Overview

overview

3

Static

static

3

Ruler.IRule-1.1.0.zip

windows7-x64

1

Ruler.IRule-1.1.0.zip

windows10-2004-x64

1

CliFx.dll

windows7-x64

1

CliFx.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows7-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

Ruler.Engine.dll

windows7-x64

1

Ruler.Engine.dll

windows10-2004-x64

1

Ruler.Engine.pdb

windows7-x64

3

Ruler.Engine.pdb

windows10-2004-x64

3

Ruler.IRule.deps.json

windows7-x64

3

Ruler.IRule.deps.json

windows10-2004-x64

3

Ruler.IRule.exe

windows7-x64

1

Ruler.IRule.exe

windows10-2004-x64

1

Ruler.IRule.exe

windows7-x64

1

Ruler.IRule.exe

windows10-2004-x64

1

Ruler.IRule.pdb

windows7-x64

3

Ruler.IRule.pdb

windows10-2004-x64

3

Ruler.IRul...g.json

windows7-x64

3

Ruler.IRul...g.json

windows10-2004-x64

3

Spectre.Console.dll

windows7-x64

1

Spectre.Console.dll

windows10-2004-x64

1

ref/Ruler.IRule.exe

windows7-x64

1

ref/Ruler.IRule.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ruler.IRule-1.1.0.zip

  • Size

    762KB

  • Sample

    240707-dtq9pavcne

  • MD5

    ce1e21fab90cbf2db4f90ec8eea38051

  • SHA1

    dbfab44f69b3fd11737c7ab71c133621f5cd7d14

  • SHA256

    8a33cc7af2cf926411f45236cb841d1b5ab667aabff7c85c102a0edb2baa2534

  • SHA512

    c696084d4a465e8d3216c53b8ff96e8b7e892122d390d6366dcba793df9944af0d7b24cff6191fcbf35058c1d553c19bba45263e62255893be69c14c0095d4cf

  • SSDEEP

    12288:qRp3J3H5k7PIK7Opi+B4UINGw30v3dwRZWespUPq3JQlvv2VP:OZX5kLI++B4ewGKri583k

Score
3/10

Malware Config

Targets

    • Target

      Ruler.IRule-1.1.0.zip

    • Size

      762KB

    • MD5

      ce1e21fab90cbf2db4f90ec8eea38051

    • SHA1

      dbfab44f69b3fd11737c7ab71c133621f5cd7d14

    • SHA256

      8a33cc7af2cf926411f45236cb841d1b5ab667aabff7c85c102a0edb2baa2534

    • SHA512

      c696084d4a465e8d3216c53b8ff96e8b7e892122d390d6366dcba793df9944af0d7b24cff6191fcbf35058c1d553c19bba45263e62255893be69c14c0095d4cf

    • SSDEEP

      12288:qRp3J3H5k7PIK7Opi+B4UINGw30v3dwRZWespUPq3JQlvv2VP:OZX5kLI++B4ewGKri583k

    Score
    1/10
    behavioral1behavioral2

    • Target

      CliFx.dll

    • Size

      100KB

    • MD5

      c0cf9423a4141c16f1da20ba5d0c4341

    • SHA1

      89f0e73083eed05305d521bbd6a4445ef5a5e8e2

    • SHA256

      c66cdf7bd17aa16615b03cc647c4baedd25b6fe436b55367a048fd76f7654e35

    • SHA512

      58605db4b1a9ab2e56a9e375adf92c83f2b9367138de2eed1ecaaf9647aa33ee5c9dbb61d7928515612f68fd03c0c33b03ef399ec4363cf8841eb08d41f44325

    • SSDEEP

      1536:gsl1z9wUWo2QK3tWYp+E6l4ze8qUVbZmN3drEpQxyysdGbuoL0APVprbC:jlXJl4NtJZ2drvjsUbrPV9C

    Score
    1/10
    behavioral3behavioral4

    • Target

      Newtonsoft.Json.dll

    • Size

      679KB

    • MD5

      916d32b899f1bc23b209648d007b99fd

    • SHA1

      e3673d05d46f29e68241d4536bddf18cdd0a913d

    • SHA256

      72cf291d4bab0edd08a9b07c6173e1e7ad1abb7ab727fd7044bf6305d7515661

    • SHA512

      60bd2693daa42637f8ae6d6460c3013c87f46f28e9b0dbf9d7f6764703b904a7c8c22e30b4ba13f1f23f6cbee7d9640ee3821c48110e67440f237c2bb2ee5eb6

    • SSDEEP

      12288:1eos/POdGV5jfWrV/9Yeh9eRcyLfLYtT5mWxTZ/B7jW5JMtRRpKzQk:10/POdGV5jfW5VnhFyvOB7jW5JMty

    Score
    1/10
    behavioral5behavioral6

    • Target

      Ruler.Engine.dll

    • Size

      9KB

    • MD5

      3fe01fb6b11407e261000cc196a4bd6b

    • SHA1

      4a4a36bba23103660b7c488571c62b1f4750176f

    • SHA256

      f79f77c8c3578139f654132fc3d526b8db51d3cbf31f752f4a6452a2b4dd3605

    • SHA512

      b1dee2f7d451d3f9eff8314b9f69a74c8c899ee92dfbbec288435c2a545b58aaa22bd002e910242ebd33cf3f292c4685a99323a5d4274359595a98c7fb2b46b7

    • SSDEEP

      192:Tdj9rNwJDVwjQ7F7Ig3w+x1uQuH4JrMo7dkjvrYUBFZyOAQ:BBrNwUjQmgVLrMo7dkjvvzV

    Score
    1/10
    behavioral7behavioral8

    • Target

      Ruler.Engine.pdb

    • Size

      11KB

    • MD5

      52eb1dfa65939c3afb8c27d4ee389d21

    • SHA1

      7bfcef34645e9386491c0052bdf2f46dbb54a0c9

    • SHA256

      f74ce0efa50ebf296f7c1f9969bd095724adcb82615139e6edff570f47bc14c4

    • SHA512

      720ec6d9007c2f578c219a28bdd27ea4f01d310e772e3771986ae67a0c5bdf6544c567d0a912ecfa8f03e4572523690f22bb4ced6f91db4d4f01d960565bbe35

    • SSDEEP

      192:4v9M+QfFaBL23Q3rp3EV9L9s9/9D9+nhMx0cXI16GhhEnaZl/zxXkmG4sc3dQ4or:4v9htaAl5M16GnaaZl/zxXkmGPcV3WkI

    Score
    3/10
    behavioral10behavioral9

    • Target

      Ruler.IRule.deps.json

    • Size

      2KB

    • MD5

      edca4fa4c3129f401809a6c9ae183d02

    • SHA1

      09d8c88ed3a646dc8a27e8711579f365120d767a

    • SHA256

      276998154b098f4e2d24e41b33204ed7b60cbf174baaa8453403705a3e2c755d

    • SHA512

      2f77ca5436704a49bbdef70709d8cf09dc8949cd23dcc6a14772f7beab95a3eae232b0b87d2ce6947f3b8644056e99826373d5ff6801578a7f04fd7d0ed84961

    Score
    3/10
    behavioral11behavioral12

    • Target

      Ruler.IRule.dll

    • Size

      41KB

    • MD5

      535fb5db8ff59e4be48b889103d3a8c2

    • SHA1

      13ed6609f4c14c1aaa1189008db1a5a33d0780c2

    • SHA256

      0e086958f19eff5410de1882814622dc76f81c75bf3adf4c8bf31806662e5a2b

    • SHA512

      fe9c34a1a1b3b7b059926d03cd093dee2a3871a9e2cdc9ab22eb2c35a45388f19e3f7ff1343450717726e7b7c7b433fe9e96381ae365e0e6133256288338fa13

    • SSDEEP

      768:PUcOG9BhrzWxn7mqBhf11vaoDYDlivEDVbi/N+6BL:8cw1J11vaoDYDLVbi1

    Score
    1/10
    behavioral13behavioral14

    • Target

      Ruler.IRule.exe

    • Size

      153KB

    • MD5

      ccc7b44c7bc889ded016b7f28a828980

    • SHA1

      d4ddaea201cb60acc86450dabe4c41cb0eba83a9

    • SHA256

      492f1aedf4893e90bdb64afdc1e2cf19d4e0f1f6849921c6562460cbfbf00461

    • SHA512

      8391e1890583d8985b4cf2fce1882f1f5a224790e9ccb0938cfe6b2f81fe5fdd94bb3f4a0bff6247b78f2fef05a9bcebd84c0469c9300e2d57b0f4a5f8545487

    • SSDEEP

      3072:gwLEVbLoEZlKk7611VBzNkDqrB5bGEAd9/i3s:gRuk7611VBzhEEua3

    Score
    1/10
    behavioral15behavioral16

    • Target

      Ruler.IRule.pdb

    • Size

      14KB

    • MD5

      d84b377723309d096f03bd74dfe0d031

    • SHA1

      db5087ca8b2767764fa2b14960e58893f4abce84

    • SHA256

      61c0f79b5406b148896c26b13082502ed2aad9d338ad39f6fa5c8bca77b2c290

    • SHA512

      b2726ad03470b192a6b53056a5ae5b54f50ea2c829b84c12abc16332677c4253d8a0d2431975afd159e66e08983c7fdfe06f238db115aea38c40186f690b73a9

    • SSDEEP

      384:wlP+16GnaaZl/zxXkmGPcV3WkHXf+PA7enEUnayf8Oqlql9:4q/92PP9

    Score
    3/10
    behavioral17behavioral18

    • Target

      Ruler.IRule.runtimeconfig.json

    • Size

      253B

    • MD5

      24e4653829de1022d01cd7ddd26e2f22

    • SHA1

      9160a009cb381e044ba4c63e4435da6bfeb9dc6d

    • SHA256

      ded3aeb5856a11db0b654a785574490cab55839ebfb17efe9e39b89618fc5b91

    • SHA512

      efd4bbba1baec0b47003831510e3aa539db9ef468e0f06ba9d7ba6d0b3800035f7c818d7d90171bfd377ec97d08c4617555bcff635dd83efceb412b1a9cca820

    Score
    3/10
    behavioral19behavioral20

    • Target

      Spectre.Console.dll

    • Size

      783KB

    • MD5

      940d937fc66997772fd3d85ecdd851dc

    • SHA1

      3e878c0eef4265b825d8cea3db68b3ecde92c564

    • SHA256

      9d5d87b6d1be137ee0046b3044f43525044e55e92a9ab5977a9037abfe943db3

    • SHA512

      6911e74574ae77f7ebc8f59e58a3e8d34922e2709946439bff093dd9d7b0f956b6ad8e8e13aea2d719ec1ed53b590502a024a8ad5786a26740f9dad772897cb5

    • SSDEEP

      12288:3ilLl/lfNRC0HN/9RiayOFqgiHhjLev+YZuNiyFXKV:R0t/9RDwniuNiyN

    Score
    1/10
    behavioral21behavioral22

    • Target

      ref/Ruler.IRule.dll

    • Size

      19KB

    • MD5

      53219a941c35e570766d68b006e564da

    • SHA1

      3e30428a2b0b355244250707222d0fe3e1120de5

    • SHA256

      d71d16e27a2588d571b9fb5d363d8d0fc21cdb9c7147cd62a1fa3d2965d7d3ca

    • SHA512

      f6f892bf6dca0c0170151331d02c7593c51cbf2a2b1263f590820ad01622aa289c03b9c9c837c3a429cb9d5099d7807e9ade80037b285549a1d15ce171754ff4

    • SSDEEP

      192:goJtxMHb92e7PSjNtB2vwAbKBrJFEgG81V:g0xM7QOsNtCKBf

    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Enterprise v15

Tasks