Edit tour

Windows Analysis Report
Ru66o6HYE6.exe

Overview

General Information

Sample Name:	Ru66o6HYE6.exe
Original Sample Name:	0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515.exe
Analysis ID:	884341
MD5:	a8a2e3100a56c891b16cd7503e4b03ae
SHA1:	e5313848436433842b4d932e3ddfc408bb20337a
SHA256:	0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515
Tags:	exeMassLogger
Infos:

Detection

Kraken Rat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Kraken Rat

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Contains functionality to capture screen (.Net source)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Found inlined nop instructions (likely shell or obfuscated code)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Binary contains a suspicious time stamp

Detected potential crypto function

Yara detected Credential Stealer

Potential time zone aware malware

Program does not show much activity (idle)

Enables debug privileges

Classification

Process Tree

System is w10x64

Ru66o6HYE6.exe (PID: 6708 cmdline: C:\Users\user\Desktop\Ru66o6HYE6.exe MD5: A8A2E3100A56C891B16CD7503E4B03AE)

cleanup

Malware Configuration

Threatname: Kraken Rat

{"Exfil Mode": "SMTP", "From": "david@product-secured.com", "Password": "H?G7iEWK_W0R##2#", "To": "premium251.web-hosting.com", "Port": "587"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Ru66o6HYE6.exe	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
Ru66o6HYE6.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Ru66o6HYE6.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Ru66o6HYE6.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe394:$s1: UnHook 0xe39b:$s2: SetHook 0xe3a3:$s3: CallNextHook 0xe3b0:$s4: _hook
Ru66o6HYE6.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd66a:$a1: get_encryptedPassword 0xd9ff:$a2: get_encryptedUsername 0xd414:$a3: get_timePasswordChanged 0xd51a:$a4: get_passwordField 0xd680:$a5: set_encryptedPassword 0xf25d:$a7: get_logins 0xef2b:$a8: GetOutlookPasswords 0xec73:$a9: StartKeylogger 0xf194:$a10: KeyLoggerEventArgs 0xec82:$a11: KeyLoggerEventArgsEventHandler

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd46a:$a1: get_encryptedPassword 0xd7ff:$a2: get_encryptedUsername 0xd214:$a3: get_timePasswordChanged 0xd31a:$a4: get_passwordField 0xd480:$a5: set_encryptedPassword 0xf05d:$a7: get_logins 0xed2b:$a8: GetOutlookPasswords 0xea73:$a9: StartKeylogger 0xef94:$a10: KeyLoggerEventArgs 0xea82:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Ru66o6HYE6.exe PID: 6708	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
Process Memory Space: Ru66o6HYE6.exe PID: 6708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ru66o6HYE6.exe PID: 6708	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x19b59:$a1: get_encryptedPassword 0x19edf:$a2: get_encryptedUsername 0x19917:$a3: get_timePasswordChanged 0x19a1d:$a4: get_passwordField 0x19b6f:$a5: set_encryptedPassword 0x1b6f3:$a7: get_logins 0x1b3c1:$a8: GetOutlookPasswords 0x1b109:$a9: StartKeylogger 0x1b62a:$a10: KeyLoggerEventArgs 0x1b118:$a11: KeyLoggerEventArgsEventHandler
decrypted.binstr	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
decrypted.binstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Ru66o6HYE6.exe.400000.0.unpack	JoeSecurity_KrakenRat	Yara detected Kraken Rat	Joe Security
0.0.Ru66o6HYE6.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Ru66o6HYE6.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Ru66o6HYE6.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe394:$s1: UnHook 0xe39b:$s2: SetHook 0xe3a3:$s3: CallNextHook 0xe3b0:$s4: _hook
0.0.Ru66o6HYE6.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd66a:$a1: get_encryptedPassword 0xd9ff:$a2: get_encryptedUsername 0xd414:$a3: get_timePasswordChanged 0xd51a:$a4: get_passwordField 0xd680:$a5: set_encryptedPassword 0xf25d:$a7: get_logins 0xef2b:$a8: GetOutlookPasswords 0xec73:$a9: StartKeylogger 0xf194:$a10: KeyLoggerEventArgs 0xec82:$a11: KeyLoggerEventArgsEventHandler

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Ru66o6HYE6.exe

Avira: detected

Found malware configuration

Source: Ru66o6HYE6.exe

Malware Configuration Extractor: Kraken Rat {"Exfil Mode": "SMTP", "From": "david@product-secured.com", "Password": "H?G7iEWK_W0R##2#", "To": "premium251.web-hosting.com", "Port": "587"}

Multi AV Scanner detection for submitted file

Source: Ru66o6HYE6.exe	ReversingLabs: Detection: 51%
Source: Ru66o6HYE6.exe	Virustotal: Detection: 68%			Perma Link

Machine Learning detection for sample

Source: Ru66o6HYE6.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: Ru66o6HYE6.exe	String decryptor: david@product-secured.com
Source: Ru66o6HYE6.exe	String decryptor: H?G7iEWK_W0R##2#
Source: Ru66o6HYE6.exe	String decryptor: premium251.web-hosting.com
Source: Ru66o6HYE6.exe	String decryptor: 587
Source: Ru66o6HYE6.exe	String decryptor: WinForms_RecursiveFormCreate
Source: Ru66o6HYE6.exe	String decryptor: WinForms_SeeInnerException
Source: Ru66o6HYE6.exe	String decryptor: KrakenStub.Resources
Source: Ru66o6HYE6.exe	String decryptor: 1
Source: Ru66o6HYE6.exe	String decryptor: %True%
Source: Ru66o6HYE6.exe	String decryptor: swCpiTiAhkkEpyDZTnAGhOBZpr
Source: Ru66o6HYE6.exe	String decryptor: True
Source: Ru66o6HYE6.exe	String decryptor: \|System Info\|System Name:
Source: Ru66o6HYE6.exe	String decryptor: Time:
Source: Ru66o6HYE6.exe	String decryptor: Date:
Source: Ru66o6HYE6.exe	String decryptor: ========\|Recovered Data\|========
Source: Ru66o6HYE6.exe	String decryptor: XmyFntc+2Mr9D8a8cIRGva7Yqa591pNDLqAR8rdY1k4=
Source: Ru66o6HYE6.exe	String decryptor: zGXhVxursUWx/Mqn01W8YxHaxPhhjF+P
Source: Ru66o6HYE6.exe	String decryptor: g6iqdQx6uSAFv0MppdYExCCYh6Ky5jTt0T2NBhI/KWg=
Source: Ru66o6HYE6.exe	String decryptor: VqONpyzLqFY=
Source: Ru66o6HYE6.exe	String decryptor: EdrE+GGMX48=
Source: Ru66o6HYE6.exe	String decryptor: KRK
Source: Ru66o6HYE6.exe	String decryptor: ------------------------
Source: Ru66o6HYE6.exe	String decryptor: x
Source: Ru66o6HYE6.exe	String decryptor: Content-Type
Source: Ru66o6HYE6.exe	String decryptor: multipart/form-data; boundary=
Source: Ru66o6HYE6.exe	String decryptor: --{0}Content-Disposition: form-data; name="document"; filename="{1}"Content-Type: {2}{3}--{0}--
Source: Ru66o6HYE6.exe	String decryptor: POST
Source: Ru66o6HYE6.exe	String decryptor: https://api.telegram.org/bot
Source: Ru66o6HYE6.exe	String decryptor: /sendMessage?chat_id=
Source: Ru66o6HYE6.exe	String decryptor: &text=
Source: Ru66o6HYE6.exe	String decryptor: utf-8
Source: Ru66o6HYE6.exe	String decryptor: /
Source: Ru66o6HYE6.exe	String decryptor: user-agent
Source: Ru66o6HYE6.exe	String decryptor: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Source: Ru66o6HYE6.exe	String decryptor: http://checkip.dyndns.org/
Source: Ru66o6HYE6.exe	String decryptor: <html><head><title>Current IP Check</title></head><body>
Source: Ru66o6HYE6.exe	String decryptor: </body></html>
Source: Ru66o6HYE6.exe	String decryptor: Current IP Address:
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: .
Source: Ru66o6HYE6.exe	String decryptor: {.}
Source: Ru66o6HYE6.exe	String decryptor: http
Source: Ru66o6HYE6.exe	String decryptor: {http}
Source: Ru66o6HYE6.exe	String decryptor: 0
Source: Ru66o6HYE6.exe	String decryptor: Create
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Clipboard_
Source: Ru66o6HYE6.exe	String decryptor: .txt
Source: Ru66o6HYE6.exe	String decryptor: STOR
Source: Ru66o6HYE6.exe	String decryptor: Recovered From:
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: Clipboard.txt
Source: Ru66o6HYE6.exe	String decryptor: text/plain
Source: Ru66o6HYE6.exe	String decryptor: 2
Source: Ru66o6HYE6.exe	String decryptor: /sendDocument?chat_id=
Source: Ru66o6HYE6.exe	String decryptor: &caption=
Source: Ru66o6HYE6.exe	String decryptor: System IP:
Source: Ru66o6HYE6.exe	String decryptor: KrakenClipboardLog.txt
Source: Ru66o6HYE6.exe	String decryptor: application/x-ms-dos-executable
Source: Ru66o6HYE6.exe	String decryptor: RecoveredDisplayShot
Source: Ru66o6HYE6.exe	String decryptor: .png
Source: Ru66o6HYE6.exe	String decryptor: \Kraken
Source: Ru66o6HYE6.exe	String decryptor: \Kraken\
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Screenshot_
Source: Ru66o6HYE6.exe	String decryptor: Recovered Screenshot From:
Source: Ru66o6HYE6.exe	String decryptor: Recovered Keylogs From:
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Keylogs_
Source: Ru66o6HYE6.exe	String decryptor: RecoveredKeylogs.txt
Source: Ru66o6HYE6.exe	String decryptor: Keylogs Recovered From:
Source: Ru66o6HYE6.exe	String decryptor: KrakenKeylogs.txt
Source: Ru66o6HYE6.exe	String decryptor: [ -- {0} -- ]
Source: Ru66o6HYE6.exe	String decryptor: {0}
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: Kraken_Password_
Source: Ru66o6HYE6.exe	String decryptor: RecoveredPassword.txt
Source: Ru66o6HYE6.exe	String decryptor: RecoveredLogins.txt
Source: Ru66o6HYE6.exe	String decryptor: 300000
Source: Ru66o6HYE6.exe	String decryptor: [
Source: Ru66o6HYE6.exe	String decryptor: ]
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: [ENTR]
Source: Ru66o6HYE6.exe	String decryptor: [TAP]
Source: Ru66o6HYE6.exe	String decryptor: ObjectLength
Source: Ru66o6HYE6.exe	String decryptor: ChainingModeGCM
Source: Ru66o6HYE6.exe	String decryptor: AuthTagLength
Source: Ru66o6HYE6.exe	String decryptor: ChainingMode
Source: Ru66o6HYE6.exe	String decryptor: KeyDataBlob
Source: Ru66o6HYE6.exe	String decryptor: AES
Source: Ru66o6HYE6.exe	String decryptor: Microsoft Primitive Provider
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptDecrypt() (get size) failed with status code: {0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptDecrypt(): authentication tag mismatch
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptDecrypt() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptOpenAlgorithmProvider() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptSetAlgorithmProperty(BCrypt.BCRYPT_CHAINING_MODE, BCrypt.BCRYPT_CHAIN_MODE_GCM) failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptImportKey() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptGetProperty() (get size) failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: BCrypt.BCryptGetProperty() failed with status code:{0}
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Outlook \| =====URL:
Source: Ru66o6HYE6.exe	String decryptor: E-Mail:
Source: Ru66o6HYE6.exe	String decryptor: K-Password:
Source: Ru66o6HYE6.exe	String decryptor: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Source: Ru66o6HYE6.exe	String decryptor: IMAP Password
Source: Ru66o6HYE6.exe	String decryptor: POP3 Password
Source: Ru66o6HYE6.exe	String decryptor: HTTP Password
Source: Ru66o6HYE6.exe	String decryptor: SMTP Password
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: Ru66o6HYE6.exe	String decryptor: Email
Source: Ru66o6HYE6.exe	String decryptor: GetBytes
Source: Ru66o6HYE6.exe	String decryptor: SMTP Server
Source: Ru66o6HYE6.exe	String decryptor: Nothing
Source: Ru66o6HYE6.exe	String decryptor:
Source: Ru66o6HYE6.exe	String decryptor: Outlook
Source: Ru66o6HYE6.exe	String decryptor: Foxmail
Source: Ru66o6HYE6.exe	String decryptor: SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command
Source: Ru66o6HYE6.exe	String decryptor: Foxmail.exe
Source: Ru66o6HYE6.exe	String decryptor: "
Source: Ru66o6HYE6.exe	String decryptor: Storage\
Source: Ru66o6HYE6.exe	String decryptor: \
Source: Ru66o6HYE6.exe	String decryptor: \Accounts\Account.rec0
Source: Ru66o6HYE6.exe	String decryptor: Account
Source: Ru66o6HYE6.exe	String decryptor: POP3Account
Source: Ru66o6HYE6.exe	String decryptor: Password
Source: Ru66o6HYE6.exe	String decryptor: POP3Password
Source: Ru66o6HYE6.exe	String decryptor: !
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Foxmail \| =====
Source: Ru66o6HYE6.exe	String decryptor: E-Mail: {0}
Source: Ru66o6HYE6.exe	String decryptor: K-Password: {0}
Source: Ru66o6HYE6.exe	String decryptor: 5A
Source: Ru66o6HYE6.exe	String decryptor: 71
Source: Ru66o6HYE6.exe	String decryptor: v10
Source: Ru66o6HYE6.exe	String decryptor: \Local State
Source: Ru66o6HYE6.exe	String decryptor: "encrypted_key":"(.*?)"
Source: Ru66o6HYE6.exe	String decryptor: \MapleStudio\ChromePlus\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: logins
Source: Ru66o6HYE6.exe	String decryptor: origin_url
Source: Ru66o6HYE6.exe	String decryptor: username_value
Source: Ru66o6HYE6.exe	String decryptor: password_value
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Coolnovo Browser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: K-Username:
Source: Ru66o6HYE6.exe	String decryptor: \CatalinaGroup\Citrio\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - CitrioBrowser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Google\Chrome SxS\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chrome Canary \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Google\Chrome\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chrome \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \CocCoc\Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Coccoc Browser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Tencent\QQBrowser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: \Vivaldi\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: \Chromium\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chromium \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \CentBrowser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Cent \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Chedot\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chedot \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \360Browser\Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - 360 English \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \360Chrome\Chrome\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - 360 China \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \BraveSoftware\Brave-Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Brave \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Torch\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Torch \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \UCBrowser\User Data_i18n\Default\UC Login Data.18
Source: Ru66o6HYE6.exe	String decryptor: wow_logins
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - UC \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Blisk\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Blisk \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Epic Privacy Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - EpicBrowser \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: \Microsoft\Edge\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Microsoft Edge \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: ataD nigoL\elbatS arepO\erawtfoS arepO\
Source: Ru66o6HYE6.exe	String decryptor: tad.dnaw\eliforp\arepO\arepO\
Source: Ru66o6HYE6.exe	String decryptor: ReadTable
Source: Ru66o6HYE6.exe	String decryptor: snigol
Source: Ru66o6HYE6.exe	String decryptor: GetRowCount
Source: Ru66o6HYE6.exe	String decryptor: GetValue
Source: Ru66o6HYE6.exe	String decryptor: lru_nigiro
Source: Ru66o6HYE6.exe	String decryptor: eulav_emanresu
Source: Ru66o6HYE6.exe	String decryptor: eulav_drowssap
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Opera \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\\|';:,<>/?+=
Source: Ru66o6HYE6.exe	String decryptor: APPDATA
Source: Ru66o6HYE6.exe	String decryptor: \FileZilla\recentservers.xml
Source: Ru66o6HYE6.exe	String decryptor: Host
Source: Ru66o6HYE6.exe	String decryptor: User
Source: Ru66o6HYE6.exe	String decryptor: Pass
Source: Ru66o6HYE6.exe	String decryptor: Port
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - FileZilla \| =====
Source: Ru66o6HYE6.exe	String decryptor: Host:
Source: Ru66o6HYE6.exe	String decryptor: Username:
Source: Ru66o6HYE6.exe	String decryptor: Password:
Source: Ru66o6HYE6.exe	String decryptor: Port:
Source: Ru66o6HYE6.exe	String decryptor: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Source: Ru66o6HYE6.exe	String decryptor: \AVAST Software\Browser\User Data\Default\Login Data
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Avast \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: (
Source: Ru66o6HYE6.exe	String decryptor: UNIQUE
Source: Ru66o6HYE6.exe	String decryptor: table
Source: Ru66o6HYE6.exe	String decryptor: Mozilla\Firefox\Profiles
Source: Ru66o6HYE6.exe	String decryptor: logins.json
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - FireFox \| =====Host:
Source: Ru66o6HYE6.exe	String decryptor: Thunderbird\Profiles\
Source: Ru66o6HYE6.exe	String decryptor: ===== \| Recovered - Chrome \| =====Found From: ThunderbirdHost:
Source: Ru66o6HYE6.exe	String decryptor: NSS_Shutdown
Source: Ru66o6HYE6.exe	String decryptor: PROGRAMFILES
Source: Ru66o6HYE6.exe	String decryptor: \Mozilla Thunderbird\
Source: Ru66o6HYE6.exe	String decryptor: \Mozilla Firefox\
Source: Ru66o6HYE6.exe	String decryptor: \mozglue.dll
Source: Ru66o6HYE6.exe	String decryptor: \nss3.dll
Source: Ru66o6HYE6.exe	String decryptor: NSS_Init
Source: Ru66o6HYE6.exe	String decryptor: PK11SDR_Decrypt

Source: Ru66o6HYE6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED3813h	0_2_00007FF9A6ED2BCC
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED2AC5h	0_2_00007FF9A6ED201D
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED404Dh	0_2_00007FF9A6ED3D5A
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED464Dh	0_2_00007FF9A6ED425D
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 4x nop then jmp 00007FF9A6ED464Dh	0_2_00007FF9A6ED455B

Networking

Yara detected Generic Downloader

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE

Source: Ru66o6HYE6.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: Ru66o6HYE6.exe	String found in binary or memory: https://api.telegram.org/bot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: Ru66o6HYE6.exe, KrakenStub/KrakenSteak.cs	.Net Code: TakeScreenshot
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	.Net Code: TakeScreenshot

System Summary

Malicious sample detected (through community Yara rule)

Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: Ru66o6HYE6.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Ru66o6HYE6.exe, 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKrakenStub.exe6 vs Ru66o6HYE6.exe
Source: Ru66o6HYE6.exe, 00000000.00000002.661915249.000000000085D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Ru66o6HYE6.exe
Source: Ru66o6HYE6.exe	Binary or memory string: OriginalFilenameKrakenStub.exe6 vs Ru66o6HYE6.exe

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Code function: 0_2_00007FF9A6ED201D

0_2_00007FF9A6ED201D

Source: Ru66o6HYE6.exe	ReversingLabs: Detection: 51%
Source: Ru66o6HYE6.exe	Virustotal: Detection: 68%

Source: Ru66o6HYE6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ru66o6HYE6.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/0

Source: Ru66o6HYE6.exe, KrakenStub/KrakenDumpedList.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: Ru66o6HYE6.exe, KrakenStub/KrakenSteak.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenDumpedList.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: Ru66o6HYE6.exe, 00000000.00000002.662388374.00000000026C2000.00000004.00000800.00020000.00000000.sdmp, Ru66o6HYE6.exe, 00000000.00000002.664019647.00000000126C1000.00000004.00000800.00020000.00000000.sdmp, Ru66o6HYE6.exe, 00000000.00000002.662388374.00000000026B6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Ru66o6HYE6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Ru66o6HYE6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED4E22 push edx; retf	0_2_00007FF9A6ED4F49
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED5CBD pushfd ; retf	0_2_00007FF9A6ED5CC1
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED4CA0 push ebx; retf	0_2_00007FF9A6ED4CA1
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6ED559B push esp; retf	0_2_00007FF9A6ED559C
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Code function: 0_2_00007FF9A6EDA132 push 00000008h; retf	0_2_00007FF9A6EDA134

Source: Ru66o6HYE6.exe

Static PE information: 0xE29D6504 [Sat Jun 24 05:37:08 2090 UTC]

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Process information queried: ProcessInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: Ru66o6HYE6.exe, KrakenStub/KrakenSteak.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: Ru66o6HYE6.exe, KrakenStub/FFDecryptor.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, KrakenStub/FFDecryptor.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Queries volume information: C:\Users\user\Desktop\Ru66o6HYE6.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Ru66o6HYE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Kraken Rat

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Ru66o6HYE6.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Kraken Rat

Source: Yara match	File source: Ru66o6HYE6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Ru66o6HYE6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.393140910.0000000000402000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ru66o6HYE6.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	Path Interception	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Email Collection	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	Automated E

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Ru66o6HYE6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Kraken Rat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ru66o6HYE6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Kraken Rat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Windows Analysis Report
Ru66o6HYE6.exe