b47d11939a10b932aa205a51f98a417e768390496556a5e8b71ee26e66eca1da

Sharing

Copy URL

Twitter E-mail

General

Target

BYPASSS2.rar
Size

95.9MB
Sample

240907-gb4nvaxfpd
MD5

c797778d935a3391149748257f839143
SHA1

7abe0de925fd18e3fc489b149e86c1cd0d5add7e
SHA256

b47d11939a10b932aa205a51f98a417e768390496556a5e8b71ee26e66eca1da
SHA512

89e08c2885e78b9a6e1bc7bffa80034e66f9f3f76be5eefbf35c6a2b23dc0c558c332ef6c72753d74c7742d30e09b2be2fc9024122294c6cb582d38afccec7a1
SSDEEP

1572864:h65ClBYdsFz5l/sNmmlrNkiTqy/JEps3Q2WhYLmDwVDlxbNldpic9p1RYCZAUDGe:oQBaG/sLrNkiTFRNTiYLmDwtlZdpicLn

Score

7^/10

Malware Config

Targets

- Target
  
  FREE POSEIDON BYPASSER.exe
- Size
  
  361KB
- MD5
  
  1f11850fa6310c17e1ec655fa1daf275
- SHA1
  
  9d83bdbf9e250244065db14526eb92647a88bd62
- SHA256
  
  74cab790e882ca4927005961f92bf026e8cbf78357810b6432c8c614486c4ba9
- SHA512
  
  d4b8b41cf8893699d96c3a561d809e4ac24f122dd6f9f121f7995fa8512a7c4e8bffea8f8759d57249ca8eb5f742fb0d3d9602360381dad468af17a7725e82f4
- SSDEEP
  
  3072:bZOQE9Qi/GbtOFq8Rp9vNC5t+rgTuGXPR3zWBUWPjaO8qSeiO:4Q/i8E4kgSqWPjaO8qsO
Score

1^/10
behavioral1
- Target
  
  Requirement's/Defender Control/Defender Control.exe
- Size
  
  447KB
- MD5
  
  58008524a6473bdf86c1040a9a9e39c3
- SHA1
  
  cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA256
  
  1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- SHA512
  
  8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP
  
  6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
Score

7^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral2
- Target
  
  Requirement's/Defender Control/Defender_Settings.vbs
- Size
  
  313B
- MD5
  
  b0bf0a477bcca312021177572311e666
- SHA1
  
  ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA256
  
  af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- SHA512
  
  09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
Score

1^/10
behavioral3
- Target
  
  install_all.bat
- Size
  
  1KB
- MD5
  
  eb55aae630088c91b88d2bfae4115ea0
- SHA1
  
  1495c69946edca474fe30c2b713aacb9f03bbf3a
- SHA256
  
  492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
- SHA512
  
  48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882
Score

7^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral4
- Target
  
  vcredist2005_x64.exe
- Size
  
  3.0MB
- MD5
  
  56eaf4e1237c974f6984edc93972c123
- SHA1
  
  ee916012783024dac67fc606457377932c826f05
- SHA256
  
  0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
- SHA512
  
  f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
- SSDEEP
  
  49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  
  vcredist2005_x86.exe
- Size
  
  2.6MB
- MD5
  
  ce2922f83fb4b170affce0ea448b107b
- SHA1
  
  b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA256
  
  4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- SHA512
  
  e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP
  
  49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  
  vcredist2008_x64.exe
- Size
  
  5.0MB
- MD5
  
  e2ada570911edaaae7d1b3c979345fce
- SHA1
  
  a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
- SHA256
  
  b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
- SHA512
  
  b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
- SSDEEP
  
  98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral7
- Target
  
  vcredist2008_x86.exe
- Size
  
  4.3MB
- MD5
  
  35da2bf2befd998980a495b6f4f55e60
- SHA1
  
  470640aa4bb7db8e69196b5edb0010933569e98d
- SHA256
  
  6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- SHA512
  
  bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP
  
  98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral8
- Target
  
  vcredist2010_x64.exe
- Size
  
  9.8MB
- MD5
  
  c9d9eebccef20d637f193490cec05e79
- SHA1
  
  15d032d669078aa6f0f7fd1cbf4115a070bd034d
- SHA256
  
  cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
- SHA512
  
  24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
- SSDEEP
  
  196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral9
- Target
  
  vcredist2010_x86.exe
- Size
  
  8.6MB
- MD5
  
  1801436936e64598bab5b87b37dc7f87
- SHA1
  
  28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA256
  
  67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- SHA512
  
  0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP
  
  196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral10
- Target
  
  vcredist2012_x64.exe
- Size
  
  6.9MB
- MD5
  
  3c03562b5af9ed347614053d459d7778
- SHA1
  
  1a5d93dddbc431ab27b1da711cd3370891542797
- SHA256
  
  681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- SHA512
  
  6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP
  
  98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral11
- Target
  
  vcredist2012_x86.exe
- Size
  
  6.3MB
- MD5
  
  7f52a19ecaf7db3c163dd164be3e592e
- SHA1
  
  96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA256
  
  b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- SHA512
  
  60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP
  
  196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral12
- Target
  
  vcredist2013_x64.exe
- Size
  
  6.9MB
- MD5
  
  49b1164f8e95ec6409ea83cdb352d8da
- SHA1
  
  1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
- SHA256
  
  a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
- SHA512
  
  29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
- SSDEEP
  
  196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral13
- Target
  
  vcredist2013_x86.exe
- Size
  
  6.2MB
- MD5
  
  38a1b890ce847167d16567cf7b7a5642
- SHA1
  
  0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
- SHA256
  
  53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
- SHA512
  
  907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
- SSDEEP
  
  196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral14
- Target
  
  vcredist2015_2017_2019_2022_x64.exe
- Size
  
  24.2MB
- MD5
  
  1d545507009cc4ec7409c1bc6e93b17b
- SHA1
  
  84c61fadf8cd38016fb7632969b3ace9e54b763a
- SHA256
  
  3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
- SHA512
  
  5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104
- SSDEEP
  
  786432:tSp+Ty2SfUfnbDDko5dFMYqlQbgAVLSElbmucMuZZxs6Sf:4p+Ty2SfWnHDk8FjVbfzPTq4
Score

4^/10

discovery
behavioral15
- Target
  
  vcredist2015_2017_2019_2022_x86.exe
- Size
  
  13.2MB
- MD5
  
  8457542fd4be74cb2c3a92b3386ae8e9
- SHA1
  
  198722b4f5fc62721910569d9d926dce22730c22
- SHA256
  
  a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
- SHA512
  
  91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182
- SSDEEP
  
  393216:x3RwlptVYmfr7yBG/4uOzH01/Nc1eJ/RXZMPDyiX:xGpttD7yBG/jx1/N/tZUDJ
Score

4^/10

discovery
behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

AutoIT Executable

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16