Overview
overview
10Static
static
10Furk-Ultra...ss.bat
windows7-x64
7Furk-Ultra...ss.bat
windows10-2004-x64
8Furk-Ultra...ra.exe
windows7-x64
6Furk-Ultra...ra.exe
windows10-2004-x64
6Furk-Ultra...it.dll
windows7-x64
1Furk-Ultra...it.dll
windows10-2004-x64
1Furk-Ultra...on.dll
windows7-x64
1Furk-Ultra...on.dll
windows10-2004-x64
1Furk-Ultra... V2.js
windows7-x64
3Furk-Ultra... V2.js
windows10-2004-x64
3Furk-Ultra...ock.js
windows7-x64
3Furk-Ultra...ock.js
windows10-2004-x64
3Furk-Ultra...der.js
windows7-x64
3Furk-Ultra...der.js
windows10-2004-x64
3Furk-Ultra...ipt.js
windows7-x64
3Furk-Ultra...ipt.js
windows10-2004-x64
3Furk-Ultra...rer.js
windows7-x64
3Furk-Ultra...rer.js
windows10-2004-x64
3Furk-Ultra...Hub.js
windows7-x64
3Furk-Ultra...Hub.js
windows10-2004-x64
3Furk-Ultra...ass.js
windows7-x64
3Furk-Ultra...ass.js
windows10-2004-x64
3Furk-Ultra...ode.js
windows7-x64
3Furk-Ultra...ode.js
windows10-2004-x64
3Furk-Ultra...ce.dll
windows7-x64
1Furk-Ultra...ce.dll
windows10-2004-x64
1Furk-Ultra...ss.exe
windows7-x64
7Furk-Ultra...ss.exe
windows10-2004-x64
8Furk-Ultra...s1.exe
windows7-x64
7Furk-Ultra...s1.exe
windows10-2004-x64
7Furk-Ultra...er.dll
windows7-x64
3Furk-Ultra...er.dll
windows10-2004-x64
3Analysis
- max time kernel
140s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
05/11/2024, 04:46
Behavioral task
behavioral1
Sample
Furk-Ultra-main/Bypass.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Furk-Ultra-main/Bypass.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Furk-Ultra-main/FurkUltra.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
Furk-Ultra-main/FurkUltra.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Furk-Ultra-main/ICSharpCode.AvalonEdit.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
Furk-Ultra-main/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Furk-Ultra-main/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Furk-Ultra-main/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Furk-Ultra-main/Scripts/Dex Explorer V2.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral10
Sample
Furk-Ultra-main/Scripts/Dex Explorer V2.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Furk-Ultra-main/Scripts/FPS Aimlock.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
Furk-Ultra-main/Scripts/FPS Aimlock.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Furk-Ultra-main/Scripts/Hitbox Extender.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Furk-Ultra-main/Scripts/Hitbox Extender.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Furk-Ultra-main/Scripts/Kick Off Script.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Furk-Ultra-main/Scripts/Kick Off Script.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Furk-Ultra-main/Scripts/Old DEX Explorer.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
Furk-Ultra-main/Scripts/Old DEX Explorer.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Furk-Ultra-main/Scripts/TopKek ScriptHub.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Furk-Ultra-main/Scripts/TopKek ScriptHub.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Furk-Ultra-main/Scripts/[FE] Chat Bypass.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Furk-Ultra-main/Scripts/[FE] Chat Bypass.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Furk-Ultra-main/Scripts/[FE] God Mode.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Furk-Ultra-main/Scripts/[FE] God Mode.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Furk-Ultra-main/System.Diagnostics.DiagnosticSource.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
Furk-Ultra-main/System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Furk-Ultra-main/bin/Bypass.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
Furk-Ultra-main/bin/Bypass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Furk-Ultra-main/bin/Bypass1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Furk-Ultra-main/bin/Bypass1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Furk-Ultra-main/bin/Helper.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Furk-Ultra-main/bin/Helper.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target Furk-Ultra-main/FurkUltra.exe
- Size 939KB
- Sample241105-fd79daxmbl
- SHA256 1f79fa84d8edcf581380c9129f5e392d778d48c8f815f331871d74a95a16d397
- MD5 ae40aa4a810011454626af870b5af1a6
- SHA1 36d59c0bbd384b649d0ca54868be5199729aa78a
- SHA512 a60063b50fbeab343667f463715a9db0194194314ee538383dc11a7693c21aee30345aeb0dc39d0ad494b7d841a87475d16e6b2ec0d78c40eb78fa09220a4a5c
- SSDEEP 12288:+jabtvyU7RBv4XpnMQ9Nx3Ug+YL4UIHDPJKDbn2mFX1WpZOVXfTpU4n81yyU9:vUUbG9zE5YLv29K+mFX1WLkbpUPyV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 7 raw.githubusercontent.com 6 raw.githubusercontent.com - Program crash 1 IoCs
pid pid_target Process procid_target 4888 2204 WerFault.exe 83 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FurkUltra.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe 2204 FurkUltra.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2204 FurkUltra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Furk-Ultra-main\FurkUltra.exe"C:\Users\Admin\AppData\Local\Temp\Furk-Ultra-main\FurkUltra.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 21122⤵
- Program crash
PID:4888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2204 -ip 22041⤵PID:2212