Overview
overview
3Static
static
1MTool-Disc...ool.py
windows10-1703-x64
3MTool-Disc...t__.py
windows10-1703-x64
3MTool-Disc...ase.py
windows10-1703-x64
3MTool-Disc...pat.py
windows10-1703-x64
3MTool-Disc...ons.py
windows10-1703-x64
3MTool-Disc...lds.py
windows10-1703-x64
3MTool-Disc...sks.py
windows10-1703-x64
3MTool-Disc...emo.py
windows10-1703-x64
3MTool-Disc...tup.py
windows10-1703-x64
3MTool-Disc...ll.bat
windows10-1703-x64
1MTool-Disc...all.sh
windows10-1703-x64
3MTool-Disc...ase.py
windows10-1703-x64
3MTool-Disc..._io.py
windows10-1703-x64
3MTool-Disc...bww.py
windows10-1703-x64
3MTool-Disc...oll.py
windows10-1703-x64
3MTool-Disc...eys.py
windows10-1703-x64
3MTool-Disc...ord.py
windows10-1703-x64
3MTool-Disc...ney.py
windows10-1703-x64
3MTool-Disc...ngo.py
windows10-1703-x64
3MTool-Disc...ook.py
windows10-1703-x64
3MTool-Disc...uel.py
windows10-1703-x64
3MTool-Disc...hbo.py
windows10-1703-x64
3MTool-Disc...ain.py
windows10-1703-x64
3MTool-Disc...eld.py
windows10-1703-x64
3MTool-Disc...ram.py
windows10-1703-x64
3MTool-Disc...ish.py
windows10-1703-x64
3MTool-Disc...gin.py
windows10-1703-x64
3MTool-Disc...unt.py
windows10-1703-x64
3MTool-Disc...xtv.py
windows10-1703-x64
3MTool-Disc...hub.py
windows10-1703-x64
3MTool-Disc...eam.py
windows10-1703-x64
3MTool-Disc...ear.py
windows10-1703-x64
3Analysis
-
max time kernel
72s -
max time network
80s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2024 16:09
Static task
static1
Behavioral task
behavioral1
Sample
MTool-Discord-AIO/MTool.py
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
MTool-Discord-AIO/anycaptcha-python-main/anycaptcha/__init__.py
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
MTool-Discord-AIO/anycaptcha-python-main/anycaptcha/base.py
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
MTool-Discord-AIO/anycaptcha-python-main/anycaptcha/compat.py
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
MTool-Discord-AIO/anycaptcha-python-main/anycaptcha/exceptions.py
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
MTool-Discord-AIO/anycaptcha-python-main/anycaptcha/fields.py
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
MTool-Discord-AIO/anycaptcha-python-main/anycaptcha/tasks.py
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
MTool-Discord-AIO/anycaptcha-python-main/demo.py
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
MTool-Discord-AIO/anycaptcha-python-main/setup.py
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
MTool-Discord-AIO/install.bat
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
MTool-Discord-AIO/install.sh
Resource
win10-20240611-en
Behavioral task
behavioral12
Sample
MTool-Discord-AIO/modules/checkers/base.py
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
MTool-Discord-AIO/modules/checkers/bonk_io.py
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
MTool-Discord-AIO/modules/checkers/bww.py
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
MTool-Discord-AIO/modules/checkers/crunchyroll.py
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
MTool-Discord-AIO/modules/checkers/dickeys.py
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
MTool-Discord-AIO/modules/checkers/discord.py
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
MTool-Discord-AIO/modules/checkers/disney.py
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
MTool-Discord-AIO/modules/checkers/duolingo.py
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
MTool-Discord-AIO/modules/checkers/facebook.py
Resource
win10-20240611-en
Behavioral task
behavioral21
Sample
MTool-Discord-AIO/modules/checkers/gfuel.py
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
MTool-Discord-AIO/modules/checkers/hbo.py
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
MTool-Discord-AIO/modules/checkers/honeygain.py
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
MTool-Discord-AIO/modules/checkers/hotspot_shield.py
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
MTool-Discord-AIO/modules/checkers/instagram.py
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
MTool-Discord-AIO/modules/checkers/ipvanish.py
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
MTool-Discord-AIO/modules/checkers/origin.py
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
MTool-Discord-AIO/modules/checkers/paramount.py
Resource
win10-20240611-en
Behavioral task
behavioral29
Sample
MTool-Discord-AIO/modules/checkers/plextv.py
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
MTool-Discord-AIO/modules/checkers/pornhub.py
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
MTool-Discord-AIO/modules/checkers/steam.py
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
MTool-Discord-AIO/modules/checkers/tunnel_bear.py
Resource
win10-20240404-en
General
-
Target
MTool-Discord-AIO/modules/checkers/facebook.py
-
Size
4KB
-
MD5
2cef3dbfd3bb3f6495a68c8ead50c769
-
SHA1
158c12a4ee704cc18f84220da5b1d174eb7c9f04
-
SHA256
321f44d07d61955c7cf7ffed857c12c16287aefe8230a072d79b6485f8710946
-
SHA512
49cb51e11ad01528acab529aa29672cc6cff120a26cb47f9e2e57d247d8ae7e26d146e15def2e8efd0905ce77707138f76e5d16e99dc6e36292e2fd54dc607e9
-
SSDEEP
48:RRhp+xRuM1T7TuWkZv+r0ekTk4SHVWR2pZug3bBTDYCOIF+VnWrxoQKioQpRey2h:jv+xRuM1T7TuNw4BkHWsZOI0QvgZD
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4588 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MTool-Discord-AIO\modules\checkers\facebook.py1⤵
- Modifies registry class
PID:1628
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4588