Extracted

Extracted

• • Target

    FunCheker.zip

  • Size

    4.9MB

  • MD5

    3c9843fb6afb01b0ddd2c880147cb156

  • SHA1

    5b889dd2416037fda2e1567357d5757aa9d7fb0f

  • SHA256

    416e65650c0e2c368a1de8ec1c39432616ab767bf215d979f614719101e2f890

  • SHA512

    f20ebac058c69851a572450d65e3053c06ab9c2c6ad826896ec359cc8d9660544973af8f19c7c01d5b552b644e399a7e3619dde139e880bb5e8708a38a7ddcb6

  • SSDEEP

    98304:U85Abi1MPrYXidZ7e9wwwFOX9IxDKekJNYVTC1udTXB8OWetQhZTpyciWIJ:X5AmKPy8ZK9wz/GJGVTC1uXB8feyhZN+

  Score

  1^/10
  behavioral1

• • Target

    FunCheker.exe

  • Size

    4.9MB

  • MD5

    ed4e93a8e3e314093fd29c1eec8a215d

  • SHA1

    33b3c5588f9c59668c6d1d307de2219d1dd2001b

  • SHA256

    484ac7a733ca8a6eaecfe04a9fabe559a44dad80bdfde4ce6cd735d87eccc7cc

  • SHA512

    703948850a956f665c64a6f601a3a0ebc5a366da7af6abea53a7d28bc264a8b7d7115ef54cfb5bb229edc2e2d71806580e0356fe74a9b1fe59516a2ab1cce92d

  • SSDEEP

    98304:euphkGhwiL8sEHA5Empd+OvwqyNUOT++UDu93CVZnZgSROb5WbOG:17k7oiQEmpg2NSK+ZYA5W

  Score

  10^/10

  umbralxwormbootkitevasionexecutionpersistenceratspywarestealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies security service

    evasion

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral2