d793a4581e3c84b3e492bdffaac29fb358363f0c2f4cfa00b67646f89725d54b

Sharing

Copy URL Twitter E-mail

General

Target
Rebel.zip
Size 66.1MB
Sample240829-q2dpsavbpe
SHA256 d793a4581e3c84b3e492bdffaac29fb358363f0c2f4cfa00b67646f89725d54b
MD5 6ee49d24c9ea810dbad189817c0ed5bc
SHA1 e12ee8df8ad93e0d6b41b7db8bfdc22a521e6c0c
SHA512 bf4005fcae08097249b05315160de7c6d0b2cd58447f00c95265d5f3212bc6c972c8a4e6098d75802f754fed6a59f5485589735c53111d7f950e9ae647dc46ec
SSDEEP 1572864:cayzgZkGwtPq5tswXXt+cydb3w8p5KpwsH9KN5gjHoC7or1Xt0h:Vy0HwF0BtMz5swsHI78ICAXt0h
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  Rebel.zip
- Size 66.1MB
- SHA256 d793a4581e3c84b3e492bdffaac29fb358363f0c2f4cfa00b67646f89725d54b
- MD5 6ee49d24c9ea810dbad189817c0ed5bc
- SHA1 e12ee8df8ad93e0d6b41b7db8bfdc22a521e6c0c
- SHA512 bf4005fcae08097249b05315160de7c6d0b2cd58447f00c95265d5f3212bc6c972c8a4e6098d75802f754fed6a59f5485589735c53111d7f950e9ae647dc46ec
- SSDEEP 1572864:cayzgZkGwtPq5tswXXt+cydb3w8p5KpwsH9KN5gjHoC7or1Xt0h:Vy0HwF0BtMz5swsHI78ICAXt0h
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Bin/Injector.exe
- Size 4.8MB
- SHA256 7450c90fad1d9ed73652c7fee391adb41ee2c62d5d43f3bdcab945e3fdec5485
- MD5 8da7ffaee1e5988d56e536d37a5e5d7d
- SHA1 ed799e5ec866ec3dff0bffb306de4b1ab2ca2361
- SHA512 34579bfbee7ec802322b12cc91276dc440d2df63d8e02b55ec303a19b4a198810a97157cf82739d0c30a509928d797142cee133aec994f0c8f5c58c5a6aebd16
- SSDEEP 98304:2sscM3M0egRUUYdiVF0Zx5NMEuRdvwp1cpY1t83Szkkak0jIiGELfHNz:Vrf0egyUKiVF0rF+dmcQtQSzkkakuR7V
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  Bin/Rebel.dll
- Size 8.6MB
- SHA256 c9b95b9204234edfab46912d21953e3a6985a6b7d50c4fd63372e3d5361c7f3d
- MD5 660d2429fc5f088bd197fb0958303936
- SHA1 4189d1ba115f9e00caceb286f22655c6988e1eb6
- SHA512 9875fff045460f77dfc21cecd1de326d67778efd12fe8f53fc09bacfec807a9309752ed4bbb23653060fbee9152dd7c9a9bfda3a0c13c0375a1db932a02a197d
- SSDEEP 98304:kz+S5QwKbQLCsjIpdUqsQf3/sfRMyxl5dn5Sz29f49EzFgfVp+t:WrS2LXjIpyDS3/0aWfmC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  FastColoredTextBox.xml
- Size 132KB
- SHA256 f3f2e537065317b6ce66dac64042e925bbcea65f00561f9860b7172c9ca07027
- MD5 70d49dec6a333f1d94fb1e77c663525c
- SHA1 184b544e672f4c4cb9ed9cf010da568eed16623d
- SHA512 b78a3c4418a7c5014eb16e72f2113f00353e9e566942f7160067c826c47f1ec2752ae7ede796fc159fb9bae499d347f822401fbc4446e2556cbd680cd595c2e2
- SSDEEP 1536:45SVw7sekyF7o//t3zEzacGE5xa5lIV1/P5:45Sm7sekyxo//xzEz3GlM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  ReadMe.txt
- Size 13B
- SHA256 4ca7414e2aba6d74826403afb6ccbcc1752297a1b61aced8808b75d80d212f2d
- MD5 1c6c20f0c324e98e38272f1245d24e11
- SHA1 bbb5dc3a18a532529ec6fa88c86542288dd979f7
- SHA512 a30aed5a54580ad73f16ad237f82e2dc99c99d9645d40d1fbdf88a7d6c10c238b6967c011ba46c6084d409e4a37b41983d600146f93cd9250a810b7d784d8246
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  RebelCracked.exe
- Size 57.8MB
- SHA256 bb60a9d9e8754a155b17a47791384acc43977b734b2eeb02e0e8cab61c52d01a
- MD5 106354515fc5eb24ea541daa429590d6
- SHA1 d022cbb1182fc17a38a0c4219ac79bf59d18a3f5
- SHA512 d4fbc160b55cf3ba5b7ce5d7da5315fb13308af2a6c081ff0fd23b83bdfe71aedb18b04925fed878dca67f02fa8860be21614d964571cc9eb3a19d8d2781c59c
- SSDEEP 1572864:OGwtPq5tswXXt+cydb3w8p5KpwsH9KN5gjHoC7or1Xt0:bwF0BtMz5swsHI78ICAXt0
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

execution upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  System.CodeDom.dll
- Size 30KB
- SHA256 e8c88b0448083663910587efeacb6a1977749fe3ffe83b263fc01f7b63d7dfd2
- MD5 59c830ac0d99f8c906292de85f804b84
- SHA1 68b6740e6ce97de8b1398f3a6e320940a0e16458
- SHA512 4028fa6b68eb3a48bb9625e6755c8e3022283694bb603905af3db54c31bc2f7291aec11f7c42a033703f84c3ff265a19416eb8798058cc42ee3c14c633e9588f
- SSDEEP 384:FuE8ujCiLMTPji3h8241EEqYC0iIcwBxehzsCtZ7U6r1fDMqyt5/WduWTTb2HRNq:FDBCi4TWaveEqYChzZpgRoj/iP9zgBV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  System.CodeDom.xml
- Size 366KB
- SHA256 92287105a0987fc6ea2404e799da13f2d57b228a1fa3039a6d0cded00d4344c5
- MD5 91af6294c77371e6773c35cfa7edd068
- SHA1 0c24bfafb91ab69a3a7a4bfbd15a9c346341c487
- SHA512 bdfb5c13ee54b88d029bae6a65f932bcf27b1d71a5c373325b2e7484d21d49745c2f3983da85d50aeb6e31febbf0bfcb3cbe46415bae15877c20d54522b65904
- SSDEEP 1536:l2e3vRrYxV4Tm0/Y/LFC9YmXVT2Y3mBhuzRKqn/gCOIFnffP6Ks5ATTglg2PLaAR:lK+c9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18