Overview

overview

9

Static

static

7

BruteForce...te.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...32.exe

windows10-2004-x64

3

BruteForce....1.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...st.exe

windows10-2004-x64

7

BruteForce...O2.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...to.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...32.exe

windows10-2004-x64

7

BruteForce...AM.exe

windows10-2004-x64

9

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...ce.exe

windows10-2004-x64

9

BruteForce...te.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...gs.exe

windows10-2004-x64

7

BruteForce...te.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...mt.exe

windows10-2004-x64

5

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...ti.exe

windows10-2004-x64

1

BruteForce...ER.exe

windows10-2004-x64

7

BruteForce...ck.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...ET.exe

windows10-2004-x64

3

BruteForce...ce.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...ys.exe

windows10-2004-x64

1

BruteForce...AM.exe

windows10-2004-x64

7

BruteForce...er.exe

windows10-2004-x64

7

BruteForce...ml.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BruteForcers PACK.rar

  • Size

    68.9MB

  • Sample

    230623-2w21zahc28

  • MD5

    5944d016648545d293ff7c32714ae756

  • SHA1

    19d831af002fce36af94ed751a59be5ada48b319

  • SHA256

    bcb43e540324aec08aad7401c57c64000e7e4ccc20efa5f64072e7a664d9492f

  • SHA512

    b5b509761c7c11d8d42b1c9648f983f9a170143c0f4acc2f91bdc8cd14199544eeb6b30487f86c07645810db3f7e873541b758a0ee6f94dc30f3cae878c09a5a

  • SSDEEP

    786432:mj9knKsqOIq9KNFc0naLKNetbh8XzfxdlqO481dZcsW2yXcFf6WHGMJHZ80suMks:GavinaVhG1dW2OcQWHzHFw4+tFRf

Score
9/10
aspackv2discoveryevasionlinkpdfpersistencepyinstallerspywarestealerthemidatrojanupx

Malware Config

Targets

    • Target

      BruteForcers PACK/BruteForcers PACK/All Mail Brute/All Mail Brute.exe

    • Size

      197KB

    • MD5

      27b2673f2398ad5192e86b6356b6e95f

    • SHA1

      f4a3adbff9f5c028b99da4f4ea4478f4e34a70f3

    • SHA256

      895fdf94a6d75dfae1f0fde953577e3aa9ef6bcfbe60304aa73132eec654fecf

    • SHA512

      3cde231f52f6e9da78b88f0f6a8350e45fc7d08d86633de4a2c48e79a8566505cf6d7dbcb082898dc0e3596939cd52799211488d2947609211780be883163f30

    • SSDEEP

      3072:X4l/2zdPQliUF4eOU55mYUYUYYUYUYUhRiz75GZFe69jX:X6/pliAOU55fRw75GZFe+j

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

    • Target

      BruteForcers PACK/BruteForcers PACK/All Mail Brute/MailSoft/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral2

    • Target

      BruteForcers PACK/BruteForcers PACK/All Mail Brute/MailSoft/ssleay32.exe

    • Size

      4.1MB

    • MD5

      e768bbea30e671a8116f1eaa706c4d93

    • SHA1

      7159ad7082be7aa7f533ee88e364cfcc5c528deb

    • SHA256

      e436924a2fac62b5df8e77b588ce8e3f8c23075e1367c6c53fbca70ff3107e42

    • SHA512

      407ce9c8a367510a7c010da53a17f7ee218dc38cdd0882d4eb46e81e3e66126d943e5c5034f18a964c36d8260e8921ed088714a0e76793c51b30dd378750eeed

    • SSDEEP

      49152:PXNu1x0AwbFCsORuyFySj+EGQE06pHsQxHoabGyEVLThT6yB:PqwbFCPr9GSQxwV/

    Score
    3/10
    behavioral3

    • Target

      BruteForcers PACK/BruteForcers PACK/BTC BRUTE CHECKER 3.1/Bitcoin Brute Checker 3.1.exe

    • Size

      183KB

    • MD5

      ee99d0874e15a451904ca19b4c4b3707

    • SHA1

      b45b61fb965dc6c61f6389de830f16a9d4ce2a31

    • SHA256

      3d7f184f288ae23c94a3171428c1dbda7a8e79035760a19ce78c905f71934578

    • SHA512

      b77ee115e9683f68de63804324f6ecd5319155b5493ef7ddab3733195a5822507866b583f004392f55d70e7a6c542dfa67fe7eb51052c9ef3a8a82ca4e6ef775

    • SSDEEP

      768:nec4lj/GeePn4RO0ngaUy1wbFWrNNVSeKG5ZxZPt+4L+gn7nQtgnggnGk/SV3Wn3:p4llePqrgcw0bVDDxJtJKgSTQl

    Score
    7/10
    persistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral4

    • Target

      BruteForcers PACK/BruteForcers PACK/BTC BRUTE CHECKER 3.1/dllsys/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral5

    • Target

      BruteForcers PACK/BruteForcers PACK/BTC BRUTE CHECKER 3.1/dllsys/bchainHost.exe

    • Size

      523KB

    • MD5

      b2c404ca1131f26172840d5a8ebe057d

    • SHA1

      4e9c9722d3516212cde254a812e4c653756ab643

    • SHA256

      e45b782daa60730a5d52bb4c59856e98fb073ecd7b5dc47eeeecd2c7fe46e9c1

    • SHA512

      e4dc9ff863b75a298a1e139feabd1455aec0f822def9811e7fc814474e7b15637f17febc2f3c1af17933d29756c69d5cf38a1ce3a2aa4ea0989afa7b850d1e1d

    • SSDEEP

      12288:m0v0okAQh7/ojoRgLwAQh7nQf+rEA2oYpB+BKVRoJbVaJup:R+DojfK8f+rEA2jpeVVaJu

    Score
    7/10
    discoveryspywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral6

    • Target

      BruteForcers PACK/BruteForcers PACK/Brute Force SEO EVO2/EVO2.exe

    • Size

      146KB

    • MD5

      f765db7bb988f0e2fd314d52adc39ea0

    • SHA1

      eb315f0b2579e802be2cebda4ae89938d3c47685

    • SHA256

      4fccc754e19102242a982e1aa025fd4c1457cb6b277c3bab33ed1d7ea1dcd330

    • SHA512

      fdacc0cb87bbd80599746363ade50d3f47c44a27300b4d8bac8bc1763a9f59d274e80e5c4f56545efd397f162586371d1d01ac92276c2953fdb896312ac34a29

    • SSDEEP

      1536:UX4l5eP5VXdLXrnu2lAK/8n7cJCrHj899WZoZfKZKqK3YWPTnsxn0uIPE:UX4l50LPlroHj8XWZ0fmK5IHxn8M

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral7

    • Target

      BruteForcers PACK/BruteForcers PACK/Brute Force SEO EVO2/library/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral8

    • Target

      BruteForcers PACK/BruteForcers PACK/Cracked Amazon Brute By JLXP Crew/Amazon Brute By Erganto.exe

    • Size

      185KB

    • MD5

      69c8af379628492df07fff92dc91964f

    • SHA1

      c627d28e839f0a9a62f4262e936bc5ccc11e2714

    • SHA256

      568ed0eb65b1c9c1ac34eb7f0b5660f3349cd134fd856e6e20cf03e68056ef7f

    • SHA512

      2a7b61f4e1a1820eb9a3ea505e21a15bb1a04f342480a509bfef1d117aa8c83c3eeffd388c824738fd2afb25006aaeef0b03de377dcef2122b0a4c437d6d96f5

    • SSDEEP

      1536:A4l/ePOr942zytUK9rS7RhhBBIMBBuixi16o0fDjH3CIyHCD:A4l/OhtoIMg0nH3C5CD

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral9

    • Target

      BruteForcers PACK/BruteForcers PACK/Cracked Amazon Brute By JLXP Crew/procs/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral10

    • Target

      BruteForcers PACK/BruteForcers PACK/Cracked Amazon Brute By JLXP Crew/procs/dllx32.exe

    • Size

      7.9MB

    • MD5

      70d42180dbb9ff89bc79d99e78945752

    • SHA1

      3d176acfba753f965a6c32bdb11c28a0e77b7955

    • SHA256

      78f600b0144385220d63cf10187bbf50b4f7438baab3a10f98c5cb2f278ef0b5

    • SHA512

      e0ca4274f6491459226b14254c70e2a169f98bac948b3608496c4723704315d19650f36ace87ecfdede702d0ff14866c4f43d9e131cc166bee079690e0bba3c3

    • SSDEEP

      196608:mOYn3evL70e2o6XIhZIM8TMa7PvBA7a4Y9UKCDptVfmERqW:++70e254QM8xA7fQnC1Ld

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer
    behavioral11

    • Target

      BruteForcers PACK/BruteForcers PACK/ExpressVPN Brute Checker By ACTEAM/ExpressVPN Brute Checker By ACTEAM.exe

    • Size

      80KB

    • MD5

      67c53c8cf5faff4da38063cd7de832b3

    • SHA1

      0df706d85d02f359752d8ef4ac3cef232f131264

    • SHA256

      3b39172bf247c3c298c9f7a675d11faafb5919e18ecab0a6e7a640332baf9f71

    • SHA512

      0fc77fa0c2a6fb8507dfb82e1ec5ae80d92e9492395b0b0283b8d9f46f14f464523732b0c35b19f262d40ee466344b5bef7efe737ea66a085575bf62e9abac2a

    • SSDEEP

      1536:24lnePnRhNZ+/t5SWhtohmdTYOrJGWU4LjtxNvvxY9Pzn:24lnoqt5SWhtohWTYU7LjtDXxY9Pzn

    Score
    9/10
    evasionpersistencethemida

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral12

    • Target

      BruteForcers PACK/BruteForcers PACK/ExpressVPN Brute Checker By ACTEAM/forms/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral13

    • Target

      BruteForcers PACK/BruteForcers PACK/ExpressVPN Brute Checker By ACTEAM/forms/viewsource.exe

    • Size

      3.5MB

    • MD5

      95e34cb7ec74b0308313608cdad5ff80

    • SHA1

      8c6606080b89b23a32c39a5e8c354f6f846662f4

    • SHA256

      4df2aba56452a16140064c81e5ab3708f8b05176ef9f6ad926848517fc31555d

    • SHA512

      5ac070acc62fcb93b12465820f11943a9e02bda13c151fe76bf2eb967639ad6656797895d62d3347f8ba2c25ad731d7a7a332479dbe4e9ea7986d9e71860ac23

    • SSDEEP

      98304:FhGOI7cg6bt6ZP25ypN9zPA8aY3OjkkGWf3rSPm4Hm:Fh7I7cg6JH8zI8H+jkkGWDoZG

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral14

    • Target

      BruteForcers PACK/BruteForcers PACK/FortNite Brute Checker 1 0 0 - Cracked By PC-RET/FortNite [Brute&Checker] 1.0.0 - [Cracked By PC-RET].exe

    • Size

      196KB

    • MD5

      2d26dc4d8ba0859eb95393d7fc7a4259

    • SHA1

      9265f6219a7cbf55c77b0125d2e9cef5ad34f132

    • SHA256

      c3b96a0b14c517c56e01e5eb795c6fcbb72a9d3c93f7360f8276cdad052a945a

    • SHA512

      17a4f0ae41c210ef9c265b24bb96520d08125b3d3538a15857d308b606e6d976d34ebb7e108e0fd4096bb25144a79c0b092984701464dc82094265e2149929ed

    • SSDEEP

      1536:Q4lHePnz1tO6UWOD1ClIzuHqFOc350x+Z+:Q4lH+MWOeIzuHdc356

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral15

    • Target

      BruteForcers PACK/BruteForcers PACK/FortNite Brute Checker 1 0 0 - Cracked By PC-RET/procs/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral16

    • Target

      BruteForcers PACK/BruteForcers PACK/FortNite Brute Checker 1 0 0 - Cracked By PC-RET/procs/RLSettings.exe

    • Size

      1.4MB

    • MD5

      32373185ece79936dfd0fd41d2848a2e

    • SHA1

      591f92bcaeeea85e8bba6988ef0d1afcea35fbbd

    • SHA256

      5390fc20629a4a350dc8f0482472f9962f50364b7818b2d510beb4e520581ad4

    • SHA512

      443b8df46dd6009285500148d2c4e0654e20e24b897fb29a9eded1cb21da6c495feaa1df81043ed4818f6ea511813c926e9f645b3ec4c8ab5c2c79f0fb5859dc

    • SSDEEP

      24576:odLgKtbMn52LmBs9MGfof321RnkcRWiZES8bLg8iPznpJy5OfH3bOn+BYSYu:odUrnow4gG1XWj7OpJy5OPrOnE

    Score
    7/10
    spywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral17

    • Target

      BruteForcers PACK/BruteForcers PACK/Instagram Brute Checker By Draingrom/Instagram Brute.exe

    • Size

      436KB

    • MD5

      764712e3d75b5d1f4a061796002a7140

    • SHA1

      084aee5530c2a2e62aa4e80e4ac2da622ac19b10

    • SHA256

      136e19176bc750affe730700df1fd336def1089abc25b224f11b99bc357058c2

    • SHA512

      e269793978b9e4cfe510cd444c9447282d948d63469732d36486f37d35263b4ea2d5cbf2dcd70e3ae51b1c96c1443051bd6e9f95a90f1921acfec2e33fd9d3e6

    • SSDEEP

      3072:o4l69tNNP2wk35viVEUFg8zfHNkc3tWS8cRvLJo9qlhh+lhq:o66D3q35viVBtR5dz8cRv9o9q3h+lh

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral18

    • Target

      BruteForcers PACK/BruteForcers PACK/Instagram Brute Checker By Draingrom/settings/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral19

    • Target

      BruteForcers PACK/BruteForcers PACK/Instagram Brute Checker By Draingrom/settings/xmt.exe

    • Size

      2.6MB

    • MD5

      739f50d778d3dc9a39bff9a75591a4ed

    • SHA1

      813d724b74b4f473ab585656b53ac5f52cab0416

    • SHA256

      72b00bca2ad9591351e276b81bbe93f0446cdf68cc7cf357135ea7c8a6b11959

    • SHA512

      6b1ba28679cb7ee3c9c44c757a58debf070a77a8947859bd5076ae22d745054e75e7b992ac0c01086c87027ad4bd65582957376df3d4dbbcdda3fc6a9085e85c

    • SSDEEP

      49152:iRL7D2ejOaUDO3mdfcHYbAvcWMz4nCuX3iGaf9ibKV0QtNKb4L/fNljZ:m31jeRC84V6Uw0yLXNN

    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral20

    • Target

      BruteForcers PACK/BruteForcers PACK/PORNHUB BRUTER CHECKER 2022/DATA/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral21

    • Target

      BruteForcers PACK/BruteForcers PACK/PORNHUB BRUTER CHECKER 2022/DATA/xpti.exe

    • Size

      17KB

    • MD5

      80e7fb00b497c172eed228ceaf0b27f0

    • SHA1

      772d855de12a41593c5007310ece356e5068ea14

    • SHA256

      eb3e18efcc5667b8cb3049a61a9d81b4bb014c08973d35d794643823dfb068f0

    • SHA512

      2ad550ac064c050e49f747bdab37652cfa8104884e17eda882568c720ff29195d938561a69362a7e7c47f6ca673773c81c226e73d374c88239de3a9c8af4633a

    • SSDEEP

      384:DB/6/y/ZPb/aeu6TJvzSnTSim70Nz8TSV765tr7:DB/ZLLSf6jr

    Score
    1/10
    behavioral22

    • Target

      BruteForcers PACK/BruteForcers PACK/PORNHUB BRUTER CHECKER 2022/PORNHUB BRUTER.exe

    • Size

      179KB

    • MD5

      4ba3cee14df6c818fb2f92a628426870

    • SHA1

      0ba7d121915d5b99dc56ad2d0c780fd300a1f53b

    • SHA256

      e1b8f55a342cdced0434b71883fa6509ea061132a9fdfe96ca14b68da8d17173

    • SHA512

      832f2b4b95954509ead01746d5fcb0a80b94100f786db2ab97f0e9ac9a91ad343502002bf672421538ba6bc35d05b11bca504185af9f17e99c794c089b5dd95c

    • SSDEEP

      768:6ec4lj/4ePn4wrgszN0cgqlqbjOrJIUKh4SL8tM3J:y4lceP37Z0vuI7j

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral23

    • Target

      BruteForcers PACK/BruteForcers PACK/PSN-brutechecker-by-Bax77 pcrt/PSN v4.3 [PC-RET] Crack.exe

    • Size

      194KB

    • MD5

      ea0c21b195a85cab3012ed28060d4582

    • SHA1

      8705413f230522a1b3df17068b3ef08c8eba12de

    • SHA256

      01b40f63dc57a2dca917a60213a5db33253c74a1265aed9b8b068efa562dcca6

    • SHA512

      f56448fe141e8defe1d28a7956a38e6bdb5d6ce901bafbeb6dedd8ea0d9501efb0af544bee79b801b58a839c780886412fbff47960c4a121091fd4a609036a18

    • SSDEEP

      1536:P4lFePnF+1ONp/C/z+wWkNm9UVX6lFcydLmVcQ6JPWOsVzmRL0hD:P4lFMVj/6+I6lBdKFKWOp0B

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral24

    • Target

      BruteForcers PACK/BruteForcers PACK/PSN-brutechecker-by-Bax77 pcrt/psn/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral25

    • Target

      BruteForcers PACK/BruteForcers PACK/PSN-brutechecker-by-Bax77 pcrt/psn/PCRET.exe

    • Size

      5.9MB

    • MD5

      5795a6711b14701420290004614b5057

    • SHA1

      793720dc52d6f111497b8c0c8a494e4568d7a0a0

    • SHA256

      eb6891a9df2da4a5cea28fd715876891907c24e94dd5a2e88ee19e511ff3300b

    • SHA512

      c26d3ec35597439282a22351ebaa703623189118682e578375ef2f4f8240bf642a4df8c593c79a89dd1b6a611acae9af820cac5d484ce1f8f713b1185d025739

    • SSDEEP

      98304:p1UAeuf51R6tdOntp4IDqqxlxgoLXdBUHMxZ3DOLdNolvMhl1owO7fylaWBAKUho:rPxbQdwBDqqPRlzeulvYewY9vh4F

    Score
    3/10
    behavioral26

    • Target

      BruteForcers PACK/BruteForcers PACK/Psn Bruteforcer & Checker/PSN_Bruteforce.exe

    • Size

      266KB

    • MD5

      48d75f6251f7561a68c29f0ae7d4f5c4

    • SHA1

      e7efee7e433c3670850ca226a681995b40beb36d

    • SHA256

      5412dfada3098e650be47040dde745bd785b898eb0f053f547eb89a345275663

    • SHA512

      956d5023c70f3af39f5fba0482461a5ce65221b08ced2cec4af6f64fa5e15a8ddae94b1ecd3f763575657a0b0b7b619abaa4cf7f783578ee1e0d8a7353b4518f

    • SSDEEP

      6144:M658iATgA5TdzOg1eul7WlBxFAKEfhr1XaIqL7ym0v:CThO3siDH6fhgIqqmq

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral27

    • Target

      BruteForcers PACK/BruteForcers PACK/Psn Bruteforcer & Checker/db/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral28

    • Target

      BruteForcers PACK/BruteForcers PACK/Psn Bruteforcer & Checker/db/psnsys.exe

    • Size

      3.7MB

    • MD5

      31e3b489d670036cd0fea9834b0fbf5f

    • SHA1

      d9ff3ac6c9e215a192305b4f12f67bddd2b69736

    • SHA256

      c7b29fc23d74d53922803f29d1c96edb3c5ea77144eacdd00d0fdb9fe243ff23

    • SHA512

      bc9d1fc3cb100aa4d542c9690288b3ee8ed65c464918ff99a697ffe9fb21c21c4f8ed5100fb133ab77b506c152e3cf624e69f5ee6b4cd3d23c8a4b335ffdd14a

    • SSDEEP

      49152:7nsHyjtk2MYC5GD89VUkauz7WSLA37EH5QELBTPNaKTIRgyo:7nsmtk2anXGIH5QE1Vahro

    Score
    1/10
    behavioral29

    • Target

      BruteForcers PACK/BruteForcers PACK/Spotify Brute Checker By ACTEAM/Spotify Brute Checker By ACTEAM.exe

    • Size

      190KB

    • MD5

      0e95517d1baf4b079e2e66cc9a51aeb5

    • SHA1

      83d504efa41eecd9f758375f278dad63c7c572b7

    • SHA256

      b9cf2f16a83537a9cb0805cbade3aedeaff30049f475a9338727b8d56da3c412

    • SHA512

      63c71f33563c84dfba2d08b0fae4579841cbe8bae1acc9ecfbb91f80db999fcfe6fb941b6285c9d0dc44a13b62b15df13b72ffb5176d27ed6deaa628d92840f3

    • SSDEEP

      1536:F4lMePedBhd3N4NGfWjJDeibS9Eu6cp4ad8jn3hmjhczYlANqkM4kdEirCavG6R6:F4lMVBhsKWl0KIKkPl2Iz3S

    Score
    7/10
    persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral30

    • Target

      BruteForcers PACK/BruteForcers PACK/Spotify Brute Checker By ACTEAM/WebDriver/Launcher.exe

    • Size

      53KB

    • MD5

      c6d4c881112022eb30725978ecd7c6ec

    • SHA1

      ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

    • SHA256

      0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

    • SHA512

      3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

    • SSDEEP

      768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral31

    • Target

      BruteForcers PACK/BruteForcers PACK/Spotify Brute Checker By ACTEAM/WebDriver/nvml.exe

    • Size

      1.8MB

    • MD5

      8c538e3eda34cb6e7cbe470d93d1384a

    • SHA1

      ccf64721bd9691e0a27cbb0d258b6bc14f8fa32c

    • SHA256

      2bcc54ed052152ac1fb77d9c8740f4ab87e3e59f3cd82e232df64c38b369f057

    • SHA512

      5aa63e3edbac96c32e415570a76c90f5c4dbf1dc6781c1f90d805e21a08473a0c15f11596f286f1c482e7125b31748f74f2176beba7da7954d7cc024de291e7e

    • SSDEEP

      49152:QtJTTUYbkfboEgpymruN7Un006BzwH6R8R:QtJTufEEgofm5YzCl

    Score
    7/10

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

21
T1060

Privilege Escalation

Defense Evasion

Modify Registry

21
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials in Files

5
T1081

Discovery

Query Registry

37
T1012

System Information Discovery

61
T1082

Virtualization/Sandbox Evasion

2
T1497

Remote System Discovery

2
T1018

Lateral Movement

Collection

Data from Local System

5
T1005

Exfiltration

Command and Control

Impact

Tasks

static1

pdflinkpyinstallerthemidaaspackv2upx
Score
7/10

behavioral1

persistence
Score
7/10

behavioral2

persistence
Score
7/10

behavioral3

Score
3/10

behavioral4

persistencespywarestealer
Score
7/10

behavioral5

persistence
Score
7/10

behavioral6

discoveryspywarestealer
Score
7/10

behavioral7

persistence
Score
7/10

behavioral8

persistence
Score
7/10

behavioral9

persistence
Score
7/10

behavioral10

persistence
Score
7/10

behavioral11

spywarestealer
Score
7/10

behavioral12

evasionpersistencethemida
Score
9/10

behavioral13

persistence
Score
7/10

behavioral14

evasionthemidatrojan
Score
9/10

behavioral15

persistence
Score
7/10

behavioral16

persistence
Score
7/10

behavioral17

spywarestealer
Score
7/10

behavioral18

persistence
Score
7/10

behavioral19

persistence
Score
7/10

behavioral20

Score
5/10

behavioral21

persistence
Score
7/10

behavioral22

Score
1/10

behavioral23

persistence
Score
7/10

behavioral24

persistence
Score
7/10

behavioral25

persistence
Score
7/10

behavioral26

Score
3/10

behavioral27

persistence
Score
7/10

behavioral28

persistence
Score
7/10

behavioral29

Score
1/10

behavioral30

persistence
Score
7/10

behavioral31

Score
7/10

behavioral32

Score
7/10