Overview

overview

10

Static

static

1

The-MALWARE-Repo

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    The-MALWARE-Repo

  • Size

    265KB

  • Sample

    240228-tyjneagc5x

  • MD5

    0198600239dd2b00d6ffea6c5d545b87

  • SHA1

    114b32d6da0ebd11efb8bec44c3763a029c2a2c7

  • SHA256

    7d7b9af864f7f91b5f6450674774e4cea687b65aa94906f127c96b550ff4fee9

  • SHA512

    6e157729b6f4e271ad38a69f9e7bac3644352ef251f6d62e3604e2f62a8110e770c8c999cbc2b924a4a5156823700928c2bb3fd8949562b08b99824099ced2c5

  • SSDEEP

    6144:pDuqJ6f10VSgE29xxspm0n1vuz3Fm9lvZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vq:kf10VSgE29xxspm0n1vuz3g9lvZJT3C0

Score
10/10
darkcometlokibotrevengeratwannacryguestaspackv2discoveryevasionpersistenceransomwareratspywarestealertrojanupxworm

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Extracted

Family

lokibot

C2

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Extracted

Path

C:\Users\Admin\Desktop\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target

      The-MALWARE-Repo

    • Size

      265KB

    • MD5

      0198600239dd2b00d6ffea6c5d545b87

    • SHA1

      114b32d6da0ebd11efb8bec44c3763a029c2a2c7

    • SHA256

      7d7b9af864f7f91b5f6450674774e4cea687b65aa94906f127c96b550ff4fee9

    • SHA512

      6e157729b6f4e271ad38a69f9e7bac3644352ef251f6d62e3604e2f62a8110e770c8c999cbc2b924a4a5156823700928c2bb3fd8949562b08b99824099ced2c5

    • SSDEEP

      6144:pDuqJ6f10VSgE29xxspm0n1vuz3Fm9lvZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vq:kf10VSgE29xxspm0n1vuz3g9lvZJT3C0

    Score
    10/10
    darkcometlokibotrevengeratwannacryguestaspackv2discoveryevasionpersistenceransomwareratspywarestealertrojanupxworm

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Modifies WinLogon for persistence

      persistence

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • RevengeRat Executable

      stealer

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

4
T1112

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

File and Directory Permissions Modification

1
T1222

Scripting

1
T1064

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Network Service Discovery

1
T1046

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks