Overview

overview

10

Static

static

10

possible malware.zip

windows7-x64

1

possible malware.zip

windows10-2004-x64

1

Malware-Fe...afa11b

windows7-x64

1

Malware-Fe...afa11b

windows10-2004-x64

1

Malware-Fe...DME.md

windows7-x64

3

Malware-Fe...DME.md

windows10-2004-x64

3

Malware-Fe...368967

windows7-x64

1

Malware-Fe...368967

windows10-2004-x64

1

Malware-Fe...DME.md

windows7-x64

3

Malware-Fe...DME.md

windows10-2004-x64

3

Malware-Fe...c43893

windows7-x64

1

Malware-Fe...c43893

windows10-2004-x64

1

Malware-Fe...aaa686

windows7-x64

1

Malware-Fe...aaa686

windows10-2004-x64

1

Malware-Fe...9f9f90

windows7-x64

1

Malware-Fe...9f9f90

windows10-2004-x64

1

Malware-Fe...DME.md

windows7-x64

3

Malware-Fe...DME.md

windows10-2004-x64

3

Malware-Fe...DME.md

windows7-x64

3

Malware-Fe...DME.md

windows10-2004-x64

3

Malware-Fe...DME.md

windows7-x64

3

Malware-Fe...DME.md

windows10-2004-x64

3

Malware-Fe...DME.md

windows7-x64

3

Malware-Fe...DME.md

windows10-2004-x64

3

Malware-Fe...DME.md

windows7-x64

3

Malware-Fe...DME.md

windows10-2004-x64

3

Malware-Fe...ff77d8

windows7-x64

1

Malware-Fe...ff77d8

windows10-2004-x64

1

Malware-Fe...f5860a

windows7-x64

1

Malware-Fe...f5860a

windows10-2004-x64

1

Malware-Fe...aa65d0

windows7-x64

1

Malware-Fe...aa65d0

windows10-2004-x64

1

Resubmissions

09/03/2026, 14:37

260309-rzdsfaev8z10

13/04/2024, 01:05

240413-bfw7nshd5810

Sharing

Copy URL Twitter E-mail

General

  • Target
    possible malware.zip
  • Size 682.3MB
  • Sample240413-bfw7nshd58
  • SHA256 ba18ff142bae31457031ca49e772b10792ad3a5bdead90cb2c1d37e2a6c2fd59
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
anchordnsaridvipercobaltstrikecomratjupyternetwalkernjratrevengeratsandroratslothfulmediaspynotesunburstsupernovateardropzebrocy0guesthackedaspackv2backdoorcryptonedropperlinkmacromacro_on_actionpackerpdfpyinstallerstealerupxvmprotect

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://webmail.lax.co.il/owa/auth/Current/Script/jquery-3.5.1.min.js

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • voly.ddns.net:88

Mutex

  • RV_MUTEX-BUPRawrSNddXxdY

Extracted

Family

  • spynote

C2

  • voly.ddns.net:1988

Extracted

Family

  • sandrorat

C2

  • voly.ddns.net:1962

Extracted

Family

  • njrat

Version

  • Hallaj PRO Rat [Fixed]

Botnet

  • HacKed

C2

  • voly.ddns.net:81

Mutex

  • 23e6d18d0fa7e25eb8844687c5ca5f5c

Attributes
  • reg_key

    23e6d18d0fa7e25eb8844687c5ca5f5c

  • splitter

    boolLove

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://summerevent.webhop.net:443/safebrowsing/rd/tnOztRgLx1ugKt8uumGcreRFm5CqXD9ge-zzz5sA6WzhC

Attributes
  • access_type

    512

  • beacon_type

    2048

  • crypto_scheme

    256

  • host

    summerevent.webhop.net,/safebrowsing/rd/tnOztRgLx1ugKt8uumGcreRFm5CqXD9ge-zzz5sA6WzhC

  • http_header1

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAIAAAAAgAAAAhQUkVGPUlEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAIAAAAAgAAABJVPXNSdjg1VUhpakJycldpSHoAAAACAAAACFBSRUY9SUQ9AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    3840

  • maxdns

    247

  • polling_time

    6600

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmFvK6fWzx+zTnQqAkZAQv6Eqwme1a80cwMNtrYEJShrKKbgpTy71w5Zd9u7EdBClno3HF9U4/9/tkBRw6PPPRa+W6bgpf97I3/Y0z36I5E/h+UP8h076IkzaWyPHbS1QMOiE6AXC3rCERjgirkn1LKUs+Q+zj0LeN8/QHEq/ZqQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /safebrowsing/rd/r8l4jO3947jVxa5wBhEijGc0y77iX4oFy

  • user_agent

    Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

  • watermark

    0

Extracted

Family

  • jupyter

Version

  • DR/1.4

C2

  • http://45.146.165.219

Extracted

Family

  • jupyter

Version

  • DR/1.0

C2

  • http://45.135.232.131

Targets

    • Target
      possible malware.zip
    • Size 682.3MB
    • SHA256 ba18ff142bae31457031ca49e772b10792ad3a5bdead90cb2c1d37e2a6c2fd59
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/3cb052a7da6cda9609c32b5bafa11b76c2bb0f74b61277fecf464d3c0baeac0e
    • Size 6KB
    • SHA256 3cb052a7da6cda9609c32b5bafa11b76c2bb0f74b61277fecf464d3c0baeac0e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/README.md
    • Size 47B
    • SHA256 66cd4b7d78465c16e710e3b8720f0700f2bb557d9feebce07033406b77bb942d
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral5behavioral6
    • Target
      Malware-Feed-master/2020.07.28_FBI-FLASH-MI-000130-MW/9f9027b5db5c408ee43ef2a7c7dd1aecbdb244ef6b16d9aafb599e8c40368967
    • Size 664KB
    • SHA256 9f9027b5db5c408ee43ef2a7c7dd1aecbdb244ef6b16d9aafb599e8c40368967
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      Malware-Feed-master/2020.07.28_FBI-FLASH-MI-000130-MW/README.md
    • Size 72B
    • SHA256 0c8668604e05ae2e1d1d369ae5992f61a0f625e0714730b10b1e13e849f699ca
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10behavioral9
    • Target
      Malware-Feed-master/2020.07.28_FBI-FLASH-MI-000130-MW/ad8d379a4431cabd079a1c34add903451e11f06652fe28d3f3edb6c469c43893
    • Size 517KB
    • SHA256 ad8d379a4431cabd079a1c34add903451e11f06652fe28d3f3edb6c469c43893
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/0d0ccfe7cd476e2e2498b854cef2e6f959df817e52924b3a8bcdae7a8faaa686
    • Size 179KB
    • SHA256 0d0ccfe7cd476e2e2498b854cef2e6f959df817e52924b3a8bcdae7a8faaa686
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/363ea096a3f6d06d56dc97ff1618607d462f366139df70c88310bbf77b9f9f90
    • Size 154KB
    • SHA256 363ea096a3f6d06d56dc97ff1618607d462f366139df70c88310bbf77b9f9f90
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/README.md
    • Size 57B
    • SHA256 664146b80800229b268722d618ac4ddcef9bd4a29715e3b7ddd36a21a0012500
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral17behavioral18
    • Target
      Malware-Feed-master/2020.08.19_CISA-North_Korean_RAT_BLINDINGCAN/README.md
    • Size 57B
    • SHA256 80eaf28ff86838e322a4413f90c055151615a42fd0ad4d665201271684b9c06c
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral19behavioral20
    • Target
      Malware-Feed-master/2020.08.26_CISA-MAR-10301706_North_Korean_RAT_VIVACIOUSGIFT/README.md
    • Size 57B
    • SHA256 cf902e98385501c66693e066020c9cd5e8f0fcde375e2821d1b2658ecec7dfc1
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral21behavioral22
    • Target
      Malware-Feed-master/2020.08.26_CISA-North_Korean_RAT_ECCENTRICBANDWAGON/README.md
    • Size 57B
    • SHA256 02f4920a8920ce63f81794307420430419349050d34b304c5168cbba41138ae6
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral23behavioral24
    • Target
      Malware-Feed-master/2020.08.26_CISA-North_Korean_RAT_FASTCASH/README.md
    • Size 57B
    • SHA256 c84b6395bd4039e696a5f809e26812630a4b3a69e34e17d7dba6d32bbdf2f95d
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral25behavioral26
    • Target
      Malware-Feed-master/2020.09.15_CISA-MAR-10297887_Iranian_Web_Shells/4a1fc30ffeee48f213e256fa7bff77d8abd8acd81e3b2eb3b9c40bd3e2b04756
    • Size 57B
    • SHA256 4a1fc30ffeee48f213e256fa7bff77d8abd8acd81e3b2eb3b9c40bd3e2b04756
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral27behavioral28
    • Target
      Malware-Feed-master/2020.09.15_CISA-MAR-10297887_Iranian_Web_Shells/51e9cadeab1b33260c4ccb2c63f5860a77dd58541d7fb0840ad52d0a1abedd21
    • Size 585B
    • SHA256 51e9cadeab1b33260c4ccb2c63f5860a77dd58541d7fb0840ad52d0a1abedd21
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral29behavioral30
    • Target
      Malware-Feed-master/2020.09.15_CISA-MAR-10297887_Iranian_Web_Shells/547440bd037a149ac7ac58bc5aaa65d079537e7a87dc93bb92edf0de7648761c
    • Size 28B
    • SHA256 547440bd037a149ac7ac58bc5aaa65d079537e7a87dc93bb92edf0de7648761c
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upxcryptonepackerpyinstallermacromacro_on_actionaspackv2stealerguesthackedbackdoorvmprotect0pdflinkdroppernetwalkeraridviperslothfulmediarevengeratspynotesandroratnjratcomratzebrocyanchordnscobaltstrikesunburstsupernovajupyterteardrop
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10