get_passwordField 0xd680:$a5: set_encryptedPassword 0xf25d:$a7: get_logins 0xef2b:$a8: GetOutlookPasswords 0xec73:$a9: StartKeylogger 0xf194:$a10: KeyLoggerEventArgs 0xec82:$a11: KeyLoggerEventArgsEventHandler

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Ru66o6HYE6.exe

Avira: detected

Found malware configuration

Source: Ru66o6HYE6.exe

Malware Configuration Extractor: Kraken Rat {"Exfil Mode": "SMTP", "From": "david@product-secured.com", "Password": "H?G7iEWK_W0R##2#", "To": "premium251.web-hosting.com", "Port": "587"}

Multi AV Scanner detection for submitted file

Source: Ru66o6HYE6.exe	ReversingLabs: Detection: 51%
Source: Ru66o6HYE6.exe	Virustotal: Detection: 68%			Perma Link

Machine Learning detection for sample

Source: Ru66o6HYE6.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: Ru66o6HYE6.exe	String decryptor: david@product-secured.com
Source: Ru66o6HYE6.exe	String decryptor: H?G7iEWK_W0R##2#
Source: Ru66o6HYE6.exe	String decryptor: premium251.web-hosting.com
Source: Ru66o6HYE6.exe	String decryptor: 587
Source: Ru66o6HYE6.exe	String decryptor: WinForms_RecursiveFormCreate
Source: Ru66o6HYE6.exe	String decryptor: WinForms_SeeInnerException
Source: Ru66o6HYE6.exe	String decryptor: KrakenStub.Resources
Source: Ru66o6HYE6.exe	String decryptor: 1
Source: Ru66o6HYE6.exe	String decryptor: %True%
Source: Ru66o6HYE6.exe	String decryptor: swCpiTiAhkkEpyDZTnAGhOBZpr
Source: Ru66o6HYE6.exe	String decryptor: True
Source: Ru66o6HYE6.exe	String decryptor: \|System Info\|System Name:
Source: Ru66o6HYE6.exe	String decryptor: Time:
Source: Ru66o6HYE6.exe	String decryptor: Date:
Source: Ru66o6HYE6.exe	String decryptor: ========\|Recovered Data\|========
Source: Ru66o6HYE6.exe	String decryptor: XmyFntc+2Mr9D8a8cIRGva7Yqa591pNDLqAR8rdY1k4=
Source: Ru66o6HYE6.exe	String decryptor: zGXhVxursUWx/Mqn01W8YxHaxPhhjF+P
Source: Ru66o6HYE6.exe	String decryptor: g6iqdQx6uSAFv0MppdYExCCYh6Ky5jTt0T2NBhI/KWg=
Source: Ru66o6HYE6.exe	String decryptor: VqONpyzLqFY=
Source: Ru66o6HYE6.exe	String decryptor: EdrE+GGMX48=
Source: Ru66o6HYE6.exe	String decryptor: KRK
Source: Ru66o6HYE6.exe	String decryptor: ------------------------
Source: Ru66o6HYE6.exe	String decryptor: x
Source: Ru66o6HYE6.exe	String decryptor: Content-Type
Source: Ru66o6HYE6.exe	String decryptor: multipart/form-data; boundary=
Source: Ru66o6HYE6.exe	String decryptor: --{0}Content-Disposition: form-data; name="document"; filename="{1}"Content-Type: {2}{3}--{0}--
Source: Ru66o6HYE6.exe	String decryptor: POST
Source: Ru66o6HYE6.exe	String decryptor: https://api.telegram.org/bot
Source: Ru66o6HYE6.exe	String decryptor: /sendMessage?chat_id=
Source: Ru66o6HYE6.exe	String decryptor: &text=
Source: Ru66o6HYE6.exe	String decryptor: utf-8
Source: Ru66o6HYE6.exe	String decryptor: /
Source: Ru66o6HYE6.exe	String decryptor: user-agent
Source: Ru66o6HYE6.exe	String decryptor: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Source: Ru66o6HYE6.exe	String decryptor: http://checkip.dyndns.org/
Source: Ru66o6HYE6.exe	String decryptor: <html><head><title>Current IP Check</title></head><body>
Source: Ru66o6HYE6.exe	String decryptor: </body></html>
Source: Ru66o6HYE6.exe	String decryptor: Current IP Address:
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: .
Source: Ru66o6HYE6.exe	String decryptor: {.}
Source: Ru66o6HYE6.exe	String decryptor: http
Source: Ru66o6HYE6.exe	String decryptor: {http}
Source: Ru66o6HYE6.exe	String decryptor: 0
Source: Ru66o6HYE6.exe	String decryptor: Create
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Clipboard_
Source: Ru66o6HYE6.exe	String decryptor: .txt
Source: Ru66o6HYE6.exe	String decryptor: STOR
Source: Ru66o6HYE6.exe	String decryptor: Recovered From:
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: Clipboard.txt
Source: Ru66o6HYE6.exe	String decryptor: text/plain
Source: Ru66o6HYE6.exe	String decryptor: 2
Source: Ru66o6HYE6.exe	String decryptor: /sendDocument?chat_id=
Source: Ru66o6HYE6.exe	String decryptor: &caption=
Source: Ru66o6HYE6.exe	String decryptor: System IP:
Source: Ru66o6HYE6.exe	String decryptor: KrakenClipboardLog.txt
Source: Ru66o6HYE6.exe	String decryptor: application/x-ms-dos-executable
Source: Ru66o6HYE6.exe	String decryptor: RecoveredDisplayShot
Source: Ru66o6HYE6.exe	String decryptor: .png
Source: Ru66o6HYE6.exe	String decryptor: \Kraken
Source: Ru66o6HYE6.exe	String decryptor: \Kraken\
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Screenshot_
Source: Ru66o6HYE6.exe	String decryptor: Recovered Screenshot From:
Source: Ru66o6HYE6.exe	String decryptor: Recovered Keylogs From:
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Keylogs_
Source: Ru66o6HYE6.exe	String decryptor: RecoveredKeylogs.txt
Source: Ru66o6HYE6.exe	String decryptor: Keylogs Recovered From:
Source: Ru66o6HYE6.exe	String decryptor: KrakenKeylogs.txt
Source: Ru66o6HYE6.exe	String decryptor: [ -- {0} -- ]
Source: Ru66o6HYE6.exe	String decryptor: {0}
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Password_
Source: Ru66o6HYE6.exe	String decryptor: RecoveredPassword.txt
Source: Ru66o6HYE6.exe	String decryptor: RecoveredLogins.txt
Source: Ru66o6HYE6.exe	String decryptor: 300000
Source: Ru66o6HYE6.exe	String decryptor: [
Source: Ru66o6HYE6.exe	String decryptor: ]
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: [ENTR]
Source: Ru66o6HYE6.exe	String decryptor: [TAP]
Source: Ru66o6HYE6.exe	String decryptor: ObjectLength
Source: Ru66o6HYE6.exe	String decryptor: ChainingModeGCM
Source: Ru66o6HYE6.exe	String decryptor: AuthTagLength
Source: Ru66o6HYE6.exe	String decryptor: ChainingMode
Source: Ru66o6HYE6.exe	String decryptor: KeyDataBlob
Source: Ru66o6HYE6.exe	String decryptor: AES
Source: Ru66o6HYE6.exe	String decryptor: Microsoft Primitive Provider
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptDecrypt() (get size) failed with status code: {0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptDecrypt(): authentication tag mismatch
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptDecrypt() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptOpenAlgorithmProvider() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptSetAlgorithmProperty(BCrypt.BCRYPT_CHAINING_MODE, BCrypt.BCRYPT_CHAIN_MODE_GCM) failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptImportKey() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptGetProperty() (get size) failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptGetProperty() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Outlook \| =====URL:
Source: Ru66o6HYE6.exe	String decryptor: E-Mail:
Source: Ru66o6HYE6.exe	String decryptor: K-Password:
Source: Ru66o6HYE6.exe	String decryptor: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Source: Ru66o6HYE6.exe	String decryptor: IMAP Password
Source: Ru66o6HYE6.exe	String decryptor: POP3 Password
Source: Ru66o6HYE6.exe	String decryptor: HTTP Password
Source: Ru66o6HYE6.exe	String decryptor: SMTP Password
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Email
Source: Ru66o6HYE6.exe	String decryptor: GetBytes
Source: Ru66o6HYE6.exe	String decryptor: SMTP Server
Source: Ru66o6HYE6.exe	String decryptor: Nothing
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: Outlook
Source: Ru66o6HYE6.exe	String decryptor: Foxmail
Source: Ru66o6HYE6.exe	String decryptor: SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command
Source: Ru66o6HYE6.exe	String decryptor: Foxmail.exe
Source: Ru66o6HYE6.exe	String decryptor: "
Source: Ru66o6HYE6.exe	String decryptor: Storage\
Source: Ru66o6HYE6.exe	String decryptor: \
Source: Ru66o6HYE6.exe	String decryptor: \Accounts\Account.rec0
Source: Ru66o6HYE6.exe	String decryptor: Account
Source: Ru66o6HYE6.exe	String decryptor: POP3Account
Source: Ru66o6HYE6.exe	String decryptor: Password
Source: Ru66o6HYE6.exe	String decryptor: POP3Password
Source: Ru66o6HYE6.exe	String decryptor: !
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Foxmail \| =====
Source: Ru66o6HYE6.exe	String decryptor: E-Mail: {0}
Source: Ru66o6HYE6.exe	String decryptor: K-Password: {0}
Source: Ru66o6HYE6.exe	String decryptor: 5A
Source: Ru66o6HYE6.exe	String decryptor: 71
Source: Ru66o6HYE6.exe	String decryptor: v10
Source: Ru66o6HYE6.exe	String decryptor: \Local State
Source: Ru66o6HYE6.exe	String decryptor: "encrypted_key":"(.*?)"
Source: Ru66o6HYE6.exe	String decryptor: \MapleStudio\ChromePlus\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: logins
Source: Ru66o6HYE6.exe	String decryptor: origin_url
Source: Ru66o6HYE6.exe	String decryptor: username_value
Source: Ru66o6HYE6.exe	String decryptor: password_value
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Coolnovo Browser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: K-Username:
Source: Ru66o6HYE6.exe	String decryptor: \CatalinaGroup\Citrio\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - CitrioBrowser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Google\Chrome SxS\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chrome Canary \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Google\Chrome\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chrome \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \CocCoc\Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Coccoc Browser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Tencent\QQBrowser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: \Vivaldi\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: \Chromium\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chromium \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \CentBrowser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Cent \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Chedot\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chedot \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \360Browser\Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - 360 English \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \360Chrome\Chrome\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - 360 China \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \BraveSoftware\Brave-Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Brave \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Torch\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Torch \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \UCBrowser\User Data_i18n\Default\UC Login Data.18
Source: Ru66o6HYE6.exe	String decryptor: wow_logins
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - UC \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Blisk\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Blisk \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Epic Privacy Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - EpicBrowser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Microsoft\Edge\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Microsoft Edge \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: ataD nigoL\elbatS arepO\erawtfoS arepO\
Source: Ru66o6HYE6.exe	String decryptor: tad.dnaw\eliforp\arepO\arepO\
Source: Ru66o6HYE6.exe	String decryptor: ReadTable
Source: Ru66o6HYE6.exe	String decryptor: snigol
Source: Ru66o6HYE6.exe	String decryptor: GetRowCount
Source: Ru66o6HYE6.exe	String decryptor: GetValue
Source: Ru66o6HYE6.exe	String decryptor: lru_nigiro
Source: Ru66o6HYE6.exe	String decryptor: eulav_emanresu
Source: Ru66o6HYE6.exe	String decryptor: eulav_drowssap
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Opera \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\\|';:,<>/?+=
Source: Ru66o6HYE6.exe	String decryptor: APPDATA
Source: Ru66o6HYE6.exe	String decryptor: \FileZilla\recentservers.xml
Source: Ru66o6HYE6.exe	String decryptor: Host
Source: Ru66o6HYE6.exe	String decryptor: User
Source: Ru66o6HYE6.exe	String decryptor: Pass
Source: Ru66o6HYE6.exe	String decryptor: Port
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - FileZilla \| =====
Source: Ru66o6HYE6.exe	String decryptor: Host:
Source: Ru66o6HYE6.exe	String decryptor: Username:
Source: Ru66o6HYE6.exe	String decryptor: Password:
Source: Ru66o6HYE6.exe	String decryptor: Port:
Source: Ru66o6HYE6.exe	String decryptor: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Source: Ru66o6HYE6.exe	String decryptor: \AVAST Software\Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Avast \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: (
Source: Ru66o6HYE6.exe	String decryptor: UNIQUE
Source: Ru66o6HYE6.exe	String decryptor: table
Source: Ru66o6HYE6.exe	String decryptor: Mozilla\Firefox\Profiles
Source: Ru66o6HYE6.exe	String decryptor: logins.json
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - FireFox \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: Thunderbird\Profiles\
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chrome \| =====Found From: ThunderbirdHost:
Source: Ru66o6HYE6.exe	String decryptor: NSS_Shutdown
Source: Ru66o6HYE6.exe	String decryptor: PROGRAMFILES
Source: Ru66o6HYE6.exe	String decryptor: \Mozilla Thunderbird\
Source: Ru66o6HYE6.exe	String decryptor: \Mozilla Firefox\
Source: Ru66o6HYE6.exe	String decryptor: \mozglue.dll
Source: Ru66o6HYE6.exe	String decryptor: \nss3.dll
Source: Ru66o6HYE6.exe	String decryptor: NSS_Init
Source: Ru66o6HYE6.exe	String decryptor: PK11SDR_Decrypt

Source: Ru66o6HYE6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED3813h	0_2_00007FF9A6ED2BCC
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED2AC5h	0_2_00007FF9A6ED201D
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED404Dh	0_2_00007FF9A6ED3D5A
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED464Dh	0_2_00007FF9A6ED425D
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED464Dh	0_2_00007FF9A6ED455B

Networking

Yara detected Generic Downloader

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE

Source: Ru66o6HYE6.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: Ru66o6HYE6.exe	String found in binary or memory: https://api.telegram.org/bot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: Ru66o6HYE6.exe, KrakenStub/KrakenSteak.cs	.Net Code: TakeScreenshot
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	.Net Code: TakeScreenshot

System Summary

Malicious sample detected (through community Yara rule)

Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Ru66o6HYE6.exe, 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKrakenStub.exe6 vs Ru66o6HYE6.exe
Source: Ru66o6HYE6.exe, 00000000.00000002.661915249.000000000085D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Ru66o6HYE6.exe
Source: Ru66o6HYE6.exe	Binary or memory string: OriginalFilenameKrakenStub.exe6 vs Ru66o6HYE6.exe

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Code function: 0_2_00007FF9A6ED201D

0_2_00007FF9A6ED201D

Source: Ru66o6HYE6.exe	ReversingLabs: Detection: 51%
Source: Ru66o6HYE6.exe	Virustotal: Detection: 68%

Source: Ru66o6HYE6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ru66o6HYE6.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/0

Source: Ru66o6HYE6.exe, KrakenStub/KrakenDumpedList.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: Ru66o6HYE6.exe, KrakenStub/KrakenSteak.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenDumpedList.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: Ru66o6HYE6.exe, 00000000.00000002.662388374.00000000026C2000.00000004.00000800.00020000.00000000.sdmp, Ru66o6HYE6.exe, 00000000.00000002.664019647.00000000126C1000.00000004.00000800.00020000.00000000.sdmp, Ru66o6HYE6.exe, 00000000.00000002.662388374.00000000026B6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Ru66o6HYE6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Ru66o6HYE6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED4E22 push edx; retf	0_2_00007FF9A6ED4F49
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED5CBD pushfd ; retf	0_2_00007FF9A6ED5CC1
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED4CA0 push ebx; retf	0_2_00007FF9A6ED4CA1
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED559B push esp; retf	0_2_00007FF9A6ED559C
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6EDA132 push 00000008h; retf	0_2_00007FF9A6EDA134

Source: Ru66o6HYE6.exe

Static PE information: 0xE29D6504 [Sat Jun 24 05:37:08 2090 UTC]

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Process information queried: ProcessInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: Ru66o6HYE6.exe, KrakenStub/KrakenSteak.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: Ru66o6HYE6.exe, KrakenStub/FFDecryptor.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/FFDecryptor.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Queries volume information: C:\Users\user\Desktop\Ru66o6HYE6.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Kraken Rat

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Kraken Rat

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	Path Interception	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Email Collection	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Timestomp	NTDS	System Network Configuration Discovery	Distributed Component Object Model	2 Data from Local System	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ru66o6HYE6.exe	51%	ReversingLabs	ByteCode-MSIL.Infostealer.Mintluks
Ru66o6HYE6.exe	69%	Virustotal		Browse
Ru66o6HYE6.exe	100%	Avira	TR/ATRAPS.Gen
Ru66o6HYE6.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/q	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot	Ru66o6HYE6.exe	false		high
http://checkip.dyndns.org/q	Ru66o6HYE6.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	884341
Start date and time:	2023-06-08 18:17:14 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Ru66o6HYE6.exe
Original Sample Name:	0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 90% Number of executed functions: 23 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target Ru66o6HYE6.exe, PID 6708 because it is empty
Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.757039780362291
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	Ru66o6HYE6.exe
File size:	82432
MD5:	a8a2e3100a56c891b16cd7503e4b03ae
SHA1:	e5313848436433842b4d932e3ddfc408bb20337a
SHA256:	0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515
SHA512:	e84237a1605ae4bc4caa8e94398a45a4347d47466c30633f237a14cb5b5a9995a3944e268ec4e9b6dcf8f374eebeea14a84678da8f5fa6645829fe41098544d5
SSDEEP:	1536:6mcODmuU/nqPPjLXFC6ihgDHXwivg8v8Pp9bLYmxQwTW:rZdPjLX4DgDHXwCggA9omx5TW
TLSH:	4A83290E33D4D820EAFF847655B14251077AF812495BD31E0EE5B8AE2F367948A93F93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e............"...P..8...........V... ...`....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41569e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE29D6504 [Sat Jun 24 05:37:08 2090 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15644	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x5b6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x136a4	0x13800	False	0.3951572516025641	data	5.811499526395625	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x5b6	0x600	False	0.41796875	data	4.098483731181005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x160a0	0x32c	data
RT_MANIFEST	0x163cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	0
Start time:	18:18:14
Start date:	08/06/2023
Path:	C:\Users\user\Desktop\Ru66o6HYE6.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Ru66o6HYE6.exe
Imagebase:	0x400000
File size:	82432 bytes
MD5 hash:	A8A2E3100A56C891B16CD7503E4B03AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_KrakenRat, Description: Yara detected Kraken Rat, Source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Function 00007FF9A6ED2BCC Relevance: 1.0, Instructions: 984COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef670fc917a44639ba1a9cf8c69f5577ef5dd7a930c9ebd060d47029621e9a6e
Instruction ID: f5bddb6ea12dfa15da86d007601f8c00a2a2cd5264d06bc9e8d60defb8b7afc5
Opcode Fuzzy Hash: ef670fc917a44639ba1a9cf8c69f5577ef5dd7a930c9ebd060d47029621e9a6e
Instruction Fuzzy Hash: F792F774D096298FDB99EF68D894BECB7B1FF59301F1041A9D05DE7292CA74AA80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED201D Relevance: .9, Instructions: 903COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1e7d9a98592a6a10093681960bced8f0b31193607cb313e928f3c91d873b3e
Instruction ID: fd05ad4d18494613761c001a82a2be1429df3c50190ad1055d9cf23c9ae7b132
Opcode Fuzzy Hash: 7c1e7d9a98592a6a10093681960bced8f0b31193607cb313e928f3c91d873b3e
Instruction Fuzzy Hash: E872B670919A2D8FDBA9EF28C895BA8B7B1FF59305F5041A9D00DE3291CB75A9C1CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED3D5A Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e96d340e10ab4d938bcd1db877915142a16ad51177c4302ba0a61a1b421c4f
Instruction ID: 089323cd345ab42674931e87c565edde323e8a76dbd9e186e5f93229e7c6b92b
Opcode Fuzzy Hash: a0e96d340e10ab4d938bcd1db877915142a16ad51177c4302ba0a61a1b421c4f
Instruction Fuzzy Hash: B8E1C170D18A298FDB94EF68C885BECB7F1FB59301F5041A9D04DE3292CA74A995CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED425D Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fdae512e8b71afc1fa4a9afefc80362633a6f5a5b8f9bfdb127b32cce55faa
Instruction ID: af1051aee6f20824d739cbc17f234960d989576c8b1cbc13408eec466b2f4252
Opcode Fuzzy Hash: b9fdae512e8b71afc1fa4a9afefc80362633a6f5a5b8f9bfdb127b32cce55faa
Instruction Fuzzy Hash: 99C15A70D0960A8FEB95EF68C454BEDB7E1FF59300F1082B9D05DE3296CA78A995CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED455B Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453e21eb2900d7b85c17e3e8e35ad7a01fba53f18eb234a78461d046600b3b25
Instruction ID: b8fde8074d5c895c20c862bbbd31edc8cd175188f2d71fbe326bc2db0c35a1e0
Opcode Fuzzy Hash: 453e21eb2900d7b85c17e3e8e35ad7a01fba53f18eb234a78461d046600b3b25
Instruction Fuzzy Hash: C1015231C1921ACBEB10EFA9C4007FDB2B1EF95300F108139C12DA31C4CAB865A9CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED982F Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

K, xrefs: 00007FF9A6EDBC94

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 814251ba82340035db78e6536d6d22f98d1486035770383a018e0a95f9f4ee81
Instruction ID: be7b5ee3f1263a454e076e061f24e088877b88b1b789fec8316cc022f9d49ac5
Opcode Fuzzy Hash: 814251ba82340035db78e6536d6d22f98d1486035770383a018e0a95f9f4ee81
Instruction Fuzzy Hash: D0513570D0961A8FEB58DF54C8407EEB3B1FF59705F208269C05CA3295DB78A991CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED0474 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0997be273bea26155229b9dce84eb405d0e84ced91528ac6697e5259f2f535e0
Instruction ID: 470963eac887f06f3360be4296e0fbeb5e22611c6a26fb3acc7d6abf3fd6ac66
Opcode Fuzzy Hash: 0997be273bea26155229b9dce84eb405d0e84ced91528ac6697e5259f2f535e0
Instruction Fuzzy Hash: 75E10770A1491D8FEB95EF68D9A1BECB7A2FF49300F9441B9D01DD3392DE646D818B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED1BAA Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f7b600b13aeeca0c403ee266b8e999f31d7bb918cfe0c7fde80fcc1260b474
Instruction ID: 4e3a853feba0a84daae52f846d8d5000a8cfcaf0e1a9e4b4da17cd3e76a51462
Opcode Fuzzy Hash: f4f7b600b13aeeca0c403ee266b8e999f31d7bb918cfe0c7fde80fcc1260b474
Instruction Fuzzy Hash: C9C1B236E096598FE751EF78E4557E8BBB1FF85321F1040BAC08CDB292CA746889CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED12A1 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc367b0a45d8e5a996ac10d3b8ef90a346eb26f8019102b2c2715e4ef14d113
Instruction ID: 6241be5b52dc2831dacc4b3b1ecdb64957f8dc7efe0b17f492e19b9abb8cfdf9
Opcode Fuzzy Hash: ebc367b0a45d8e5a996ac10d3b8ef90a346eb26f8019102b2c2715e4ef14d113
Instruction Fuzzy Hash: 5E71FD70908A5C8FDB94EF68D895BEDBBF1FF59301F1041AAD04DE7252CA75A881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED2C6A Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd04135c29307041a9648561807646e5663fd9682b2e001185301d599c3b9ddb
Instruction ID: 70d092be2400e5235bb69ce679ced27ef1f87c313e0907e86083056a2cd7c788
Opcode Fuzzy Hash: dd04135c29307041a9648561807646e5663fd9682b2e001185301d599c3b9ddb
Instruction Fuzzy Hash: 3D7108709496198FDBA5DF28C894BE9B7B1FF5A301F1041EAD04DE7292DB38A984CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED01E0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c469650bb1ffcaeb12d7b1905bd1fb3f8f654c369cbceb873fbd5ce90b3ae37
Instruction ID: fe73e298fb42b2b2031bfaeda80b3941245a51d556be2efc2a86dbb0bf8f8325
Opcode Fuzzy Hash: 0c469650bb1ffcaeb12d7b1905bd1fb3f8f654c369cbceb873fbd5ce90b3ae37
Instruction Fuzzy Hash: DE61C570A08A1C8FDF94EF68D899BACBBF1FF59301F5041AAD04DE7251CA75A881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED4E22 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d33bd9c47b77a09129ed57d5204ca3e995669a9f273ef194239594c92e4c054
Instruction ID: ffc47edc5ffbfd788918b7196294169d18d882032ea87dd87a68da1648a98db9
Opcode Fuzzy Hash: 0d33bd9c47b77a09129ed57d5204ca3e995669a9f273ef194239594c92e4c054
Instruction Fuzzy Hash: 67619D30C0961ACFEB6ADB14C805BE9B7B0FF51704F2042B9D56DD71A1DB787A598B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED1531 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c2ab05f0e5da70fe7bb57bedb386824874138c46f43a9ff9b8a32a2a71c417
Instruction ID: d7d915496c601aa4faf445894c844bfada72becc59216c24b5274a46ae198728
Opcode Fuzzy Hash: d1c2ab05f0e5da70fe7bb57bedb386824874138c46f43a9ff9b8a32a2a71c417
Instruction Fuzzy Hash: 4041DB308AF24B8AE642BB7054AE6FE6B60DF02B14F682D75E0B8D2083CD9C75258250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED17D1 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa95f1e75f8e402022facbb956912fd69e9be454af3a3555c2abf14fcf561fc6
Instruction ID: 8f75e6d50d1c0e606045ee76d898651473f32108d9a6944546de38484c59d978
Opcode Fuzzy Hash: aa95f1e75f8e402022facbb956912fd69e9be454af3a3555c2abf14fcf561fc6
Instruction Fuzzy Hash: 9C31DC31E1894E8EE786EBA4D4203FDBBA1FF89310F549175D04DD32C2DEA838418750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED4FEC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9658e1ec92ce8abc9bace1a027cc56ecf70b8791c02585deb7d8023690706688
Instruction ID: b2be4b7dd7e539c70da72d7f4462c66424b4b54837b32918ca1e03fa189c9b06
Opcode Fuzzy Hash: 9658e1ec92ce8abc9bace1a027cc56ecf70b8791c02585deb7d8023690706688
Instruction Fuzzy Hash: DE21F630C1861A8FEB5ADF59C844BEEB3B0FF54704F1041A9D158A3295DB787A95CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED9394 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f931e09ea84a8bfcc6680b29ad79d622342a226765474a23451283f4ed5e1ab8
Instruction ID: 02edc792aa20e79e736299e0781b05f3411ff52034a108076bcc7b29fc7a0951
Opcode Fuzzy Hash: f931e09ea84a8bfcc6680b29ad79d622342a226765474a23451283f4ed5e1ab8
Instruction Fuzzy Hash: AE113B34A0A24B8EE709DB64C4506FDB7A0EF61319F60507AE06CDB1D3DD68BA10C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED929A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25ac9272bf77f95217c3a473c0184186844cf5b634049e6130d20de4da68d7
Instruction ID: 9ee9d40c65cef4ea1a6460e560e0467c165cb14cc0a6c6b251e7c93a20e72df6
Opcode Fuzzy Hash: 7b25ac9272bf77f95217c3a473c0184186844cf5b634049e6130d20de4da68d7
Instruction Fuzzy Hash: 8311BE30A0960ACBEB49EB54C4506FD72A1EF64318F605039E06DD72D2DE78B911C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED4FC2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb27407209c7cbe19bfbe255cb3344d71981dead50f0d25a98433b95c8761fb
Instruction ID: ff0c10cd417f63ec8db1389b6f0c9dff7f8aaa4ddbcbe9446ffd6f862e4a7be5
Opcode Fuzzy Hash: ddb27407209c7cbe19bfbe255cb3344d71981dead50f0d25a98433b95c8761fb
Instruction Fuzzy Hash: 1B017530C1AB5A8FDB9ADF18C854BE9B3B0FF44708F1041A8D468D3290DB787A568F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED4FD0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4669a99227600160ef966a86485138ebc76d8c4cf70ee9ff4b1122095c3638
Instruction ID: e4233e19e3a4656cff16fdc9bd5b04e803261ac5a2356084730bda985a3309e4
Opcode Fuzzy Hash: 7d4669a99227600160ef966a86485138ebc76d8c4cf70ee9ff4b1122095c3638
Instruction Fuzzy Hash: 46012530C1965A8FEB9ADF58C840BEDB3B0FF58704F200168D569D3290DB787A568B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED4FD9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3071beca5623e405daab90570af7760b705b65a589b844bc4b97590676f9df2
Instruction ID: 12d4fd9adce5a0a2b90bd1d891ce3506ec02102403cae55cfbbf1e758d7cf942
Opcode Fuzzy Hash: c3071beca5623e405daab90570af7760b705b65a589b844bc4b97590676f9df2
Instruction Fuzzy Hash: 1D014430C09A1A8FEB9ACF08C844BA9B3B0FF08708F1001A8D558E3290DB747A958F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED4FE3 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666c9bdecc39ac5b3fc930fba5435449dbf31de1393476180b04bc6056ac18f6
Instruction ID: dd5df528b14a8f9906a087bc9a3bd7fda272f28b9fea3e9718c6148e88e52064
Opcode Fuzzy Hash: 666c9bdecc39ac5b3fc930fba5435449dbf31de1393476180b04bc6056ac18f6
Instruction Fuzzy Hash: 0DF03C30C1961A8FEB9ADF58C445BEDB3B0EF14704F200168D569D3290DA747A558F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED78A1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbff63a0353e3853e0e94059cfa2fec8ba0578240d360c45ac26277168f0cc9
Instruction ID: 53165d4b8e5c5da1a11dc757d08485ef7b6db6bb432efb7cdc863e3eac21b22c
Opcode Fuzzy Hash: 3dbff63a0353e3853e0e94059cfa2fec8ba0578240d360c45ac26277168f0cc9
Instruction Fuzzy Hash: ACF01D71D05116CFEB5ADB20C855BE87260EB22710F5441BED06ED76E1DE7439898A50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A6ED7925 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.666279121.00007FF9A6ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A6ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff9a6ed0000_Ru66o6HYE6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ef8ae30b9f51cb6e28410c133af1f7743dbb1123e61b4f2dae0e96c5f52d47
Instruction ID: b728b7b128b4206aaa45ff582d732f7ef04ea3ca7632782bbcc508733d217527
Opcode Fuzzy Hash: 51ef8ae30b9f51cb6e28410c133af1f7743dbb1123e61b4f2dae0e96c5f52d47
Instruction Fuzzy Hash: AFE03031D0511A8EEB5ADB10C895BE972A0EB21710F5041FAD41ED31D1EE343A85CE50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ru66o6HYE6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Kraken Rat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Ru66o6HYE6.exePID: 6708, Parent PID: 3324

Windows Analysis Report
Ru66o6HYE6.exe