Overview

overview

8

Static

static

3

Rebel.zip

windows7-x64

1

Rebel.zip

windows10-2004-x64

1

Bin/Injector.exe

windows7-x64

5

Bin/Injector.exe

windows10-2004-x64

5

Bin/Rebel.dll

windows7-x64

1

Bin/Rebel.dll

windows10-2004-x64

1

FastColore...ox.dll

windows7-x64

1

FastColore...ox.dll

windows10-2004-x64

1

FastColore...ox.xml

windows7-x64

3

FastColore...ox.xml

windows10-2004-x64

1

ReadMe.txt

windows7-x64

1

ReadMe.txt

windows10-2004-x64

1

RebelCracked.exe

windows7-x64

8

RebelCracked.exe

windows10-2004-x64

8

System.CodeDom.dll

windows7-x64

1

System.CodeDom.dll

windows10-2004-x64

1

System.CodeDom.xml

windows7-x64

3

System.CodeDom.xml

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rebel.zip

  • Size

    66.1MB

  • Sample

    240829-q2dpsavbpe

  • MD5

    6ee49d24c9ea810dbad189817c0ed5bc

  • SHA1

    e12ee8df8ad93e0d6b41b7db8bfdc22a521e6c0c

  • SHA256

    d793a4581e3c84b3e492bdffaac29fb358363f0c2f4cfa00b67646f89725d54b

  • SHA512

    bf4005fcae08097249b05315160de7c6d0b2cd58447f00c95265d5f3212bc6c972c8a4e6098d75802f754fed6a59f5485589735c53111d7f950e9ae647dc46ec

  • SSDEEP

    1572864:cayzgZkGwtPq5tswXXt+cydb3w8p5KpwsH9KN5gjHoC7or1Xt0h:Vy0HwF0BtMz5swsHI78ICAXt0h

Score
8/10
discoveryexecutionupx

Malware Config

Targets

    • Target

      Rebel.zip

    • Size

      66.1MB

    • MD5

      6ee49d24c9ea810dbad189817c0ed5bc

    • SHA1

      e12ee8df8ad93e0d6b41b7db8bfdc22a521e6c0c

    • SHA256

      d793a4581e3c84b3e492bdffaac29fb358363f0c2f4cfa00b67646f89725d54b

    • SHA512

      bf4005fcae08097249b05315160de7c6d0b2cd58447f00c95265d5f3212bc6c972c8a4e6098d75802f754fed6a59f5485589735c53111d7f950e9ae647dc46ec

    • SSDEEP

      1572864:cayzgZkGwtPq5tswXXt+cydb3w8p5KpwsH9KN5gjHoC7or1Xt0h:Vy0HwF0BtMz5swsHI78ICAXt0h

    Score
    1/10
    behavioral1behavioral2

    • Target

      Bin/Injector.exe

    • Size

      4.8MB

    • MD5

      8da7ffaee1e5988d56e536d37a5e5d7d

    • SHA1

      ed799e5ec866ec3dff0bffb306de4b1ab2ca2361

    • SHA256

      7450c90fad1d9ed73652c7fee391adb41ee2c62d5d43f3bdcab945e3fdec5485

    • SHA512

      34579bfbee7ec802322b12cc91276dc440d2df63d8e02b55ec303a19b4a198810a97157cf82739d0c30a509928d797142cee133aec994f0c8f5c58c5a6aebd16

    • SSDEEP

      98304:2sscM3M0egRUUYdiVF0Zx5NMEuRdvwp1cpY1t83Szkkak0jIiGELfHNz:Vrf0egyUKiVF0rF+dmcQtQSzkkakuR7V

    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3behavioral4

    • Target

      Bin/Rebel.dll

    • Size

      8.6MB

    • MD5

      660d2429fc5f088bd197fb0958303936

    • SHA1

      4189d1ba115f9e00caceb286f22655c6988e1eb6

    • SHA256

      c9b95b9204234edfab46912d21953e3a6985a6b7d50c4fd63372e3d5361c7f3d

    • SHA512

      9875fff045460f77dfc21cecd1de326d67778efd12fe8f53fc09bacfec807a9309752ed4bbb23653060fbee9152dd7c9a9bfda3a0c13c0375a1db932a02a197d

    • SSDEEP

      98304:kz+S5QwKbQLCsjIpdUqsQf3/sfRMyxl5dn5Sz29f49EzFgfVp+t:WrS2LXjIpyDS3/0aWfmC

    Score
    1/10
    behavioral5behavioral6

    • Target

      FastColoredTextBox.dll

    • Size

      323KB

    • MD5

      8610f4d3cdc6cc50022feddced9fdaeb

    • SHA1

      4b60b87fd696b02d7fce38325c7adfc9e806f650

    • SHA256

      ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9

    • SHA512

      693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09

    • SSDEEP

      6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO

    Score
    1/10
    behavioral7behavioral8

    • Target

      FastColoredTextBox.xml

    • Size

      132KB

    • MD5

      70d49dec6a333f1d94fb1e77c663525c

    • SHA1

      184b544e672f4c4cb9ed9cf010da568eed16623d

    • SHA256

      f3f2e537065317b6ce66dac64042e925bbcea65f00561f9860b7172c9ca07027

    • SHA512

      b78a3c4418a7c5014eb16e72f2113f00353e9e566942f7160067c826c47f1ec2752ae7ede796fc159fb9bae499d347f822401fbc4446e2556cbd680cd595c2e2

    • SSDEEP

      1536:45SVw7sekyF7o//t3zEzacGE5xa5lIV1/P5:45Sm7sekyxo//xzEz3GlM

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      ReadMe.txt

    • Size

      13B

    • MD5

      1c6c20f0c324e98e38272f1245d24e11

    • SHA1

      bbb5dc3a18a532529ec6fa88c86542288dd979f7

    • SHA256

      4ca7414e2aba6d74826403afb6ccbcc1752297a1b61aced8808b75d80d212f2d

    • SHA512

      a30aed5a54580ad73f16ad237f82e2dc99c99d9645d40d1fbdf88a7d6c10c238b6967c011ba46c6084d409e4a37b41983d600146f93cd9250a810b7d784d8246

    Score
    1/10
    behavioral11behavioral12

    • Target

      RebelCracked.exe

    • Size

      57.8MB

    • MD5

      106354515fc5eb24ea541daa429590d6

    • SHA1

      d022cbb1182fc17a38a0c4219ac79bf59d18a3f5

    • SHA256

      bb60a9d9e8754a155b17a47791384acc43977b734b2eeb02e0e8cab61c52d01a

    • SHA512

      d4fbc160b55cf3ba5b7ce5d7da5315fb13308af2a6c081ff0fd23b83bdfe71aedb18b04925fed878dca67f02fa8860be21614d964571cc9eb3a19d8d2781c59c

    • SSDEEP

      1572864:OGwtPq5tswXXt+cydb3w8p5KpwsH9KN5gjHoC7or1Xt0:bwF0BtMz5swsHI78ICAXt0

    Score
    8/10
    executionupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral13behavioral14

    • Target

      System.CodeDom.dll

    • Size

      30KB

    • MD5

      59c830ac0d99f8c906292de85f804b84

    • SHA1

      68b6740e6ce97de8b1398f3a6e320940a0e16458

    • SHA256

      e8c88b0448083663910587efeacb6a1977749fe3ffe83b263fc01f7b63d7dfd2

    • SHA512

      4028fa6b68eb3a48bb9625e6755c8e3022283694bb603905af3db54c31bc2f7291aec11f7c42a033703f84c3ff265a19416eb8798058cc42ee3c14c633e9588f

    • SSDEEP

      384:FuE8ujCiLMTPji3h8241EEqYC0iIcwBxehzsCtZ7U6r1fDMqyt5/WduWTTb2HRNq:FDBCi4TWaveEqYChzZpgRoj/iP9zgBV

    Score
    1/10
    behavioral15behavioral16

    • Target

      System.CodeDom.xml

    • Size

      366KB

    • MD5

      91af6294c77371e6773c35cfa7edd068

    • SHA1

      0c24bfafb91ab69a3a7a4bfbd15a9c346341c487

    • SHA256

      92287105a0987fc6ea2404e799da13f2d57b228a1fa3039a6d0cded00d4344c5

    • SHA512

      bdfb5c13ee54b88d029bae6a65f932bcf27b1d71a5c373325b2e7484d21d49745c2f3983da85d50aeb6e31febbf0bfcb3cbe46415bae15877c20d54522b65904

    • SSDEEP

      1536:l2e3vRrYxV4Tm0/Y/LFC9YmXVT2Y3mBhuzRKqn/gCOIFnffP6Ks5ATTglg2PLaAR:lK+c9

    Score
    3/10
    discovery
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks