Overview

overview

8

Static

static

3

rats (some...rs.dll

windows7-x64

1

rats (some...rs.dll

windows10-2004-x64

1

rats (some...or.dll

windows7-x64

1

rats (some...or.dll

windows10-2004-x64

3

rats (some...or.exe

windows7-x64

7

rats (some...or.exe

windows10-2004-x64

7

rats (some...SP.dll

windows7-x64

3

rats (some...SP.dll

windows10-2004-x64

3

rats (some...ts.exe

windows7-x64

7

rats (some...ts.exe

windows10-2004-x64

7

rats (some...ts.exe

windows7-x64

7

rats (some...ts.exe

windows10-2004-x64

7

rats (some...64.exe

windows7-x64

7

rats (some...64.exe

windows10-2004-x64

7

rats (some...86.exe

windows7-x64

8

rats (some...86.exe

windows10-2004-x64

8

rats (some...64.exe

windows7-x64

7

rats (some...64.exe

windows10-2004-x64

7

rats (some...86.exe

windows7-x64

7

rats (some...86.exe

windows10-2004-x64

7

rats (some...64.exe

windows7-x64

7

rats (some...64.exe

windows10-2004-x64

7

rats (some...86.exe

windows7-x64

7

rats (some...86.exe

windows10-2004-x64

7

rats (some...64.exe

windows7-x64

7

rats (some...64.exe

windows10-2004-x64

7

rats (some...86.exe

windows7-x64

7

rats (some...86.exe

windows10-2004-x64

7

rats (some...64.exe

windows7-x64

7

rats (some...64.exe

windows10-2004-x64

7

rats (some...86.exe

windows7-x64

7

rats (some...86.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rats (some other than java).zip

  • Size

    154.6MB

  • Sample

    230503-t3x2lafd34

  • MD5

    a13878137e6bc9bc2ac1e4e57bd1e476

  • SHA1

    ea80f5187eed45e5ebeaff4185c55a00615b9715

  • SHA256

    7267ad085257a95ab1858fa599d5f7c761bc802dcf2b53d9114952b84923d9b0

  • SHA512

    d3bfa6d2b7a61aac7d22b6b92861a00bffed9d40f2ed4099343e8d081921a6d33fa51a27644b56f8df8f5354e299937078c385e3ad8dac991cf8669792a6a41a

  • SSDEEP

    3145728:6Fx/JvQxY8QMFqNyxH/djJNUBYEXL/qQHo0lOA1PO091GKenUAzz2:QhqqyNPmBYEXrqso0lOAB+KenUAf2

Score
8/10
discoverypersistencepyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      rats (some other than java)/Detours.dll

    • Size

      117KB

    • MD5

      b4bf736edbe89ebc57c5fb7d82941d01

    • SHA1

      d73c77800118092e9689f205dec4ac512df62ec1

    • SHA256

      45055a71a4af629d6f4bf535838b3a162779ee6c731707ae89efb36471643bb4

    • SHA512

      ee084dd6316a2caa27b3224f25b1620138925b9bcabd852cc3c6844acb9a2ac69ec955b8ad7e6818eda1d409f927e26670321d3628c143aef93106a7ba307c33

    • SSDEEP

      1536:Kz53XybrnqEZigIw4OQhQRyJWyvov8d8T8885iea+HBpj5dEpNgm:KFyX/ZbI7OQhTJhQ0d5Bp3EIm

    Score
    1/10
    behavioral1behavioral2

    • Target

      rats (some other than java)/Injector.dll

    • Size

      19KB

    • MD5

      5b3d08fbabb03da2b25e2226af01e75f

    • SHA1

      526ac1a84195b287bc1aef2cfcbe58a44e9b5cbc

    • SHA256

      533fd331803d73ea25569d4294bd77dd186f16a4e06a39bb6a103003283db427

    • SHA512

      b8bd7c08f70a8c35c0cf5ae55e25d03ca3e4a13d6e08e02719b9ac19755190a744b54052dd637e5423defb1a56410e82b18755c41997d52c1cbb9d1f9e38b798

    • SSDEEP

      384:ZOb8xZszrOyeI75BcudM/iioSDMBDhLf/ndDGD0CgtCYxOBa6:cQxZdI7K/DMhT/dD609wQOBX

    Score
    3/10
    behavioral3behavioral4

    • Target

      rats (some other than java)/Injector.exe

    • Size

      19.8MB

    • MD5

      599cc1d720ba43152c57bc011581040f

    • SHA1

      36e55579af64e400f77cf276be8205d33afe2f48

    • SHA256

      a1c3e4fd069ccb4db26d9bab90ef247ea217b26200c29a01de47c7b6cfe03f39

    • SHA512

      31a8c15ec4b337dfa457ba4cd2c1f4184deb82146540d4e1387fb1848a545992b678c06431886adeed6d773ea14c94a4750b31fc0939204989a7c4961a12a84e

    • SSDEEP

      393216:cSxAlnOFkx482kVzeeul4/m3pWFqyEgsS1+v88umEHqpKVPq7:cTlOqx4fkMP4K9BeRVy

    Score
    7/10
    upxspywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral5behavioral6

    • Target

      rats (some other than java)/MinecraftESP.dll

    • Size

      3.2MB

    • MD5

      b395598c7d1c57e1f63f2206897fd0c5

    • SHA1

      c14f603edeea1c76973edaa49afb78855d10e285

    • SHA256

      ec9df815686b778a097ff0a46651a6b93b88014bcfc8c68be07167f9e0f0d64f

    • SHA512

      33c834ac5ae1b7e58bfc85297ce53f91f62a0ad688358b51389c5db733ea6d856c40590f4ef4ae4ee72fca3c780e8efb97ca4766f2cce578a3ff37ae6dc7a62e

    • SSDEEP

      49152:X+htTdO2aFRTDBiRlmPvJbZpYQuFJ0ZMFicaC:Xr3cqvhHn

    Score
    3/10
    behavioral7behavioral8

    • Target

      rats (some other than java)/Requirements.exe

    • Size

      19.2MB

    • MD5

      d7f26e8bcb4f0c95891c3578ae3b42fc

    • SHA1

      a9a17170502911c7a4874255229d48099dfc17ff

    • SHA256

      2627a167692e954f03bad0fc22e2191c8169f637fc3f2374b26dc8150e748324

    • SHA512

      81a60b7e14fb5bed40b86ebc89831e92f749c2d55f750d04999e470b830bb15001c2a5de2c87e00369063566dd29b1c3fabf4a0852ac42430d2009020618107c

    • SSDEEP

      393216:tu7L/zKJhooqHsdQuslN/m3ppl96voWOv+9fI9BJHVSwona+dSRqPD:tCLLKJ+zHsdQu4KfQvorvSQ13o5h

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral10behavioral9

    • Target

      rats (some other than java)/Requirments.exe

    • Size

      19.2MB

    • MD5

      8fb4bf6d68c8a7da09fd48db5a9e4120

    • SHA1

      fe717bac44ecb0f6be470ab47b824f44c0b27b63

    • SHA256

      a083d470b02fac1847e2f8040287908fb774825752665f63b340b2b89c5f76ea

    • SHA512

      de25a6aef6044afbae7f05428cb6dc282878597ccd7ec9f9bbf02afd18cafcb55d998d22b471d0c220d83bfbf5029f04e7dddda1c2da5442150d3f7946357a7e

    • SSDEEP

      393216:qu7L/zKJhooqHsdQuslN/m3ppl96voWOv+9fI9BJHUkltA04SeY5j:qCLLKJ+zHsdQu4KfQvorvSQ10ue0

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral11behavioral12

    • Target

      rats (some other than java)/vcredist2005_x64.exe

    • Size

      3.0MB

    • MD5

      56eaf4e1237c974f6984edc93972c123

    • SHA1

      ee916012783024dac67fc606457377932c826f05

    • SHA256

      0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0

    • SHA512

      f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736

    • SSDEEP

      49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN

    Score
    7/10
    persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14

    • Target

      rats (some other than java)/vcredist2005_x86.exe

    • Size

      2.6MB

    • MD5

      ce2922f83fb4b170affce0ea448b107b

    • SHA1

      b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847

    • SHA256

      4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29

    • SHA512

      e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0

    • SSDEEP

      49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral15behavioral16

    • Target

      rats (some other than java)/vcredist2008_x64.exe

    • Size

      5.0MB

    • MD5

      e2ada570911edaaae7d1b3c979345fce

    • SHA1

      a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

    • SHA256

      b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

    • SHA512

      b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

    • SSDEEP

      98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral17behavioral18

    • Target

      rats (some other than java)/vcredist2008_x86.exe

    • Size

      4.3MB

    • MD5

      35da2bf2befd998980a495b6f4f55e60

    • SHA1

      470640aa4bb7db8e69196b5edb0010933569e98d

    • SHA256

      6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

    • SHA512

      bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

    • SSDEEP

      98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral19behavioral20

    • Target

      rats (some other than java)/vcredist2010_x64.exe

    • Size

      9.8MB

    • MD5

      c9d9eebccef20d637f193490cec05e79

    • SHA1

      15d032d669078aa6f0f7fd1cbf4115a070bd034d

    • SHA256

      cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223

    • SHA512

      24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

    • SSDEEP

      196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral21behavioral22

    • Target

      rats (some other than java)/vcredist2010_x86.exe

    • Size

      8.6MB

    • MD5

      1801436936e64598bab5b87b37dc7f87

    • SHA1

      28c54491be70c38c97849c3d8cfbfdd0d3c515cb

    • SHA256

      67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d

    • SHA512

      0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

    • SSDEEP

      196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral23behavioral24

    • Target

      rats (some other than java)/vcredist2012_x64.exe

    • Size

      6.9MB

    • MD5

      3c03562b5af9ed347614053d459d7778

    • SHA1

      1a5d93dddbc431ab27b1da711cd3370891542797

    • SHA256

      681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064

    • SHA512

      6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75

    • SSDEEP

      98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral25behavioral26

    • Target

      rats (some other than java)/vcredist2012_x86.exe

    • Size

      6.3MB

    • MD5

      7f52a19ecaf7db3c163dd164be3e592e

    • SHA1

      96b377a27ac5445328cbaae210fc4f0aaa750d3f

    • SHA256

      b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386

    • SHA512

      60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b

    • SSDEEP

      196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral27behavioral28

    • Target

      rats (some other than java)/vcredist2013_x64.exe

    • Size

      6.9MB

    • MD5

      49b1164f8e95ec6409ea83cdb352d8da

    • SHA1

      1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

    • SHA256

      a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

    • SHA512

      29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

    • SSDEEP

      196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral29behavioral30

    • Target

      rats (some other than java)/vcredist2013_x86.exe

    • Size

      6.2MB

    • MD5

      38a1b890ce847167d16567cf7b7a5642

    • SHA1

      0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

    • SHA256

      53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

    • SHA512

      907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

    • SSDEEP

      196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v6

Tasks

static1

pyinstaller
Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
3/10

behavioral5

upx
Score
7/10

behavioral6

spywarestealerupx
Score
7/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
7/10

behavioral10

spywarestealer
Score
7/10

behavioral11

Score
7/10

behavioral12

spywarestealer
Score
7/10

behavioral13

persistence
Score
7/10

behavioral14

persistence
Score
7/10

behavioral15

persistence
Score
8/10

behavioral16

persistence
Score
8/10

behavioral17

Score
7/10

behavioral18

Score
7/10

behavioral19

Score
7/10

behavioral20

Score
7/10

behavioral21

Score
7/10

behavioral22

Score
7/10

behavioral23

Score
7/10

behavioral24

Score
7/10

behavioral25

discovery
Score
7/10

behavioral26

discovery
Score
7/10

behavioral27

discovery
Score
7/10

behavioral28

discovery
Score
7/10

behavioral29

discovery
Score
7/10

behavioral30

discovery
Score
7/10

behavioral31

discovery
Score
7/10

behavioral32

discovery
Score
7/10