General
-
Target
Anarxiya.rar
-
Size
53.7MB
-
Sample
240705-vhqbpavbka
-
MD5
d345b172408711fffd95a016486782b7
-
SHA1
a0b7189cfe47788b264e743be546f9cea0f3c8fb
-
SHA256
8074d6085f0629dc715fbf492933cf91ae573051c84aa749d56f88936e8f0ea1
-
SHA512
0a22a5946df436534e220082651a629fe55da1c0a1ed1e0a97ef6c35764f0737ad5f4d22f4f61e305ab72663c454e3dd94b37bdca9842d0241030fa27000e742
-
SSDEEP
786432:5Co3pULKQEL6voi2rbhNZ31HqCcymYonsE0uA5zMqmUdJUceAIV1Ee:5Co3pWKFa7ObhNPqHxDu5gnae
Behavioral task
behavioral1
Sample
Anarxiya/Anarchy Panel.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:7777
-
delay
1
-
install
true
-
install_file
restmaPrograms.exe
-
install_folder
%AppData%
Extracted
C:\Users\Admin\Desktop\README.txt
Files\Java\jdk-1.8\jre\lib\deploy\[email protected]
Files\Java\jdk-1.8\jre\lib\deploy\[email protected]
Files\Java\jre-1.8\lib\deploy\[email protected]
Files\Java\jre-1.8\lib\deploy\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
https://tox.chat/download.html
Targets
-
-
Target
Anarxiya/Anarchy Panel.exe
-
Size
54.6MB
-
MD5
94bac1a0cc0dbac256f0d3b4c90648c2
-
SHA1
4abcb8a31881e88322f6a37cbb24a14a80c6eef2
-
SHA256
50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
-
SHA512
30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
-
SSDEEP
786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj
-
StormKitty payload
-
Async RAT payload
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Renames multiple (3112) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1