Overview

overview

10

Static

static

10

MonoBleedi...tor.js

windows10-2004-x64

3

MonoBleedi...tor.js

windows10-2004-x64

7

Theory of ...ng.exe

windows10-2004-x64

7

Theory of ...er.dll

windows10-2004-x64

1

Theory of ...gc.dll

windows10-2004-x64

1

Theory of ...tor.js

windows10-2004-x64

3

Theory of ...tor.js

windows10-2004-x64

3

Theory of ...tor.js

windows10-2004-x64

3

Theory of ...ng.exe

windows10-2004-x64

1

Theory of ...rp.dll

windows10-2004-x64

1

Theory of ...ty.dll

windows10-2004-x64

1

Theory of ...on.dll

windows10-2004-x64

1

Theory of ...on.dll

windows10-2004-x64

1

Theory of ...re.dll

windows10-2004-x64

1

Theory of ...ta.dll

windows10-2004-x64

1

Theory of ...ce.dll

windows10-2004-x64

1

Theory of ...ng.dll

windows10-2004-x64

1

Theory of ...es.dll

windows10-2004-x64

1

Theory of ...ns.dll

windows10-2004-x64

1

Theory of ...em.dll

windows10-2004-x64

1

Theory of ...on.dll

windows10-2004-x64

1

Theory of ...tp.dll

windows10-2004-x64

1

Theory of ...cs.dll

windows10-2004-x64

1

Theory of ...ml.dll

windows10-2004-x64

1

Theory of ...on.dll

windows10-2004-x64

1

Theory of ...ls.dll

windows10-2004-x64

1

Theory of ...ns.dll

windows10-2004-x64

1

Theory of ...nq.dll

windows10-2004-x64

1

Theory of ...nt.dll

windows10-2004-x64

1

Theory of ...ml.dll

windows10-2004-x64

1

Theory of ...em.dll

windows10-2004-x64

1

Theory of ...me.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    theoryofeverything.zip

  • Size

    120.4MB

  • Sample

    240514-pn4tdafc7t

  • MD5

    dbfecda82efe18a3450b12b83146aaeb

  • SHA1

    8a9f9c47c989cb1d1e537f975afbdb9144a68409

  • SHA256

    7270e81ff76322c4fe062d629051d369e6cf8d7bbe86f226c662daea1e7fbd9b

  • SHA512

    63c07036e07271e0137c89d109d26e22f1b1d4572df69304a0b4941ffd677a512df50e52981d659074a062ff22625e3783916340edda472b90fc96f4e2dcb8e2

  • SSDEEP

    3145728:bgfIHpXlKyAsxxCSAMzCEkl0aryuYAfVwPlKHS:bgwJgynXCSLzCEO0PS9woy

Score
10/10
crealstealerexecutionpyinstallerspywarestealer

Malware Config

Targets

    • Target

      MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx

    • Size

      59KB

    • MD5

      f7be9f1841ff92f9d4040aed832e0c79

    • SHA1

      b3e4b508aab3cf201c06892713b43ddb0c43b7ae

    • SHA256

      751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

    • SHA512

      380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

    • SSDEEP

      768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw

    Score
    3/10
    execution
    behavioral1

    • Target

      MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx

    • Size

      59KB

    • MD5

      f7be9f1841ff92f9d4040aed832e0c79

    • SHA1

      b3e4b508aab3cf201c06892713b43ddb0c43b7ae

    • SHA256

      751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

    • SHA512

      380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

    • SSDEEP

      768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw

    Score
    7/10
    executionpyinstallerspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral2

    • Target

      Theory of Everything.exe

    • Size

      6.6MB

    • MD5

      0ac08ce72c98d3d3871c209f85c660ae

    • SHA1

      8d601d2a9978e7a6029e93a73951ca5bf856f01f

    • SHA256

      149aaae086dc337b06f9d90f4969f4101fcba8f07db10cf66d513542c77de82d

    • SHA512

      0e3a80a8235d265a079f5e789a0ffc197551c008a7c62cbe5f665126155ed1fafc382aa294fac68f307148dc1c59e36e60b4f0905db9741ef09acf88888c94fa

    • SSDEEP

      98304:q9WQRZ4Lt/odDwG1eFsr7/zPlcGxH0Ig17E3AAy5tx5KD/SofcqBxAridooe8D:qXZ4eDwGcsztcGfcY3gtAxcqBxAri4a

    Score
    7/10
    spyware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral3

    • Target

      Theory of Everything_Data/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll

    • Size

      769KB

    • MD5

      7d37f70aa9e8cefed7f1d3bbf43f336d

    • SHA1

      779eb3c34ade41365e614848819cb3bc4dfa7867

    • SHA256

      31b9ca94e3ed2688779dfba10bbe35d7e2c87425173994a4de772ca27d5c47c5

    • SHA512

      0cdbc1310dcaa5892c94e284370b4449f0eddf0734e6522f5a1686bdcb0fb03d80317348ddd0b9d3b53c70a3e3d3f99e73c6ecdc200b5066ddf33fa10203d7e9

    • SSDEEP

      12288:cDO9tW5xZpTCJvEFvN9TH+m36rm+QFk0Po1TnmfqXbymLA:dILZpTCJvEFvN9Tp2DQFk0Po1TIqbLA

    Score
    1/10
    behavioral4

    • Target

      Theory of Everything_Data/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll

    • Size

      4.7MB

    • MD5

      bb4e5098e8a32dcc4d9dfee0fe24b4fe

    • SHA1

      35899ad7aef28853d315fb24d64204da55aa396e

    • SHA256

      45b0d24335f90625a868789b479f0a4c48fac86d43710d04da078de8f7c24282

    • SHA512

      5d990b123d548076b3304b69ea7fd3603bea705282a3650c29ae0095c4a15dc8c5115bba7d7787b2d3cad2976ca83fe5f99deb975065c6ecdae43daa1cb5b2a2

    • SSDEEP

      98304:969Y2vFQjA9qzE8Hrr2jJxcpFzCXSVB5Sn:p2tQjAQI8Hrr2ApbS

    Score
    1/10
    behavioral5

    • Target

      Theory of Everything_Data/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx

    • Size

      59KB

    • MD5

      f7be9f1841ff92f9d4040aed832e0c79

    • SHA1

      b3e4b508aab3cf201c06892713b43ddb0c43b7ae

    • SHA256

      751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

    • SHA512

      380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

    • SSDEEP

      768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw

    Score
    3/10
    execution
    behavioral6

    • Target

      Theory of Everything_Data/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx

    • Size

      59KB

    • MD5

      f7be9f1841ff92f9d4040aed832e0c79

    • SHA1

      b3e4b508aab3cf201c06892713b43ddb0c43b7ae

    • SHA256

      751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

    • SHA512

      380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

    • SSDEEP

      768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw

    Score
    3/10
    execution
    behavioral7

    • Target

      Theory of Everything_Data/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx

    • Size

      59KB

    • MD5

      f7be9f1841ff92f9d4040aed832e0c79

    • SHA1

      b3e4b508aab3cf201c06892713b43ddb0c43b7ae

    • SHA256

      751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

    • SHA512

      380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

    • SSDEEP

      768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw

    Score
    3/10
    execution
    behavioral8

    • Target

      Theory of Everything_Data/Theory of Everything.exe

    • Size

      638KB

    • MD5

      4a11b18b927abc2eeba3830dfe26f58d

    • SHA1

      ba843f43fd0b4bc84961089286b73a701bc82d06

    • SHA256

      0b3b4d243920d05a93e187c181c38627bb91f728bbc97abfb8d89feec642d25e

    • SHA512

      e802360ab1bad8a12c5410e55233d3d1f2893c881c1812efa744e7a6b101185509c6b875c89386106ea87e7acdb6bf40e0c91720f9098ea6a5196b47cd78e9cd

    • SSDEEP

      12288:z4eC+mCbUDn/Af95WcjbKNZqJvsN0u36mr/DfAScy:0qmCbcW9aaJvsGu36mrLf0y

    Score
    1/10
    behavioral9

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/Assembly-CSharp.dll

    • Size

      156KB

    • MD5

      f8b16be6fd546a131ada141f12f17aac

    • SHA1

      4975d90c16096dcf1a8ceae446783807b7679add

    • SHA256

      d048a1b2084475a47812da495021e56277bb303a7e7b57f0b652e144e82a2dbc

    • SHA512

      29ed3952512a6a37259eb04fcbd94b35605919a577b6894a63a53ff36164b9c5acb76a992ea219f84b169847506ee33f1c352865c564447b42bb1cec39cf96cd

    • SSDEEP

      3072:471Y1vgT73kCmp+ysUwRpt7epB6raR3/ZJWDTeZqud8M4CJS:OhvDpt7epYaR8TIvmS

    Score
    1/10
    behavioral10

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/Mono.Security.dll

    • Size

      303KB

    • MD5

      f7acab1e09deaa11c9bdd0d723363016

    • SHA1

      e940058cff5dc584c11dc6e4b111e85a3f6ca06e

    • SHA256

      8c47b23389f9eede068683ed8b64b5a466f986499112983290778b30accfd1ba

    • SHA512

      ec73a3c841358113a33829b50ea14ec860ccaee883c327515b369d08e3979643466fb57dfd550c62eb1468b6c92c0cb03ffb07505ec77e62bb83fafcd51b2894

    • SSDEEP

      6144:Buca+sTOwf+31OE5FXNywY1URfxArXj5of:9Ui9kgxY

    Score
    1/10
    behavioral11

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.ComponentModel.Composition.dll

    • Size

      242KB

    • MD5

      7cfe714806f245e2571e58be288ea10e

    • SHA1

      4820ec4a7558e18aa1ea151d22cf1920b82b23a7

    • SHA256

      596500c15e90d4b63573a19da292009c95b02e05005f48077d7fc0850dd220fd

    • SHA512

      9e5808152c5921b69f1080644ff84a1ecbf1358475c4c28191bd07a061e504c72264854777c2be38dadb7c250d890285f55d94a394edf8277692a83fe9d79bf7

    • SSDEEP

      3072:DdpvT15KXwrqrkRixoK47Sr73v/1fLExXEGgDX/EOoRlKPW10QgFLqRRRRRqqS6h:DrvTmUTTOoRlKPk5gF3HoJ0XtCeaK0w

    Score
    1/10
    behavioral12

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Configuration.dll

    • Size

      42KB

    • MD5

      0765746318f9520147182a4e503acef9

    • SHA1

      a7a17abaa12b469953cc61da5d2c84913223c11b

    • SHA256

      e69e4d073e188a3b0df9bea575927e813d4092e1e3599c54ea15aceb19c1e199

    • SHA512

      8273d27c1acd0e01b50e124593a28ae6c52ee1c5606c954287ebb058d0f312d35cdc31a95c4d0112668ae6491fcd961db0acbd8fbedfe3c92ced8ea4ee383513

    • SSDEEP

      384:uC2yuMNMMZJN56g8mKo/hjp0r4ourMVSzciDqnjdiaFg9/Ses93HE7LDaXTSv/fG:2yP1Sm3ScrMdWgdVl93kZAarx2ZJO5

    Score
    1/10
    behavioral13

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Core.dll

    • Size

      1.0MB

    • MD5

      caf99bab07df42b6e4544ae64dc4d908

    • SHA1

      cac81132ef8a76cc0bee99dfa5ffc2096c02b848

    • SHA256

      2d702d211d34e9b94ca18a5ef10a6c2b0fa40fb2cb09751348c7d5bd4dffed02

    • SHA512

      312ae4f3baa0bbae11173961f99d4ca1ff35473fa7432076c36fe07ede4f16b882e03d5dc4216f20091b47763e269be113fe95af9f31927b789c3bf953569c19

    • SSDEEP

      12288:7HJ2eJWqejMiMRDm3l2fo+5HcXILaRbm57iNC/UB1658SYd5kcowul:7HFGoqCUXAYdecowul

    Score
    1/10
    behavioral14

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Data.dll

    • Size

      1.9MB

    • MD5

      d314b95fb863cdd6119abc7e28e7c1fa

    • SHA1

      5996b5c782631a2e7f276f5f660809c421810916

    • SHA256

      23dae8379e8c412f69caa0668be411c87672a775ce473e18faf01f56c114e079

    • SHA512

      bd74f8a6d19bbf45ae67117ad3fa8eafc397c16657197eb4dcbad3829ffa6096fc29c692b7dc8649a75c9d6078c8ed123806de27db290a9ecf445143187801a9

    • SSDEEP

      24576:+etFgYwMkru3rrFdx0dkR9VUJLdaD7y7X5bLid1EB80o6Dpc:HFLwirZ0CUJL4f1EB80jp

    Score
    1/10
    behavioral15

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Diagnostics.StackTrace.dll

    • Size

      6KB

    • MD5

      1fbb019db62578427a660fdca39139fe

    • SHA1

      6c5cee9a58dcf493f94df27b7de17f19bdf021e3

    • SHA256

      4701e843059674accc1c87038ec41f3cecbadce2a65755f527c8b65b0cebc8ce

    • SHA512

      7571a6b15a03b2ac408d219b798b964d90cea0b58ec9cacc2709c1495dd4edd24fd35327e496e945e297f1fc976f128db6ee6a75e1d22752adc7a79a65f3d4dc

    • SSDEEP

      96:Z5SzrdBy6UFfVGJfFPlcaxvtV6gOCua5fpbe1xa0:Z5QfnUF9GBFPl5xFVsCFTe18

    Score
    1/10
    behavioral16

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Drawing.dll

    • Size

      180KB

    • MD5

      1afff3a67c365aed5c2603e9c69d8c51

    • SHA1

      9a95855ddf016638e72c3bba8749823969fcd9e7

    • SHA256

      41d7f9907c43d1c9dda3cd4a9eda76c836dcc7daf7f657ba993f6b6d9c146ae1

    • SHA512

      9252dba52939c852f8377a58b2f0ff673775f409f41d5efb463c50cde72da8d1c6ef595f3d1ef94db3351d3b41a66711dc6ed299a8fd1b5a880c04af25614c7a

    • SSDEEP

      3072:EigawrUmay+yV3XOe3QpYbh+q6FR3F7lx:v2VnOppYbh9Oxl

    Score
    1/10
    behavioral17

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.EnterpriseServices.dll

    • Size

      32KB

    • MD5

      b5564227dd9dca95c7e0760c7524e7f7

    • SHA1

      ce1d3f79a763554f67f45f666fad48c7251ad48f

    • SHA256

      a805a32131c8fb1d235f7f7a59d6e47ecd7f8f50694ff8f032eafbc4d0d90e71

    • SHA512

      35877ebb4f22a1ec23a072594f6cd2b4ce9cbbc45f2e65cdee0c3dab6aae3a57fec7ec60b1a96c35e05b70b69a79367c3b798993e0dea088135681a3841bd564

    • SSDEEP

      768:WFDPgwXPjXVB1SeXbtjfLWifV1jmadK/wDS1ubnpkQK:WRPgwXPjXVB1vXbIifbm8KoS1urpkQ

    Score
    1/10
    behavioral18

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Globalization.Extensions.dll

    • Size

      6KB

    • MD5

      f09c5ddef200f21725e5fde17d3b9016

    • SHA1

      44bff1f24b235f742f84e4f152e912fa0452ec9f

    • SHA256

      4e8c5ad3450450ba6bc6a474300f2445094870f2bcc9ca16472fb2f3adb88ebd

    • SHA512

      d966eede100800f13f6c759a59410758b137379aae5ad4f770e705197fd02b6b7e7ea26f08a9bddc10fbf5e01948117e3721248603d5e40756f458f20edbf6dc

    • SSDEEP

      96:ZA4ggaqpBVwEw8xv1lOH2OARPtcRQKRWen0R/0:llLxXOZARPCRpRWen0R/

    Score
    1/10
    behavioral19

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.IO.Compression.FileSystem.dll

    • Size

      22KB

    • MD5

      f9a07c1ef58c863f89e74f11a3b21447

    • SHA1

      b80979949b817d26afe0a8a8b0358f704ece82b2

    • SHA256

      221abe4eea00347c51ac7409b47ba7b08ccfdaae8e36e706a8ee0d4de6ceb87a

    • SHA512

      280f846d9d769a3244a6689c72758024639d867bb5f272ed54577ffb3a6f6bd29fc22ac9dff0010f04524c352b76cc7703325c11cdcb63aed5412d96881d091f

    • SSDEEP

      384:6930DrKcLQhPZcNgndNzytVTl0qRbli3ESmMadMMtDBEb/gYFf0B7a:60D1Lhs6ve6

    Score
    1/10
    behavioral20

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.IO.Compression.dll

    • Size

      96KB

    • MD5

      bd03377bb478fe581834bb237b4c6725

    • SHA1

      c3ae3bcd5c8d9af77cc579e1d335f8cf6d2a2415

    • SHA256

      6045d16e65834f67b2604359a137a4b74434293813ccab0d86b34c5f7b1785fa

    • SHA512

      7cd60c00a40e4dcb5b4fbcbd71ed2249d0e2baef48aafd2a72cf95040c653187109b85f96167bb8e550d38b630129dd7df597d104e3284a6ade425c480f25501

    • SSDEEP

      1536:mVYlTkwzl46ORXHNopHEJo5JK1/E9ITZOBLOTX8MHujjHs67b:mVYZH5460XNopgo5JK1s9NCTXFHuXTP

    Score
    1/10
    behavioral21

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Net.Http.dll

    • Size

      112KB

    • MD5

      42bdedded9d4107ac31ec2d5f28f6e1b

    • SHA1

      d66e90d23f5f794a9aac281a3d2712600780772a

    • SHA256

      88870a3dd7923bca34f35c46a3c2b3145cc34a9ce444a307c8c69efbcb82f991

    • SHA512

      993d55ea201ec30ca8963263e710808a318e732dfdc3bdcb9cb00591fddb05cd288e614b8e26cfdae00e9ba35e9a96151d6fc24368140bf30129e680f40d2083

    • SSDEEP

      1536:IRmbM8tBzjhvA8/Ljg06MYTJkjJaLbECSgTM4ylFyz/XyPb4zt1cb5O:ImhVP/SwWECSgTM4yPyz/XyPb4zf+O

    Score
    1/10
    behavioral22

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Numerics.dll

    • Size

      111KB

    • MD5

      885b5345047df2ed6298401f3acf3159

    • SHA1

      e271ce9efe4e140a8a5489202992bf80fbf45986

    • SHA256

      01d3b2dd6375da4378b8c9951a6bbb4997dd6a0651753e5736aa1b0587015f35

    • SHA512

      7bfbdbd52f044e1c4504111a4ec93b62ee0711ca9299884b1f073f0521250231caaf8e33142b6d5ce5b1f4e40a25b82b6059236b87afe070cddd73215e29cdb5

    • SSDEEP

      1536:2tbXi3q2X2T+jc5o9SQMhhuiVEptn+igiqW0NzN9CXI0pVzDtPrXpNPRGH0d9cW:r3qKc5oEhzVKtfg7W0NXlG3tPrnl/

    Score
    1/10
    behavioral23

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Runtime.Serialization.Xml.dll

    • Size

      7KB

    • MD5

      a9f4cef4a4cbc618fb55e324be0ae949

    • SHA1

      d2cad3b5e80fe01056613b0d942c177cc6d0cca1

    • SHA256

      2394dff209954e143795bedba8ec9c737e17ecd96e3a3a02de6d7c2631f04152

    • SHA512

      a5032317153b8d0cc979fe031d63260b8d099134c4077d2915a15559741d4f67672a3380ca2809d289f24027bd72a62237c9bf9837633d8be0304732cf56df57

    • SSDEEP

      192:8DSDpZlHcZQcXAcu5H8Ht6xI83h0MuENeqB8:8DSDpZlHcZQX18HSvOMuEHB8

    Score
    1/10
    behavioral24

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Runtime.Serialization.dll

    • Size

      821KB

    • MD5

      e38f503216d5820dfdf2d469e194f999

    • SHA1

      3e389a379656b5786b601c8ecd0a49f119a5caca

    • SHA256

      988564a6a6cdd7efc8d541434ccff96bbc2f7f9349290b0efaf5735046cd582f

    • SHA512

      fc96c66c0c16c88797ad333dc742343bb05777258e9faa170d6e4f62de5f556583101c16d56fd7dac481ce755b02065414f8697335b02f9e581ad222e11f5d71

    • SSDEEP

      12288:V7UKDvNE01glqPJyL53hehpE0ukyymiA/JvKL:V7nE01gWJy3hUnW8A/JvKL

    Score
    1/10
    behavioral25

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.ServiceModel.Internals.dll

    • Size

      213KB

    • MD5

      db77383f6a5476198c0e065e12d183a7

    • SHA1

      9effed5affa4c7566d45d9fc40313d1369ac39e0

    • SHA256

      ab27dd2afdfab73dd36c5b90a542c78a69822d8add2bba3cc95db8990b23f4c4

    • SHA512

      16f9dea8f871f618afc8f012b7ab3a4087e5885b7155c3c8d5212163bf974438f3f2dcf87bf46c060d0133511f6f148f851fd5d6dcc5bd94a4c7c12855415636

    • SSDEEP

      6144:8osVNgZFwcHCjvBd/LnGQk+wfODcWJkP:8osVWZFwcHCjvOlu

    Score
    1/10
    behavioral26

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Transactions.dll

    • Size

      32KB

    • MD5

      372716edcb838185812ae2b1f729c6df

    • SHA1

      ce108732f9ee44c18e6434c886bcd75e112e9bbd

    • SHA256

      ff78a8b68809535c1d93cc6e511c79e0d2f85d97b358da2a8a76eca8c8f2e4bc

    • SHA512

      d41f07db40ef77a692e9222af2a9e5789dfe1914cc668c8128f26560c9ee062c7ceadc60dda1a9ea57b23fb4214c4c88f14fe71e3330ba6acb018a9054f66c91

    • SSDEEP

      384:2y9feF73NdxAgFDQLXzDjsG6QTWyAaL5NcX7fk57TuTepkZb0Rbli3ESmMadMiio:p9feF7DMjsrQJLkXAFE8kxNZ

    Score
    1/10
    behavioral27

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Xml.Linq.dll

    • Size

      116KB

    • MD5

      13489016860b776576969ae7c4a08a91

    • SHA1

      27d9afb31db54faf71a3a78025f703e61043b9b8

    • SHA256

      7152197c2d69b60a24b9af3323b45b76bde9f9f63a447c69090656289ac32c1e

    • SHA512

      71bba3edec3980a8e9ef157e61379384247c2f129dca097e528b8ea4a826c4c4e87a7248cfd68dc51442934c38c6287e8d14fdbeae68edcb226d401a3245620b

    • SSDEEP

      3072:vNU5ioEWuB91Z0S44VPRN5qaYf81tVZEz2:bB+iPRGiE

    Score
    1/10
    behavioral28

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Xml.XPath.XDocument.dll

    • Size

      5KB

    • MD5

      a9550b31f294bd35d030f4760b591bf0

    • SHA1

      d3037659b6f9111b1328141625f99aaf0af35f96

    • SHA256

      c53307ed65e10be7f252ee8c93a6261af7a7c44b5006631f57950624c3f06f5e

    • SHA512

      a7e619de6722b3ec3d17b1636682f054d425187ab095b5ba2d24ee4100dc7a38bd3378beb0a8dfe15fac8f858844b6ee8a064f35aeb3179250c53423b195c12b

    • SSDEEP

      48:6u+llre3H3BfWYxWkxb1wfRrZ24Mvzsz+IvRkT7G/wxO38SZ44l+lmeAC5IhefV+:IufWkjxaRrkIxvAPOLmceAi0

    Score
    1/10
    behavioral29

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.Xml.dll

    • Size

      2.3MB

    • MD5

      dc13c345b6649321d2ae8c84cd302144

    • SHA1

      c929df287acf5a727397541ef2c4b8a595aec60d

    • SHA256

      8283e176446695c0486b8b1cda7581178e9ddd5ceb49873dd7da519730497609

    • SHA512

      5a3b15728cca9b1fc46ffdf718fd28d738f628c4a14e1888a49ef4280fe15de3ee23f99f037616459adb7b0047baa31ad3ae0fc97af8ea67026979a969c64489

    • SSDEEP

      24576:Oj/y6RfS6LIqFLHAx7YEDno3CfxkvUVZl/VNnTwlh3WnWMQNtH7U/ZD:heLIqFzAxnDqWVNnTwlh3WnsNtH7U

    Score
    1/10
    behavioral30

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/System.dll

    • Size

      2.2MB

    • MD5

      c939fa96fd80d8a5373e49ceb020b115

    • SHA1

      924a0dbefd8a426467972253d1488f8cf3b13c20

    • SHA256

      eb88af77bd39b9a7da6c3a248d0f57ce1e83ad7921aec5441d0c5b48d1c2b0ba

    • SHA512

      58e261b48745ded6463daf85b60c770a787595c1c47ecba9295c39463d995280672b04471c2cf5a246806aa87d99a9d7f4b0a6411d871a3dc1d25038f703a667

    • SSDEEP

      24576:IMh2KuFsAB6Tq3S5FXV9JCBdkFPaJaoJnZLLjfnajfdlvEiGrLpd4k1LY+HXD7P1:BjuhB6O3S5FxMfvL3HXD7PBDHibWcv/

    Score
    1/10
    behavioral31

    • Target

      Theory of Everything_Data/Theory of Everything_Data/Managed/Unity.2D.Animation.Runtime.dll

    • Size

      36KB

    • MD5

      b6add377c2c15a7c0fc6fb41bcc48951

    • SHA1

      d71cd09479ef2e8623eb76633fdc0e291b3472a8

    • SHA256

      8800ba3ad22a6099dc307836f69b090aaccd7d6a902f6ce7c7f8b9fc2e84be8e

    • SHA512

      3dd652951927e8c62e51a21b0e8fdad4582c6b1cc1926bf8efb6511aafe164ac207a920236941e49f04204ce8f11cddf72cc8fd8e6d43f60b722446978ac3789

    • SSDEEP

      768:1HG1Oh8jUdKwT9hEjs813/STJ4FkZfZPoG7DdEPPF3jqQyGjZ:Q1OmaT9ujv136tXZPvfePPF3/jZ

    Score
    1/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

5
T1059

JavaScript

5
T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Process Discovery

2
T1057

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Web Service

2
T1102

Impact

Resource Development

Reconnaissance

Tasks

static1

pyinstallercrealstealer
Score
10/10

behavioral1

execution
Score
3/10

behavioral2

executionpyinstallerspywarestealer
Score
7/10

behavioral3

spyware
Score
7/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10