Overview

overview

10

Static

static

10

Cheat_Bypa...ss.dll

windows7-x64

1

Cheat_Bypa...ss.dll

windows10-2004-x64

1

Cheat_Bypa...TA.exe

windows7-x64

10

Cheat_Bypa...TA.exe

windows10-2004-x64

10

Cheat_Bypa...64.exe

windows7-x64

1

Cheat_Bypa...64.exe

windows10-2004-x64

1

Cheat_Bypa...ss.dll

windows7-x64

1

Cheat_Bypa...ss.dll

windows10-2004-x64

1

Cheat_Bypa...TA.exe

windows7-x64

10

Cheat_Bypa...TA.exe

windows10-2004-x64

10

Cheat_Bypa...64.exe

windows7-x64

1

Cheat_Bypa...64.exe

windows10-2004-x64

3

PPRE/PPRE.exe

windows7-x64

7

PPRE/PPRE.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

Project.exe

windows7-x64

7

Project.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

locales/de.ps1

windows7-x64

1

locales/de.ps1

windows10-2004-x64

1

locales/nb.ps1

windows7-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Desktop.rar

  • Size

    94.7MB

  • Sample

    240304-shgy7sec86

  • MD5

    b683ab06fdb05f8969fefd1dc7cb2ecb

  • SHA1

    d08558eed94fbc5911a46a98a2410dc310acfb12

  • SHA256

    2883ca6aa4128eba9e009482d2e665ff528465c853e099aa87a9324fc343ff64

  • SHA512

    13cf8044de0920739afbe604aeaf33f92fc9e5e531d4f34ea03bd81fabe76adfab92987ebf803125123c4a76a340cf7656cdfee4bf40c71098d51e5d1e12382c

  • SSDEEP

    1572864:fALnyMWKrF9I/LmfY131yXoONw5lLkGb0P/7pkELI2qeTcig6EdIA7vdH3+3x/+2:fALVHUp2Xk5hkG49lLIT5ig6EG0V3+3L

Score
10/10
lummanjrat2024evasionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

2024

C2

userdalex2024.ddns.net:4444

Mutex

1c455b7054bf3cdcc6d194b1216e5458

Attributes
  • reg_key

    1c455b7054bf3cdcc6d194b1216e5458

  • splitter

    |'|'|

Targets

    • Target

      Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll

    • Size

      1015KB

    • MD5

      c4dfbbd29f479ff9d9fc482022fbc43a

    • SHA1

      b41a7f08625508a15c1ac085fe9fa136a04f0ed3

    • SHA256

      afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

    • SHA512

      13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

    • SSDEEP

      12288:Cab/04n458xRrPzrUBHK5fhgxFmXEP2f7K46TnSEl1yt6zzng0LNU5R37A6Dv:Cl4n458xRrPztgxoGRNU5R37J

    Score
    1/10
    behavioral1behavioral2

    • Target

      Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe

    • Size

      748KB

    • MD5

      6f165b1eef8c2891e4e9d5e37f9074ec

    • SHA1

      4017b1950461c898c5041c3abe08f80ff3ec668b

    • SHA256

      36711a12941ffc7194605b9664f452fa3179eacc55b5701fd22414eff087b80f

    • SHA512

      2c4c47bb48c87055599ceb0e9ee761de5c33e94bbc58ef3613b008f65b8afaa4522660780a93a9ef553b090d09ef06121e89126627413feca9e6ed7c2cf32bf9

    • SSDEEP

      3072:nLJMjbcHDdMwQy1SZ/yUqnLQZr29SB8baRYX2NCancRuXAlSfZEPCNIj2BMmu/Gu:nlMeBzQ6SRInLQZApPAKNMBpPAKNM

    Score
    10/10
    njrat2024evasionpersistencetrojanupx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral3behavioral4

    • Target

      Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe

    • Size

      1.3MB

    • MD5

      6f0dd4150efddfc20b70401479964211

    • SHA1

      e97c802a8013b13fb91a831b779ade7c3ca6870b

    • SHA256

      0e6d59fcdf8f143e23b076cc8380d6d23324839ae4f91793133b600e7eb76eb9

    • SHA512

      d8e823876507cd10b8c176e502c99bb80d52742eaa7c0e319b2a5c1f605de962505bf09950418a461fde427db34a59dbb67cbb4a6045f44d243c77945aebd0fb

    • SSDEEP

      24576:uLGfO4noYBPtVY3HPou37urInN48pGrnofSVgPCS3tMrMyj3F9hIF1SqY5cbaF:uLGfKY5tVY3gur9N4p0SVE3tMx3FE1Sr

    Score
    1/10
    behavioral5behavioral6

    • Target

      Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll

    • Size

      1015KB

    • MD5

      c4dfbbd29f479ff9d9fc482022fbc43a

    • SHA1

      b41a7f08625508a15c1ac085fe9fa136a04f0ed3

    • SHA256

      afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

    • SHA512

      13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

    • SSDEEP

      12288:Cab/04n458xRrPzrUBHK5fhgxFmXEP2f7K46TnSEl1yt6zzng0LNU5R37A6Dv:Cl4n458xRrPztgxoGRNU5R37J

    Score
    1/10
    behavioral7behavioral8

    • Target

      Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe

    • Size

      748KB

    • MD5

      6f165b1eef8c2891e4e9d5e37f9074ec

    • SHA1

      4017b1950461c898c5041c3abe08f80ff3ec668b

    • SHA256

      36711a12941ffc7194605b9664f452fa3179eacc55b5701fd22414eff087b80f

    • SHA512

      2c4c47bb48c87055599ceb0e9ee761de5c33e94bbc58ef3613b008f65b8afaa4522660780a93a9ef553b090d09ef06121e89126627413feca9e6ed7c2cf32bf9

    • SSDEEP

      3072:nLJMjbcHDdMwQy1SZ/yUqnLQZr29SB8baRYX2NCancRuXAlSfZEPCNIj2BMmu/Gu:nlMeBzQ6SRInLQZApPAKNMBpPAKNM

    Score
    10/10
    njrat2024evasionpersistencetrojanupx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral10behavioral9

    • Target

      Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe

    • Size

      1.3MB

    • MD5

      6f0dd4150efddfc20b70401479964211

    • SHA1

      e97c802a8013b13fb91a831b779ade7c3ca6870b

    • SHA256

      0e6d59fcdf8f143e23b076cc8380d6d23324839ae4f91793133b600e7eb76eb9

    • SHA512

      d8e823876507cd10b8c176e502c99bb80d52742eaa7c0e319b2a5c1f605de962505bf09950418a461fde427db34a59dbb67cbb4a6045f44d243c77945aebd0fb

    • SSDEEP

      24576:uLGfO4noYBPtVY3HPou37urInN48pGrnofSVgPCS3tMrMyj3F9hIF1SqY5cbaF:uLGfKY5tVY3gur9N4p0SVE3tMx3FE1Sr

    Score
    3/10
    behavioral11behavioral12

    • Target

      PPRE/PPRE.exe

    • Size

      64.1MB

    • MD5

      cc676fc1304b6f2ea59554fd21b4a0bb

    • SHA1

      ef6c1a4c4cde571603e8abba46ebd4ca32734d90

    • SHA256

      06be4ae2f4ea9751c93387d2b622366d5396ad5274c033d5fc388d9c699d7cec

    • SHA512

      a71a7943b2c1681bf3170fb83147fa98e74f3840e85da29e53bef719b1ed570591b16d81f22678586ebd8c309e2ba785f0c017f59c9d8f3496dec9f40101a63e

    • SSDEEP

      1572864:byXoONw5lLkGb0P/7pkELI2qeTcig6EdIA7vdH3+3x/+1Tn13dUE7:GXk5hkG49lLIT5ig6EG0V3+3lOpth7

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral17behavioral18

    • Target

      LICENSES.chromium.html

    • Size

      6.3MB

    • MD5

      34999967f735b07e9cbcf6c397cea4db

    • SHA1

      8001fcdd6ce0c6e5a3d91fd45e4c9726fa67f3e4

    • SHA256

      c5a05048505c00af46c75fb5ca22057f09dce001eada3a756c3839d59011758f

    • SHA512

      b6c2f722b6551231801e453bba8f9593d9f1a82edb305869ee07ef77f286968eb6ad5db1abbe750e88c8af973c362ee161aa5c591ea04ff39e4f4b34e6fa4baf

    • SSDEEP

      24576:/PV05W5WS9YzHIlGMmfu626s6W6a6q5AHWeQFpD:F9n

    Score
    1/10
    behavioral19behavioral20

    • Target

      Project.exe

    • Size

      147.0MB

    • MD5

      5fff4c7f41fe8a04f7c6ffcb191bfd54

    • SHA1

      e660df9a92442e6a91e0805b3310a94bde5fe414

    • SHA256

      4aba8d9303ced281e6b884dbb045582d9bf24405ced912fb9aeb97335ffe483d

    • SHA512

      7cd6010c78c81f5a9234f3a5849d4c7bc3896a537fd3c4030976f29cabf16aeb331a88c4186fd0bb2edc9b56fa6551065c247a0ca05084aaa72ddfab75d0ff14

    • SSDEEP

      1572864:QroLm1cZ4K5MvHwpkeg9duXYFPEiFWITK886rc028B+yJwG5xmR:FCjwAI8xO

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral21behavioral22

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      cb9807f6cf55ad799e920b7e0f97df99

    • SHA1

      bb76012ded5acd103adad49436612d073d159b29

    • SHA256

      5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

    • SHA512

      f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

    • SSDEEP

      49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI

    Score
    1/10
    behavioral23

    • Target

      ffmpeg.dll

    • Size

      2.6MB

    • MD5

      ed8f4c34e43f20c78fcb2f8a1592ab51

    • SHA1

      8494ac5b85991ab0217676249f894bcd7eff11b5

    • SHA256

      24a896a9b63d116c2da72928cbbffff4934bf0ce1ec3e99d53493cd776e3a07b

    • SHA512

      db677c21ba9c70e08b76a5eeefbc452565301fe0722e5320f5f3f17662e5f33ae92cb79d701270d2fe0b20b1478c4b057f1e9e3b2e4301912bd846caf8c37ec2

    • SSDEEP

      49152:9YuqVaqc35GHXVNtcZ44yODvSEbO/1o/GRRpYN4MJ8eIknusyUUjkU+jLtyTzQVD:9YLVl54yODvH/ySJUiLtyTzQVkU5qkJx

    Score
    1/10
    behavioral24behavioral25

    • Target

      libEGL.dll

    • Size

      464KB

    • MD5

      439861fc5d1dc9aa1deb42bfe7c97bb7

    • SHA1

      58a79d22e8a8d152a456114c844f6f7e4a82c134

    • SHA256

      c813ee6b4e4f81f32f4fed86497cd751fdb4c19b0b718c61aed06f0760f511db

    • SHA512

      31c11364c8174fe289c99d8a467b1e03e92cb3b2557beb94da6359df5c9c366b30b50350d1b5a321c6a4048641720c3756fad0c1625c7fc1adde4dbde312e727

    • SSDEEP

      6144:l3rGS+e87yDqHfFetvM/jvtGgJ53B6Zj8s1al2zl0ovk1SA7e:dGS+e87A6eZM/jvtGgJZB6ZirS

    Score
    1/10
    behavioral26behavioral27

    • Target

      libGLESv2.dll

    • Size

      7.0MB

    • MD5

      81d090c7823b55120df7b74325ab6ff7

    • SHA1

      d7a870b2e43d5f15a72267f05ea2b52ac0f8b3bc

    • SHA256

      5b9cbbf9797d8281ac01dbe49372160040b86be1d5906ee2e4ee87ce17de5eb9

    • SHA512

      9812c0736afff9283a34ac796b83a91367b768e1f359dbf4390b2f4339535e26ec426f7bae2d2bfa0c29e547ab060bc95199fd4b9c1e01a079ca5b5acd7ef729

    • SSDEEP

      49152:hcRs1/VOY14IRwMqs5Jbkqd0bRh7yWXSnYUIV2Wi5zi1lJf3Lnn6cB7/h2Hmbs2F:eG2Ipp9eR+UDGRSoGetN4/n1

    Score
    1/10
    behavioral28behavioral29

    • Target

      locales/de.pak

    • Size

      367KB

    • MD5

      cfc9d90273c31ccf66d81739aa76306a

    • SHA1

      ecab570041654b147b3dd118829e2f7ae668f840

    • SHA256

      8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a

    • SHA512

      c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380

    • SSDEEP

      6144:F+QNkAjzYyqSFaPjON3Be0mzBWCj0Xs5HgIxBI0gql:cQLjMyvFaCN3mzBd5xy0gql

    Score
    1/10
    behavioral30behavioral31

    • Target

      locales/nb.pak

    • Size

      332KB

    • MD5

      f15c568a9ed8b2ca497571453ce6bce2

    • SHA1

      957ffec56ce14f33fa75f493936552751e966d16

    • SHA256

      18512064afcc3fb5a0e1f36400e592ff34e8c6c9a7ed0bbe3432255c4759ad8c

    • SHA512

      3bd27f9612b39836e5e7654e6f07c2fd5a31f2c338db36daa51e2c1462986cf4b651d555245ee2e97acd044e44a5beffb8cc9d56c1af11f52fedf9f7fbf7da97

    • SSDEEP

      6144:I9HHvGNQkyLirVh6EQFewqOp7fyyVgLmy07E6SRw5PX4RXODcF:6npqrOEQFewqOp7fyy3ELG5PX4IDcF

    Score
    1/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

2
T1562.004

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

7
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

lumma
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

njrat2024evasionpersistencetrojanupx
Score
10/10

behavioral4

njrat2024evasionpersistencetrojanupx
Score
10/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

njrat2024evasionpersistencetrojanupx
Score
10/10

behavioral10

njrat2024evasionpersistencetrojanupx
Score
10/10

behavioral11

Score
1/10

behavioral12

Score
3/10

behavioral13

spywarestealer
Score
7/10

behavioral14

spywarestealer
Score
7/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

spywarestealer
Score
7/10

behavioral22

spywarestealer
Score
7/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10