Overview
overview
10Static
static
10Toolz (astro).zip
windows10-1703-x64
1888 Rat v1....6.exe
windows10-1703-x64
10Anarchy Panel.exe
windows10-1703-x64
10__MACOSX/T...rat.7z
windows10-1703-x64
3__MACOSX/T...Rat.7z
windows10-1703-x64
3__MACOSX/T... 2.zip
windows10-1703-x64
1__MACOSX/T...ker.7z
windows10-1703-x64
3__MACOSX/T... V2.7z
windows10-1703-x64
3Analysis
-
max time kernel
131s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26-09-2024 13:36
Behavioral task
behavioral1
Sample
Toolz (astro).zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
888 Rat v1.2.6/888 Rat v1.2.6.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Anarchy Panel.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
__MACOSX/Toolz (astro)/._Borat.7z
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
__MACOSX/Toolz (astro)/._DarkVision Rat.7z
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
__MACOSX/Toolz (astro)/._LOIC_2.9.9.99 2.zip
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
__MACOSX/Toolz (astro)/._Netflix checker.7z
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
__MACOSX/Toolz (astro)/._XBinder V2.7z
Resource
win10-20240404-en
General
-
Target
__MACOSX/Toolz (astro)/._DarkVision Rat.7z
-
Size
176B
-
MD5
50391083f1f503e2b48e787e70975a83
-
SHA1
8bb01e01f5e9ccfbecf68afab49ccaccdb7e4759
-
SHA256
cef0b1fb664b72ed672ce42b92df7fbf5aefb75c821bea7850949e92ecbddc9f
-
SHA512
fe59462d2ca2433c4ff3ee86b25d09dc32059cd1147f160ac5ec8d7abeb59fec0458718dfa9bbeac98f6fc806461d85716e821fac51324e31a7d911307f440e6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3408 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\__MACOSX\Toolz (astro)\._DarkVision Rat.7z"1⤵
- Modifies registry class
PID:4448
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3408