Resubmissions
12/12/2024, 19:07
241212-xs6grswlhj1012/12/2024, 19:07
241212-xsna7awlfl1011/12/2024, 12:57
241211-p6934stkhw1008/12/2024, 12:52
241208-p34f6ayngj1008/12/2024, 12:51
241208-p3y7fatpe11008/12/2024, 12:48
241208-p133lstpbw10Analysis
- max time kernel
95s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/12/2024, 12:48
Behavioral task
behavioral1
Sample
release.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
release.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Release/Discord rat.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Release/Discord rat.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
builder.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
builder.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
dnlib.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
dnlib.dll
Resource
win10v2004-20241007-en
General
- Target release.zip
- Size 445KB
- Sample241208-p133lstpbw
- SHA256 c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
- MD5 06a4fcd5eb3a39d7f50a0709de9900db
- SHA1 50d089e915f69313a5187569cda4e6dec2d55ca7
- SHA512 75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
- SSDEEP 12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4548 7zFM.exe Token: 35 4548 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4548 7zFM.exe