Overview
overview
10Static
static
3ItroublveT...SC.exe
windows7-x64
10ItroublveT...SC.exe
windows10-2004-x64
10ItroublveT...rv.exe
windows7-x64
10ItroublveT...rv.exe
windows10-2004-x64
9ItroublveT...ram.js
windows7-x64
1ItroublveT...ram.js
windows10-2004-x64
1ItroublveT...er.vbs
windows7-x64
1ItroublveT...er.vbs
windows10-2004-x64
1ItroublveT...es.vbs
windows7-x64
1ItroublveT...es.vbs
windows10-2004-x64
1ItroublveT...LI.exe
windows7-x64
1ItroublveT...LI.exe
windows10-2004-x64
1ItroublveT...re.dll
windows7-x64
1ItroublveT...re.dll
windows10-2004-x64
1ItroublveT...er.dll
windows7-x64
1ItroublveT...er.dll
windows10-2004-x64
1ItroublveT...ns.dll
windows7-x64
1ItroublveT...ns.dll
windows10-2004-x64
1ItroublveT...er.dll
windows7-x64
1ItroublveT...er.dll
windows10-2004-x64
1ItroublveT...me.dll
windows7-x64
1ItroublveT...me.dll
windows10-2004-x64
ItroublveT...en.dll
windows7-x64
1ItroublveT...en.dll
windows10-2004-x64
1ItroublveT...ib.dll
windows7-x64
1ItroublveT...ib.dll
windows10-2004-x64
1ItroublveT...le.dll
windows7-x64
1ItroublveT...le.dll
windows10-2004-x64
1ItroublveT...le.dll
windows7-x64
1ItroublveT...le.dll
windows10-2004-x64
1ItroublveT...le.dll
windows7-x64
1ItroublveT...le.dll
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 00:44
Static task
static1
Behavioral task
behavioral1
Sample
ItroublveTSC-master/ItroublveTSC.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ItroublveTSC-master/ItroublveTSC.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
ItroublveTSC-master/bin/Binaries/RtkBtManServ.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ItroublveTSC-master/bin/Binaries/RtkBtManServ.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
ItroublveTSC-master/bin/Program.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ItroublveTSC-master/bin/Program.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
ItroublveTSC-master/bin/Properties/Resources.Designer.vbs
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ItroublveTSC-master/bin/Properties/Resources.Designer.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
ItroublveTSC-master/bin/Properties/Resources.vbs
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
ItroublveTSC-master/bin/Properties/Resources.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
ItroublveTSC-master/bin/obf/CLI.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
ItroublveTSC-master/bin/obf/CLI.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
ItroublveTSC-master/bin/obf/Confuser.Core.dll
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
ItroublveTSC-master/bin/obf/Confuser.Core.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
ItroublveTSC-master/bin/obf/Confuser.DynCipher.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
ItroublveTSC-master/bin/obf/Confuser.DynCipher.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
ItroublveTSC-master/bin/obf/Confuser.Protections.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
ItroublveTSC-master/bin/obf/Confuser.Protections.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
ItroublveTSC-master/bin/obf/Confuser.Renamer.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
ItroublveTSC-master/bin/obf/Confuser.Renamer.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
ItroublveTSC-master/bin/obf/Confuser.Runtime.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
ItroublveTSC-master/bin/obf/Confuser.Runtime.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
ItroublveTSC-master/bin/obf/Teen.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
ItroublveTSC-master/bin/obf/Teen.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
ItroublveTSC-master/bin/obf/dnlib.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
ItroublveTSC-master/bin/obf/dnlib.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
ItroublveTSC-master/bin/packages/System.IO.Compression.ZipFile.4.3.0/lib/net46/System.IO.Compression.ZipFile.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
ItroublveTSC-master/bin/packages/System.IO.Compression.ZipFile.4.3.0/lib/net46/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
ItroublveTSC-master/bin/packages/System.IO.Compression.ZipFile.4.3.0/lib/netstandard1.3/System.IO.Compression.ZipFile.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
ItroublveTSC-master/bin/packages/System.IO.Compression.ZipFile.4.3.0/lib/netstandard1.3/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
ItroublveTSC-master/bin/packages/System.IO.Compression.ZipFile.4.3.0/ref/net46/System.IO.Compression.ZipFile.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
ItroublveTSC-master/bin/packages/System.IO.Compression.ZipFile.4.3.0/ref/net46/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20240412-en
General
-
Target
ItroublveTSC-master/bin/Binaries/RtkBtManServ.exe
-
Size
2.8MB
-
MD5
88ab0bb59b0b20816a833ba91c1606d3
-
SHA1
72c09b7789a4bac8fee41227d101daed8437edeb
-
SHA256
f4fb42c8312a6002a8783e2a1ab4571eb89e92cd192b1a21e8c4582205c37312
-
SHA512
05cff2ca00ba940d9371c469bce6ffb4795c845d77525b8a1d4919f708296e66c0a6f3143c5964f5e963955e4f527a70624651113e72dc977f5ef40fa0276857
-
SSDEEP
49152:AsmhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gxr:6qXpy05Q0N1rsYSZ6BoXh1kkypSH3Ohs
Malware Config
Signatures
-
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral4/memory/2496-2-0x00000144CDAE0000-0x00000144CDE22000-memory.dmp WebBrowserPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2496-2-0x00000144CDAE0000-0x00000144CDE22000-memory.dmp Nirsoft