General

  • Target

    https://www.upload.ee/files/14414499/TikTokSpammverV2.zip.html

  • Sample

    241026-z5k3pswreq

Malware Config

Targets

    • Target

      https://www.upload.ee/files/14414499/TikTokSpammverV2.zip.html

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Growtopia

      Growtopa is an opensource modular stealer written in C#.

    • Growtopia family

    • Modifies Windows Defender Real-time Protection settings

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks