Overview
overview
10Static
static
10Toolz (astro).zip
windows10-1703-x64
1888 Rat v1....6.exe
windows10-1703-x64
10Anarchy Panel.exe
windows10-1703-x64
10__MACOSX/T...rat.7z
windows10-1703-x64
3__MACOSX/T...Rat.7z
windows10-1703-x64
3__MACOSX/T... 2.zip
windows10-1703-x64
1__MACOSX/T...ker.7z
windows10-1703-x64
3__MACOSX/T... V2.7z
windows10-1703-x64
3Analysis
-
max time kernel
119s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
26-09-2024 13:36
Behavioral task
behavioral1
Sample
Toolz (astro).zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
888 Rat v1.2.6/888 Rat v1.2.6.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Anarchy Panel.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
__MACOSX/Toolz (astro)/._Borat.7z
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
__MACOSX/Toolz (astro)/._DarkVision Rat.7z
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
__MACOSX/Toolz (astro)/._LOIC_2.9.9.99 2.zip
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
__MACOSX/Toolz (astro)/._Netflix checker.7z
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
__MACOSX/Toolz (astro)/._XBinder V2.7z
Resource
win10-20240404-en
General
-
Target
__MACOSX/Toolz (astro)/._Borat.7z
-
Size
176B
-
MD5
6fe023634c9e4d7aa45d741cc27f7c38
-
SHA1
632185eed0913f9a0757176b8f93ca5164ffa66d
-
SHA256
f22584998e4e43ec2ee9208a4442000e68dc394a86e098d14a6a6ca945ae9ff1
-
SHA512
bb35b53188c134f5612a70cb17575d19138c52d7c7f64a654bdf544816c1cd8e01d03ac046527512fb431e444e4461143b19f92cc896b04b74eed2b099e8cde1
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3512 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\__MACOSX\Toolz (astro)\._Borat.7z"1⤵
- Modifies registry class
PID:4928
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3512