Overview
overview
10Static
static
10The-MALWAR...de.txt
windows10-1703-x64
1The-MALWAR....A.exe
windows10-1703-x64
7The-MALWAR....E.exe
windows10-1703-x64
9The-MALWAR....a.exe
windows10-1703-x64
The-MALWAR...ks.exe
windows10-1703-x64
1The-MALWAR...lc.exe
windows10-1703-x64
10The-MALWAR...re.txt
windows10-1703-x64
1The-MALWAR....l.exe
windows10-1703-x64
3The-MALWAR...ck.exe
windows10-1703-x64
3The-MALWAR....A.exe
windows10-1703-x64
3The-MALWAR....B.exe
windows10-1703-x64
3The-MALWAR...de.txt
windows10-1703-x64
1Resubmissions
25-08-2024 18:37
240825-w9lm9aybld 1025-08-2024 18:31
240825-w6eqjazcpm 1025-08-2024 18:25
240825-w2whgsxgjb 10Analysis
-
max time kernel
302s -
max time network
329s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
25-08-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaser.C.sourcecode.txt
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaster.A.exe
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaster.E.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Net-Worm/CodeRed.a.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Net-Worm/EternalRocks.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Net-Worm/Kolabc/Kobalc.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Net-Worm/Loveware.txt
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Net-Worm/Opaserv.l.exe
Resource
win10-20240611-en
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Net-Worm/Rahack/Rahack.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Net-Worm/Sasser/Sasser.A.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Net-Worm/Sasser/Sasser.B.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Net-Worm/Sasser/Sasser.c.sourcecode.txt
Resource
win10-20240404-en
General
-
Target
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaster.A.exe
-
Size
6KB
-
MD5
5ae700c1dffb00cef492844a4db6cd69
-
SHA1
bed8e439f28a1a0d3876366cbd76a43cdccf60fa
-
SHA256
258f82166d20c68497a66d82349fc81899fde8fe8c1cc66e59f739a9ea2c95a9
-
SHA512
2cc1ec68df94edc561dd08c4e3e498f925907955b6e54a877b8bc1fb0dd48a6276f41e44756ed286404f6a54f55edb03f8765b21e88a32fd4ca1eb0c6b422980
-
SSDEEP
96:R+sKQYu8u0J81Pyd6jgqC9Upq1CKPYKSa1aqDOJ9kq1R/X7Dw3YXmI:R+szB8G1PO6jgVFLYo1S9k6Xw3smI
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1112-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-1-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-2-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-3-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-4-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-5-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-6-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-7-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-8-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-9-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-10-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-11-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-12-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-13-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-14-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-15-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-16-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-17-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-18-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-19-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-20-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-21-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-22-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-23-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-24-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-25-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-26-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-27-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-28-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-29-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1112-30-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windows auto update = "msblast.exe" Blaster.A.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blaster.A.exe