Extracted

Extracted

• • Target

    Hidden-Malware-BuilderV5-main.zip

  • Size

    2.6MB

  • MD5

    d3de7ff429c8d05cb7ff4b1941d8bb0a

  • SHA1

    e70963f512a73ad46a0be2ec31e6e7d30fe6365b

  • SHA256

    60d598cba87775c68774967bfeeebc98cc01315f294872e417cccdd3e5c869ed

  • SHA512

    1f3035dc16c66b7e97ffd01f0cfe02ee0c466d74e4aebe7dfa9978d6a310cef564e29d8237710dd5d539ace0e86828c6219f7f432515ceb49a9ff08f414d23c8

  • SSDEEP

    49152:xeCBCiv3I9yUfFH9Py82t+OfzfSQSCaP52pNI7RnIWUMskmkekgVZmQC1kzcLbE8:pBCUY9rF5OfTdnaxwN+RnIWs2eOQYYc3

  Score

  10^/10

  asyncratdefaultdefense_evasionexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1

• • Target

    Hidden-Malware-BuilderV5-main/Guna.UI2.dll

  • Size

    3.8MB

  • MD5

    a29c7159170dc36961cc7c6ae0ac6e40

  • SHA1

    8fcaff77cda4dfca269f12d7f7284bd1dfb35df3

  • SHA256

    8e0ebe5cebbcb46b3e870b6bfb20412a52f534240846220b7a5da7cad2d71903

  • SHA512

    475b1695efc339b52d052ff17e7f9e245e1973f5fa93b79f482fb8baf9757d539cd8d5582544663824d091ad6919e315c0c524b055756a219bbf2fd901bd3537

  • SSDEEP

    24576:cVaMMD+dmfoN6y42wVXXicKsZv76OqM8wd/8++XJVkhIiA6Gu1cJCyHQ/jzhpb:tAR7wVCEZvum8wJ6T6nmO

  Score

  1^/10
  behavioral2

• • Target

    Hidden-Malware-BuilderV5-main/H-Malware Builder V5.exe

  • Size

    407KB

  • MD5

    c8f6d76b4ae82978272bde392561c4f4

  • SHA1

    80447d36fcf88cc9caa806db53e22d9468cc31ee

  • SHA256

    c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e

  • SHA512

    10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad

  • SSDEEP

    12288:r5p4UNBN3aqeKNoRfwoZrHMBV9EwEcb8+DvtuWUb:r9N3aqPCRooZwBjEhcYcvYWUb

  Score

  10^/10

  asyncratdefaultbootkitdefense_evasionexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral3

• • Target

    Hidden-Malware-BuilderV5-main/H-Malware Builder V5.exe.config

  • Size

    1KB

  • MD5

    3ccdef9ef8aeaeaa1857abb225f901c1

  • SHA1

    3161fed09525aaf1ad74d03fd7a9294f005bffb5

  • SHA256

    64081c78450d0771dfa215cb606d94f21f803162986f275a705cdd600a1256d2

  • SHA512

    225a2a7d14dc84d72eaf5fb9915e50eb0dfb7be17fd11910652dfeba21e24385d231f0d4141620d729da973b182898371150781213e9260bd563c8ded91e4248

  Score

  1^/10
  behavioral4

• • Target

    Hidden-Malware-BuilderV5-main/H-Malware Builder V5.xml

  • Size

    2KB

  • MD5

    f0de2ea3841f7b242eb88b28fae919b9

  • SHA1

    45473e068085c9180d2fde71e9285440cb16a632

  • SHA256

    d7cb090e43f620e11a6367968f25baef9e176e059b9275c125e557c96da68af9

  • SHA512

    a075a2f8879d68e50a49faaf35affb0ecfef7c493a63f85e12773ca2f1716c3da0c26c1acd1ac9eef6328d0cf1c23c87d7fb4d8409c520d7535238d5ab983711

  Score

  1^/10
  behavioral5

• • Target

    Hidden-Malware-BuilderV5-main/IconExtractor.dll

  • Size

    10KB

  • MD5

    640d8ffa779c6dd5252a262e440c66c0

  • SHA1

    3252d8a70a18d5d4e0cc84791d587dd12a394c2a

  • SHA256

    440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2

  • SHA512

    e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

  • SSDEEP

    192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl

  Score

  1^/10
  behavioral6

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (1).ico

  • Size

    97KB

  • MD5

    4f409511e9f93f175cd18187379e94cb

  • SHA1

    598893866d60cd3a070279cc80fda49ee8c06c9b

  • SHA256

    115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f

  • SHA512

    0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f

  • SSDEEP

    1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1

  Score

  3^/10
  behavioral7

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (10).ico

  • Size

    115KB

  • MD5

    ad1740cb3317527aa1acae6e7440311e

  • SHA1

    7a0f8669ed1950db65632b01c489ed4d9aba434e

  • SHA256

    7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878

  • SHA512

    eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2

  • SSDEEP

    768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN

  Score

  3^/10
  behavioral8

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (2).ico

  • Size

    112KB

  • MD5

    f1463f4e1a6ef6cc6e290d46830d2da1

  • SHA1

    bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf

  • SHA256

    142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec

  • SHA512

    0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2

  • SSDEEP

    1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2

  Score

  3^/10
  behavioral9

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (3).ico

  • Size

    131KB

  • MD5

    a512719efc9e6ecc5e2375abceb1669a

  • SHA1

    51fae98edfab7cd6b6baac6df5ecbda082eeb1db

  • SHA256

    b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574

  • SHA512

    e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625

  • SSDEEP

    1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld

  Score

  3^/10
  behavioral10

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (4).ico

  • Size

    125KB

  • MD5

    9c053bef57c4a7b575a0726af0e26dae

  • SHA1

    47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c

  • SHA256

    5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41

  • SHA512

    482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a

  • SSDEEP

    1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY

  Score

  3^/10
  behavioral11

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (5).ico

  • Size

    100KB

  • MD5

    9dbdd6972e129d31568661a89c81d8f9

  • SHA1

    747399af62062598120214cef29761c367cfd28a

  • SHA256

    45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484

  • SHA512

    e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d

  • SSDEEP

    192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ

  Score

  3^/10
  behavioral12

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (6).ico

  • Size

    106KB

  • MD5

    d7c9666d30936e29ce156a2e04807863

  • SHA1

    845e805d55156372232e0110e5dc80380e2cb1e5

  • SHA256

    6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5

  • SHA512

    3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56

  • SSDEEP

    768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2

  Score

  3^/10
  behavioral13

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (7).ico

  • Size

    164KB

  • MD5

    7891c91d1761dc8a8846d362e6e31869

  • SHA1

    0229bb01b7b4a0fca305eb521ec5dfbaa53674ea

  • SHA256

    29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8

  • SHA512

    ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7

  • SSDEEP

    3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+

  Score

  3^/10
  behavioral14

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (8).ico

  • Size

    108KB

  • MD5

    af1739a9b1a1bf72e7072ad9551c6eea

  • SHA1

    8da0a34c3a8040c4b7c67d7143c853c71b3d208d

  • SHA256

    a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab

  • SHA512

    eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120

  • SSDEEP

    768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD

  Score

  3^/10
  behavioral15

• • Target

    Hidden-Malware-BuilderV5-main/Icons/icon (9).ico

  • Size

    264KB

  • MD5

    3e24e40b41ecc59750c9231d8f8da40b

  • SHA1

    91a701cf25aea2984f75846b6c83865d668ccad6

  • SHA256

    bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80

  • SHA512

    fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572

  • SSDEEP

    3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP

  Score

  3^/10
  behavioral16

• • Target

    Hidden-Malware-BuilderV5-main/README.md

  • Size

    529B

  • MD5

    c732078c0c6bff3d2f060c93aa45e1e6

  • SHA1

    a4eb26b4ba78d8ece5a850833c63a9f9896c2ba3

  • SHA256

    2f4a357450f7f5a8d56ff3b1584abae3d7cd9d9671803a06bc20714b6d21b019

  • SHA512

    b911a167aca3a51c3be6a0575b42b171b435713304d02530a22c88a47e375591579940d0ad05f4919d4d70c2fa5f1f7757046603fcbd7b557c015ff5f0e255cf

  Score

  3^/10
  behavioral17

• • Target

    Hidden-Malware-BuilderV5-main/SimpleObfuscator.dll

  • Size

    1.4MB

  • MD5

    9967cc2531192b3a140053d86e1bfe22

  • SHA1

    15784dc0dd3fc43db48cb0b83764e7e3d7071f60

  • SHA256

    e2d7b0d79fa1fa65e5ad99bd80900048039f6442a6d6ef140515b9af021932eb

  • SHA512

    d65d8248f60450459725eabfd48ecb6afb63e62d8bb46aee5d42e5052f34468b95d61086eb50ef87bcb0de466dfcb5558b9589062bfb40bf948a54f9c108f73c

  • SSDEEP

    24576:Swfrd1MpF8UHwTxSX1h0WjSWr7uvJyQ0rJ:pmISlKdc

  Score

  1^/10
  behavioral18

• • Target

    Hidden-Malware-BuilderV5-main/Tools/ILMerge.exe

  • Size

    912KB

  • MD5

    35a3dc21f6e0ed6a8423f7455a379f9c

  • SHA1

    631b3d76f02b386e0bac33fa8a0cb464cef984be

  • SHA256

    4a0dac9d63c87b726285cbcab13757db23acb82f29f4bd4806a26997ce11f5f4

  • SHA512

    3abea20d1e5d6083faca67901488d9ce318a4f9929afb1b223a9dcff4fa440408928183aa712e6d0d25dbcea603da31eae09a481641a6bcde9e8eda95e336cfb

  • SSDEEP

    12288:X0zOaLOF4xKbTQ+ZyoMyixinEcD2B7I3x6cDjGCErg1oh:X7dLM9inTxtRa

  Score

  1^/10
  behavioral19

• • Target

    Hidden-Malware-BuilderV5-main/Tools/Microsoft.Win32.TaskScheduler.dll

  • Size

    167KB

  • MD5

    c6b3538f7bf8c8a7ce900edf5994df5b

  • SHA1

    1c89d3a09d86ab5f67ea9877534451cf778132ac

  • SHA256

    b185b29b50062038c531c4301129bd06e0d51027e7512c3ecb41569413cea893

  • SHA512

    ebfcb2d810afb3f267662700d3e54d40a83aa10b2a7b1c38af4cf909a7457bf1eb768085eba69e7af679f20a9d02cd73118f52a113bd2cdde05987b0a9e4a085

  • SSDEEP

    3072:fo4cTDxLDwpnNnNSeBfAEHBAnpK37nXxOalx+o2bHQe0UBagDeo7QA74tyohsaQs:fjwBDwpnRNSe9+Qx/nfU8FoisaF

  Score

  1^/10
  behavioral20