Overview
overview
10Static
static
10Toolz (astro).zip
windows10-1703-x64
1888 Rat v1....6.exe
windows10-1703-x64
10Anarchy Panel.exe
windows10-1703-x64
10__MACOSX/T...rat.7z
windows10-1703-x64
3__MACOSX/T...Rat.7z
windows10-1703-x64
3__MACOSX/T... 2.zip
windows10-1703-x64
1__MACOSX/T...ker.7z
windows10-1703-x64
3__MACOSX/T... V2.7z
windows10-1703-x64
3Analysis
-
max time kernel
77s -
max time network
88s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26-09-2024 13:36
Behavioral task
behavioral1
Sample
Toolz (astro).zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
888 Rat v1.2.6/888 Rat v1.2.6.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Anarchy Panel.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
__MACOSX/Toolz (astro)/._Borat.7z
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
__MACOSX/Toolz (astro)/._DarkVision Rat.7z
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
__MACOSX/Toolz (astro)/._LOIC_2.9.9.99 2.zip
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
__MACOSX/Toolz (astro)/._Netflix checker.7z
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
__MACOSX/Toolz (astro)/._XBinder V2.7z
Resource
win10-20240404-en
General
-
Target
__MACOSX/Toolz (astro)/._Netflix checker.7z
-
Size
176B
-
MD5
3fb98ee0cc3fba7a7efbcca62b407461
-
SHA1
bf31d00a1267239b5df25745fd0a09d2895ddcad
-
SHA256
17374e638d89419c7a7240a8279a83413c3a3dde9d145c7f842f2e1429ee9b36
-
SHA512
ceae5cba86b95934a57eb24cd3278513c51e058d1e9848125599e567ba85c56f78cbbe799fa01038e37cac153eaca70cfadfbda5eb3aea9667d4ea6ab8d79eab
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid Process 872 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\__MACOSX\Toolz (astro)\._Netflix checker.7z"1⤵
- Modifies registry class
PID:4820
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:872