3c806eec38fc8565c942fe0a79331bf3215989d494bb3d5fa8d8057dcef58e03

Sharing

Copy URL Twitter E-mail

General

Target
b1921d4747ed0ca08ecb31dda5b57079dcd6085d
Size 30.2MB
Sample241108-22f1pasajc
SHA256 3c806eec38fc8565c942fe0a79331bf3215989d494bb3d5fa8d8057dcef58e03
MD5 03bf9239a1c35ef0f6f162180499167f
SHA1 b1921d4747ed0ca08ecb31dda5b57079dcd6085d
SHA512 6cd7a438a05c940649e8202e392318905e5785a0476a10388aa62081cdca2de9d9ede2045fb6fbabd116ad7b785b10c4970d0536fea8f945c5510db27c346273
SSDEEP 786432:eQaNznirxs9+seaiiI0Ppr91OLvHh99br84AEEuDW:eQSzB9+sPiD0Pn1Uvh99brhTDW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  b1921d4747ed0ca08ecb31dda5b57079dcd6085d
- Size 30.2MB
- SHA256 3c806eec38fc8565c942fe0a79331bf3215989d494bb3d5fa8d8057dcef58e03
- MD5 03bf9239a1c35ef0f6f162180499167f
- SHA1 b1921d4747ed0ca08ecb31dda5b57079dcd6085d
- SHA512 6cd7a438a05c940649e8202e392318905e5785a0476a10388aa62081cdca2de9d9ede2045fb6fbabd116ad7b785b10c4970d0536fea8f945c5510db27c346273
- SSDEEP 786432:eQaNznirxs9+seaiiI0Ppr91OLvHh99br84AEEuDW:eQSzB9+sPiD0Pn1Uvh99brhTDW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  -warcraft-tft-keygen-F82Z5I7.exe
- Size 9.5MB
- SHA256 fb3d286faee2cf6345988d4dd8c025688075e425a64c311439bed5d54461b0ab
- MD5 a959e89b1669d9657223e0708e60edca
- SHA1 5e6113b81512f75f7138994a72e7d1152ebbab05
- SHA512 bb183aede190f9886d18ee002ffaae6e66e485a4f8d0123887e37b622c63685f35f7beda400ea4118770491e962a48d401e29e9ed64f584e30b02df367702aba
- SSDEEP 196608:AW6aE7Lojzz2jXtfoZ08YKvF0n3mOr0ikl8UuYOOKDHoazb9keDC:OZ7Lszz2jX6ixKvF0n2Oo8wEDPkf
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4
- Target
  .............exe
- Size 3.9MB
- SHA256 bdb03d50cba10bbbaea2409521c515d15f3e674e6ccabbadfec319bdc08cd1ea
- MD5 1c9d03acc5ce4d1565e01418e2892087
- SHA1 345be215d0017d06a3934150105389730038fa69
- SHA512 1442ad0b3af4fddc1c6980426a25f6d2c4b033902b8cc42596ad0077385ca3d56e4fed4517a61fe4d5b5b185b34030196ac9c5dcc61d93fd48292aed2b7998e8
- SSDEEP 49152:gnHn5pXUXb6c9YuoHjAbDiYFpIDckO4iNQxgei6HQR9sXafgkDFMVR9C1UhPJXMS:45pEXOc9AH8FpQrDgeJrBiCV2HXq
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery spyware stealer
behavioral5 behavioral6
- Target
  BNGatewayEditor.exe
- Size 222KB
- SHA256 3d08d4e044382696df6009772975c7c6c48402e7d08e8adaba48f1681d5a5a57
- MD5 40adea5692f30fbb2631ecfd9c941080
- SHA1 d185b4ab686ed828ae8eff170cc7752b89b8164f
- SHA512 dcb6a47b044e7534f4953bc5ba4de853be48ed37328151c6ce2b3882fb402b9559df55b4ff4d17ac7b3f435e114cf93b48f31eb7cdd1335acf92917a84238a3d
- SSDEEP 6144:dNsTt9Xb+bsPfpsA+XkVIQAGfwdvkAmaYRiyM3r:XU9rcQBsABqQAGYUDRVM3r
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  icyHell.net.URL
- Size 49B
- SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
- MD5 511c6acc2e680e74ce2ca281ee3b8d3a
- SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
- SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
- MD5 SHA1 SHA512
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral10 behavioral9
- Target
  Warcracft III Reforged/StarCraft-Setup-Mac.zip
- Size 3.8MB
- SHA256 124a392d7a6e26ea26c86bce5e5b4b8d96cbb1f7cad0f32c9cf296c6b49c53e7
- MD5 f5c292039b8cccd136b357f0a374f584
- SHA1 8629866741b44ccd4755085e85cf3349df0ebcb4
- SHA512 21410863bc53054833aa3df156341a244bc5db2470246050b4c8ca8fe820281fc71d3deb564df93eb715a891f2648fa0fbab7784c368d789b0e7c37707afe6a6
- SSDEEP 98304:RXh1dNFTXMAQaixWrGUXlFeGUpUfHP20oJ/fGVaVLa1yS1w0N:RfxXCnxWrbdm6+5nV41d
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  Warcracft III Reforged/StarCraft-Setup.exe
- Size 4.8MB
- SHA256 527111caf8051bff0e019113faf2258b2fe5b8b7dae0e93b68d20d04ed19995a
- MD5 0f66a5bbb9a1e750d98c9529d0a5f7d4
- SHA1 6d6ae5c4096c03a83e97f290ec5bbc55753b9ba7
- SHA512 331ea370cddeb2942ab3756338c74ad3ea988c5d1df840fa0e5ad94a08066a5d2c28a98ab0a1a7841f00850eacddce31e4f7871e96002f69d080e0c4668746b7
- SSDEEP 98304:djp5CzCWby2H8sh8nIKWc9fDmuqMR1GNe/GXh:r52r0fSuqHX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  W3CDKeyGrabber.exe
- Size 64KB
- SHA256 4d38069e48c93a588d022822f3788d72884aca66958572e417d0d1561b889054
- MD5 532e8469a56ca603d38a1212cd92b439
- SHA1 f4107211421b81e82d462b49000533029ccd501f
- SHA512 048aaa9db67dfaaa9f8f0623334cc853f1078e3b20b05367842e03a52246cb93101db419608ca5d3422c8312d2821616553a22fed016b3881733b85834d3cc92
- SSDEEP 1536:Iu8WSYXkWFFCx6qF5g7EPxMIlKBkvDWueo:dSYXkWFFCjcub
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  icyHell.net.URL
- Size 49B
- SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
- MD5 511c6acc2e680e74ce2ca281ee3b8d3a
- SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
- SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
- MD5 SHA1 SHA512
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral16 behavioral17
- Target
  W3Fixer.exe
- Size 490KB
- SHA256 63c2d15c7ad1cb951cefbbfd6fab56303d20d69a44f56fd5e897281a5d2a202d
- MD5 b9edcc7484ae0dc329e1946a56e1e49d
- SHA1 7866ee04717183fab357f29cbc1f5764db946182
- SHA512 987b7110b420da01b7c798423be10991b78d18b203664660a13083841f41372a2f8331a0a67cf1f9a0a7c2cd9b2d6cb603997b1b13ab2640782927ba3f45485f
- SSDEEP 6144:op9HOFKNhVw8bNdEdi7uYN2GhA66lpaxtyToctgOKd/N7xlOzZIOPUBiHCTl0Fzy:ovTw8bwWhGpGgTwOuVsbNCmFzCwwAq9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  icyHell.net.URL
- Size 49B
- SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
- MD5 511c6acc2e680e74ce2ca281ee3b8d3a
- SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
- SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
- MD5 SHA1 SHA512
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral20 behavioral21
- Target
  WarCraft3_TFT_Keygen_by_CRiS.exe
- Size 105KB
- SHA256 cc93b45e0835b94330151656afb59788a5f748479a5a6d75988b0ef1f1d81573
- MD5 2a25957404d3379f8a470b06932d5ecf
- SHA1 8ecae9e50a2afb9312b0de790d446856719e8055
- SHA512 e6daed850220ed529e395369f2b04cc4202f2f826a04e95422e6e4f51204122f8dc9022af227629618b1043189ec5696529808b391807b32636dc9a96e006512
- SSDEEP 3072:I5QVMnbLzdVR8CifXXXyWsSta8GoasuP:kQVGbndVCftt1Fb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  icyHell.net.URL
- Size 49B
- SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
- MD5 511c6acc2e680e74ce2ca281ee3b8d3a
- SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
- SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
- MD5 SHA1 SHA512
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral24 behavioral25
- Target
  Warcracft III Reforged/Warcraft III Reforged™ Setup.exe
- Size 10.6MB
- SHA256 fcd4dd0cd7f49f879cb94cdb263af2ab149e1b817ce59b10a13db9f338f47cfa
- MD5 69ed233958e8c23382060102217b22d4
- SHA1 5084e3104dd3da0b3614aba1e2d7c1357a9dcc14
- SHA512 5e157735442f1ed596a7faeea66ee5e5cd2f1546a036962f7d349e71196810fa07ff3201113a9f90db8878272099ab05d5e2be88efa0470e982c238bf382c272
- SSDEEP 196608:wuDdEGOylRlbMN34CJAk6t5/ooYzxVAruqZY/5slZSFOW6sqgCkujAnZZ:wqdxOqJQ4Xk6tivzzYNq5slcOBsbyjAf
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
behavioral26 behavioral27
- Target
  FTkey.exe
- Size 475KB
- SHA256 e0424b1bf56de09f3def9402775d078486d557df699a0189f1e727de13f488bf
- MD5 2c5fb7fba2e1261ab2b334e3aa71401c
- SHA1 36b38e02eaac12e68b9910fadba22fe5e1b0218e
- SHA512 1b009d2b3143039090723be052eb36662fc310220cbb995b9f17679c8380c2bba0063e33a6293f27dbae2045af6eee0c842657f8aa0afcbec1c53e7cb005c510
- SSDEEP 6144:pQyxZd3/xW8xEzU9iNJlv1AAMHsv9fCDl4iWYgIUrBxUHuEToctgOKd/N7xl8Yn:/d3s2ErNJ5eAMO9KRJXgRrzOJTwOuVj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  cdkey.exe
- Size 410KB
- SHA256 0fd7ba3f1b90b1b683a70e53a7cfd6d42ea26ef9f8884329d9289359f256d0d6
- MD5 cfc639aa681171e6d38c0bcf50ffc449
- SHA1 df4813d3dcc382141cde3e98a4a89e02ebbd33dc
- SHA512 d9194ea27e779a54f2b1495237e47561e041c2931d4bf0a93dbc6fd9d8ea1bdf3c220d228b61698b130e6e984ecb6034aa1544be788fc37294aaebb25bfc6f97
- SSDEEP 6144:xFJ5rQMZ8Oieyc05LqtzUqFdGaMkLoQzHhXrPXTBM5kkb6NBcwlJyo1yGLbcSg7T:RFwxej05ebKTwoQzHlFknwqAaCRR3s
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  icyHell.net.URL
- Size 49B
- SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
- MD5 511c6acc2e680e74ce2ca281ee3b8d3a
- SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
- SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
- MD5 SHA1 SHA512
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

UPX packed file

Checks whether UAC is enabled

Checks whether UAC is enabled

Checks whether UAC is enabled

Checks whether UAC is enabled

Loads dropped DLL

Enumerates connected drives

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32