Overview
overview
3Static
static
1Xvirus-Too...rus.py
windows7-x64
3Xvirus-Too...rus.py
windows10-2004-x64
3Xvirus-Too...up.bat
windows7-x64
1Xvirus-Too...up.bat
windows10-2004-x64
1Xvirus-Too...rt.bat
windows7-x64
1Xvirus-Too...rt.bat
windows10-2004-x64
1Xvirus-Too...t__.py
windows7-x64
3Xvirus-Too...t__.py
windows10-2004-x64
3Xvirus-Too...les.py
windows7-x64
3Xvirus-Too...les.py
windows10-2004-x64
3Xvirus-Too...mer.py
windows7-x64
3Xvirus-Too...mer.py
windows10-2004-x64
3Xvirus-Too...ger.py
windows7-x64
3Xvirus-Too...ger.py
windows10-2004-x64
3Xvirus-Too...ort.py
windows7-x64
3Xvirus-Too...ort.py
windows10-2004-x64
3Xvirus-Too...mer.py
windows7-x64
3Xvirus-Too...mer.py
windows10-2004-x64
3Xvirus-Too...ger.py
windows7-x64
3Xvirus-Too...ger.py
windows10-2004-x64
3Xvirus-Too...ker.py
windows7-x64
3Xvirus-Too...ker.py
windows10-2004-x64
3Xvirus-Too...ker.py
windows7-x64
3Xvirus-Too...ker.py
windows10-2004-x64
3Xvirus-Too...ner.py
windows7-x64
3Xvirus-Too...ner.py
windows10-2004-x64
3Xvirus-Too...ver.py
windows7-x64
3Xvirus-Too...ver.py
windows10-2004-x64
3Xvirus-Too...ger.py
windows7-x64
3Xvirus-Too...ger.py
windows10-2004-x64
3Xvirus-Too...ver.py
windows7-x64
3Xvirus-Too...ver.py
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 16:28 UTC
Static task
static1
Behavioral task
behavioral1
Sample
Xvirus-Tools-main/Xvirus.py
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Xvirus-Tools-main/Xvirus.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Xvirus-Tools-main/setup.bat
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Xvirus-Tools-main/setup.bat
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Xvirus-Tools-main/start.bat
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Xvirus-Tools-main/start.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Xvirus-Tools-main/util/__init__.py
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Xvirus-Tools-main/util/__init__.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Xvirus-Tools-main/util/options/bypass_rules.py
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
Xvirus-Tools-main/util/options/bypass_rules.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Xvirus-Tools-main/util/options/channel_spammer.py
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
Xvirus-Tools-main/util/options/channel_spammer.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Xvirus-Tools-main/util/options/hypesquad_changer.py
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Xvirus-Tools-main/util/options/hypesquad_changer.py
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
Xvirus-Tools-main/util/options/mass_report.py
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Xvirus-Tools-main/util/options/mass_report.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
Xvirus-Tools-main/util/options/soundboard_spammer.py
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Xvirus-Tools-main/util/options/soundboard_spammer.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Xvirus-Tools-main/util/options/token_bio_changer.py
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
Xvirus-Tools-main/util/options/token_bio_changer.py
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
Xvirus-Tools-main/util/options/token_checker.py
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
Xvirus-Tools-main/util/options/token_checker.py
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
Xvirus-Tools-main/util/options/token_global_nicker.py
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
Xvirus-Tools-main/util/options/token_global_nicker.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
Xvirus-Tools-main/util/options/token_joiner.py
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
Xvirus-Tools-main/util/options/token_joiner.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
Xvirus-Tools-main/util/options/token_leaver.py
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
Xvirus-Tools-main/util/options/token_leaver.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
Xvirus-Tools-main/util/options/token_pron_changer.py
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
Xvirus-Tools-main/util/options/token_pron_changer.py
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
Xvirus-Tools-main/util/options/token_saver.py
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
Xvirus-Tools-main/util/options/token_saver.py
Resource
win10v2004-20231215-en
General
-
Target
Xvirus-Tools-main/util/options/soundboard_spammer.py
-
Size
1KB
-
MD5
aeed67f5c6d83f7c9a262e5a60751d20
-
SHA1
77405701061c7a1208fd38dd313e198df46829c4
-
SHA256
a6cc0b409a54ac21d0662b156c029694b4fdbced30db2307ba83443502ae2f0d
-
SHA512
d770142aedbadf384462eadb3cb40e2155d30345a668da2673df9c20127c85d6c3cc905f9c2a1e42e15f21f7c6070aa6997c5a87bbb90158f2b1a8c2769f2212
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3560 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\soundboard_spammer.py1⤵
- Modifies registry class
PID:2336
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3560
Network
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.178.17.96.in-addr.arpaIN PTRResponse172.178.17.96.in-addr.arpaIN PTRa96-17-178-172deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request18.53.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request204.178.17.96.in-addr.arpaIN PTRResponse204.178.17.96.in-addr.arpaIN PTRa96-17-178-204deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request195.178.17.96.in-addr.arpaIN PTRResponse195.178.17.96.in-addr.arpaIN PTRa96-17-178-195deploystaticakamaitechnologiescom
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
18.53.126.40.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
172.178.17.96.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
204.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
31.243.111.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
195.178.17.96.in-addr.arpa