Overview
overview
10Static
static
3AridekVM-P...s..scr
windows7-x64
6AridekVM-P...s..scr
windows10-2004-x64
10AridekVM-P...64.dll
windows7-x64
1AridekVM-P...64.dll
windows10-2004-x64
1AridekVM-P...86.dll
windows7-x64
1AridekVM-P...86.dll
windows10-2004-x64
1AridekVM-P...s..scr
windows7-x64
6AridekVM-P...s..scr
windows10-2004-x64
10AridekVM-P...ver.js
windows7-x64
1AridekVM-P...ver.js
windows10-2004-x64
1General
-
Target
AridekVM-Permanted-Hwid-Spoofer-Changer-main.zip
-
Size
2.6MB
-
Sample
240314-rzb9lsef2w
-
MD5
96a4709352a3ffe8980a281dcddeeb56
-
SHA1
b67f25b07c5d24c69f497e962d1c926475d99c45
-
SHA256
7c234430fd1c5eb32070d34f5e924e41cbc758b5ad03138168109a48a74fc986
-
SHA512
4d06086b2fce79b7a6ed98da290412639d69fcdefc5d4c02f1629cf14ebda4b9d30a88c994d6aec307714b9c687a6a5bacd9983cace3435ce6ade43c4e1a1ea7
-
SSDEEP
49152:PZGNNDG7gMhdW4ESmPbf9QqKMh/4ef0c6IcT8kV7T+1kieCLVqbZdeMkd7kOqbZK:PgmPk9QqKMa3c6IBkVX+GCLVqbZsMkdt
Static task
static1
Behavioral task
behavioral1
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/HWID Spoofer Resounls..scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/HWID Spoofer Resounls..scr
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/lib/MinHook.x64.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/lib/MinHook.x64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/lib/MinHook.x86.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/lib/MinHook.x86.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/main/HWID Spoofer Resounls..scr
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/main/HWID Spoofer Resounls..scr
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/main/intel_driver.js
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/main/intel_driver.js
Resource
win10v2004-20240226-en
Malware Config
Extracted
asyncrat
0.5.8
Op
40.66.40.50:6214
HftZzDq0qcC7
-
delay
3
-
install
false
-
install_file
OperaCertifica
-
install_folder
%AppData%
Extracted
asyncrat
0.5.8
Ch
40.66.40.50:4173
nmovkV052oeK
-
delay
3
-
install
false
-
install_file
ChromeCertifica
-
install_folder
%AppData%
Targets
-
-
Target
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/HWID Spoofer Resounls..scr
-
Size
351KB
-
MD5
13d1fc17b74fdbe39d0141d4f5e2b6db
-
SHA1
0c48d2d21eff6bc55fefe111b25e81fcc27e25a5
-
SHA256
194c0a05958c8ead4bfa916ace6e1a5acdb7f433ce57c1d48abc9160a6bca4e5
-
SHA512
3eaf731772e1c1386a84eae459ca1d8cb81fa8d79be1cb91f5e8678e9861a687178007e881a0fd03d116c597918e3a5f580a5060e32dc0faeeee22ebe1ac3b0c
-
SSDEEP
6144:haxxiw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFm6axHUZ:hukqjVnl36ud0zR/6CtQ9PUHIG8Dn
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
-
-
Target
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/lib/MinHook.x64.dll
-
Size
15KB
-
MD5
9ed71db2c29203e785fa532a6261e416
-
SHA1
77e9aa544efce588b70b2f7841e80d77ea773cb3
-
SHA256
bddd6adaee8ab13eabaa7c73c97718cee1437db2054ca713ec7cc86e8002a300
-
SHA512
ca3d81e5cab227d43ca06d9c66e22f51a5976e1fc541bc7a0b627acb97c02db6fcc1e1cd090b5f68d004844cc426ca17af57d20d542e84c9ff20d19557657678
-
SSDEEP
192:8Ff48texc+160hdtQAq7XtwGR13mfupYp+XNJ3q8UJM5oaaBLKnMJA4yzTMW:/8V+k0rtQztwGR13mf3WNT5ILKzPMW
Score1/10 -
-
-
Target
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/lib/MinHook.x86.dll
-
Size
12KB
-
MD5
81fae251dd1155dbe840106724cbe87f
-
SHA1
129ec3df3beecbf62d9e4e0db6ad677339d68804
-
SHA256
d1db9afdc79dcd34f77d1eb825c4f95e37e7f72ca7bd0e717e69d275fd94093e
-
SHA512
21745cf30f45b363ac3b854a8da737f4240621c98e9554389e66453bcaa9bed85260a0126a53a99adf53f65aba0e255b410056d60f1e5cf9dbdb829ad7693f97
-
SSDEEP
192:s+Uo0tQ8/JwFZIVHh51/IjU266/68S6P4VMWk:PKt8vadIp6+wMW
Score1/10 -
-
-
Target
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/main/HWID Spoofer Resounls..scr
-
Size
351KB
-
MD5
13d1fc17b74fdbe39d0141d4f5e2b6db
-
SHA1
0c48d2d21eff6bc55fefe111b25e81fcc27e25a5
-
SHA256
194c0a05958c8ead4bfa916ace6e1a5acdb7f433ce57c1d48abc9160a6bca4e5
-
SHA512
3eaf731772e1c1386a84eae459ca1d8cb81fa8d79be1cb91f5e8678e9861a687178007e881a0fd03d116c597918e3a5f580a5060e32dc0faeeee22ebe1ac3b0c
-
SSDEEP
6144:haxxiw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFm6axHUZ:hukqjVnl36ud0zR/6CtQ9PUHIG8Dn
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
-
-
Target
AridekVM-Permanted-Hwid-Spoofer-Changer-main/HWIDSpoofer/main/intel_driver.hpp
-
Size
10KB
-
MD5
1db64f9baeea0a57d1a2d7706956ef78
-
SHA1
fc4b089224ba33c9d853a6ddfcbbb06019bbbbc6
-
SHA256
e15e67854edeac4b98309324fb3044c95a6199d2230fe46bb347cbbd88d8fa70
-
SHA512
1445dddd44cdeb6467e4d8f0c68e53060d63e8237d4089689e6c64fb3b4f308eaf16b6112b361aea9d60cab6a43ac1176b6b766a34b18a3d62c6f22503a92b2a
-
SSDEEP
192:f2U9GAijPjrjjIuIuIGIdIvInp6nqV8TUN3CFvC4Pl6SSzgeVGAXJjP6YrYVUFyg:EBczge52YrY4Y1YTY0Y5YHYM
Score1/10 -
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
2Privilege Escalation
Abuse Elevation Control Mechanism
2Bypass User Account Control
2Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
2