General
-
Target
Pass_10101-NewFileV2_CFU78.rar
-
Size
6.3MB
-
Sample
221128-wm7l7seb89
-
MD5
6d4c1453a75f6be22614d82a614b0e0f
-
SHA1
7d3b779a297307d663ea494ffe8a0648dcbb0059
-
SHA256
547b22253ae2238469fab07049029807ea9e119a0c03e77e2bf9bb1461c9acf8
-
SHA512
b692a6e1af4993cfb808b8601d16773196c1200e4ea9e88b37b1b9cf39332c9106fc89f930b06e3be744ba09dde131bd70ded6c4a2920349de5cd86b55f83e94
-
SSDEEP
196608:kdyGhvmNAHowj4qoNgnKHcnk+ELi+pNRj/mgi/cEj:kdywmyJj4qOgKEO/2
Static task
static1
Behavioral task
behavioral1
Sample
File_Here.rar
Resource
win7-20220812-es
Behavioral task
behavioral2
Sample
File_Here.rar
Resource
win10v2004-20220812-es
Behavioral task
behavioral3
Sample
read.me.txt
Resource
win7-20220812-es
Behavioral task
behavioral4
Sample
read.me.txt
Resource
win10v2004-20221111-es
Malware Config
Extracted
cryptbot
http://tystne110.top/gate.php
-
payload_url
http://pabryd01.top/firlot.dat
Targets
-
-
Target
File_Here.rar
-
Size
6.3MB
-
MD5
4d195ff23b4a560f16250281850c7b4a
-
SHA1
1d8a2b40f0f2f9a463c95f5840ecc8f48ff4f224
-
SHA256
3a98c3bb0728e42c7f8e6e2492ddbbeff3a87413b51390bb52b3a33584530ee4
-
SHA512
6d69d168b1cce34c328c1724fedfe0348e0b64ec346c0efa12d0aec93e32adf15353f69626ea5827e02d968674c3c673851a58fa3f9321d2c70739a13d193c85
-
SSDEEP
196608:hdyGhvmNAHowj4qoNgnKHcnk+ELi+pNRj/mgi/cE1:hdywmyJj4qOgKEO/8
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
read.me.txt
-
Size
169B
-
MD5
f16c83b6077119948a5436c220689924
-
SHA1
884f1ce8af3c19054800e0a87bf716b5dc6d0577
-
SHA256
68d49e3f237f0384b4f09103151fff0557e66b390234e4033c0ac39f6ba36d27
-
SHA512
b89e4e6f8357c268285adc91fdb7d096ef8a6fc59c288d6ced27b7d077753814e3ddefe9a40987673aad40b541f275b27be7f30d6c8df619ef8370eca3342567
Score1/10 -