73fe73a408623f135099e52acde31931a25c4784f6455494a5fd5f4bc438e09e

General

Target
RL AI BOT.rar
Size 4.0MB
Sample240925-amk8batdkn
SHA256 73fe73a408623f135099e52acde31931a25c4784f6455494a5fd5f4bc438e09e
MD5 afc36c81e2eb73a5225403951a460c04
SHA1 0a9a115f9fa0d9d8050017a713365c42c0d0a6c8
SHA512 3ba97a2515fc625876709c1eca4de5171424bde7624e43d8a8698ad8c28c4a61f58cb30960e79cbe4c031b1862a8b2c61ff954f590597c3ac6aeadd3c9067a53
SSDEEP 49152:maOxQYhqhXik1ll+IUre+LogsEStdJE83+fLSAYwvn4L/0WHCp0hp9tHyey5Ccmd:m3Jhq8k5r+Logsvt9ir4Lm95F2Nr+pqZ
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  RL AI BOT.rar
- Size 4.0MB
- SHA256 73fe73a408623f135099e52acde31931a25c4784f6455494a5fd5f4bc438e09e
- MD5 afc36c81e2eb73a5225403951a460c04
- SHA1 0a9a115f9fa0d9d8050017a713365c42c0d0a6c8
- SHA512 3ba97a2515fc625876709c1eca4de5171424bde7624e43d8a8698ad8c28c4a61f58cb30960e79cbe4c031b1862a8b2c61ff954f590597c3ac6aeadd3c9067a53
- SSDEEP 49152:maOxQYhqhXik1ll+IUre+LogsEStdJE83+fLSAYwvn4L/0WHCp0hp9tHyey5Ccmd:m3Jhq8k5r+Logsvt9ir4Lm95F2Nr+pqZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1
- Target
  RL AI BOT/Instructions.txt
- Size 610B
- SHA256 3097b0d79ee0f1a76c9e52824fe2758a06ef407eb9d2cea7904d9fe1383dc135
- MD5 3421dcd2e6fb1d6e51e7c7253bf68735
- SHA1 d11735df5010af381450e402fa4c3605ec7eadc2
- SHA512 ca25aa00f52b02a040a5f2bd81f58cb16ac1cac9b2aad119cca145a25dc64844d1b598c439a46252cc1ebadf372f7e4f8975d7a73672908539bb6f2a1d861586
- MD5 SHA1 SHA512
Score

1^/10
behavioral2
- Target
  RL AI BOT/RL_AI_Bot.exe
- Size 4.6MB
- SHA256 c388a38e46a212f9413d41a9f28265a2fe1c7c77b3620bfcdcc6c7b4b3b9dee0
- MD5 430c4b93e35ef63fbb153c1a12d1621a
- SHA1 79bf0b686f7b112e400fe349cfd4b5c62a7389b2
- SHA512 96b334d0c4f0b5167e4aed2bccf397e30b850db1616d898ad3461e37874aa153b984ea3e2690d24c0045172a89e643aac2d7509f746e8a2dde161c45fe970ec2
- SSDEEP 98304:DXbIrqRVeeHnQC8TVAHaedIs6E7vliojARot:vIAVlHQLA0vC
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

defense_evasion discovery evasion execution exploit themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3