Resubmissions

11-12-2024 18:37

241211-w9f3rstpez 10

11-12-2024 18:28

241211-w4jayatnat 10

General

  • Target

    virus.zip

  • Size

    49.2MB

  • Sample

    241211-w4jayatnat

  • MD5

    7d68b93d4a7e51dbfdb62da3979bd11a

  • SHA1

    47c4b9e3d564b668cffbf4519e8b1211ee97a2ab

  • SHA256

    9ddd2984852b80fb41546e96a1c3414a55415050761a47633d28a4faeef7a3d1

  • SHA512

    db5fe8ea5ca56c0d49ac38090015f70502ca4ef8211f3d665e0fa4335bfa28768747343aa50b57d2f5e0b8176767a0f1cb0c83b078fe2071d3d69144d7124ec4

  • SSDEEP

    1572864:8SUiIzH6/VfA7URPNfKkEBiUA0zwunkc7QE:XTXVfHPtQiPpunlQE

Malware Config

Targets

    • Target

      virus/FiddlerSetup.5.0.20245.10105-latest.exe

    • Size

      4.4MB

    • MD5

      c1980b018489df28be8809eb32519001

    • SHA1

      e860439703d7b6665af4507b20bbef2bbb7b73f4

    • SHA256

      588024037b1e5929b1f2a741fff52a207bcab17f0650ec7cb0cd3cb78051998d

    • SHA512

      f70d419e869e56700a9e23350a9779f5dd56bb78adb9a1b0d5039287a24f20004db20f842294d234d4717feaa3184a5e6d90f0ee3666208bad2ea518d37b0a35

    • SSDEEP

      98304:qMgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdA:qMoWvePjqHv72Qo96pvtF5wH

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target

      $PLUGINSDIR/FiddlerSetup.exe

    • Size

      4.4MB

    • MD5

      c2a0eb6f104eacec3f39581451ee208f

    • SHA1

      9ae7d02aeb640fbd090dfc01885b98dd5dd0b6cc

    • SHA256

      1f926cc353301e547e76c6d2eff23fcbe85495ba0292174cc6344fac26457af8

    • SHA512

      8b062e4f0af1dce3a12b5776646fe8c235f30de6772f579da1a6ab2bb559ed69b3bd32af95eee248c48008ddcbd40a7e49eae722a44bc9b49dd13fe38113a3ca

    • SSDEEP

      98304:KgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdAM:KoWvePjqHv72Qo96pvtF5wHM

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      192639861e3dc2dc5c08bb8f8c7260d5

    • SHA1

      58d30e460609e22fa0098bc27d928b689ef9af78

    • SHA256

      23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

    • SHA512

      6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

    • SSDEEP

      192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr

    Score
    3/10
    • Target

      Analytics.dll

    • Size

      32KB

    • MD5

      1c2bd080b0e972a3ee1579895ea17b42

    • SHA1

      a09454bc976b4af549a6347618f846d4c93b769b

    • SHA256

      166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

    • SHA512

      946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

    • SSDEEP

      384:gpeCB0nVQ/EMq7+Zi9nQwnHgfLtVUEoBXejF6XFlnwnYPLYyTcGq1y2h33XcQ7:/U0VQMMrZi9QiHWtVxOFxwxGqXR7

    Score
    1/10
    • Target

      Be.Windows.Forms.HexBox.dll

    • Size

      60KB

    • MD5

      e6f7b8c5ec4d1543eaa7f5d148c6327c

    • SHA1

      61a5bf82b4f7da4040f76e7aec4b4b5fe0c544ec

    • SHA256

      bbfd21490a4be96e1a44a92e39406e87978aea1fc58b603702e4e21a143dd89e

    • SHA512

      6f4516677937f6d58d250f7b6a50f3815691f84ac17e455dd09dc6d4ecc215a8a8ea000706885c858708603223661908067ed36c037766a52d15f2eb33af1fc4

    • SSDEEP

      1536:/KS4Z+5ZUOxinOGm7kF5Gw5qQ0DaK/nbL0LolKo4I/AhYe:T4ZkiHOGT0Dpf08Bve

    Score
    1/10
    • Target

      DotNetZip.dll

    • Size

      461KB

    • MD5

      a999d7f3807564cc816c16f862a60bbe

    • SHA1

      1ee724daaf70c6b0083bf589674b6f6d8427544f

    • SHA256

      8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

    • SHA512

      6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

    • SSDEEP

      6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW

    Score
    1/10
    • Target

      EnableLoopback.exe

    • Size

      82KB

    • MD5

      81564947d42846910eec2d08310e0d25

    • SHA1

      b7a167dcd3afb29c8a0e18c943d634e3fc58a44c

    • SHA256

      543f16b73f7d40177585332f433ce76dddc1526e12bcd62cb73edd11eb002341

    • SHA512

      8f06409517697b022787bc9e2ed7e73100018422177aa3f63ecb406c3bdb6b021624f909a16fca0430002bfa7d35a461b38750c79c0273a154f63316b4e13037

    • SSDEEP

      768:AREI16zcI2eupxmhm/ljPb0O7/Al25znrShUABg4CqnZx6qmmlkoxPLabCxf1mlr:y1HLdwOLFzrShURwZoxmlkoxDtfIIM

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      ExecAction.exe

    • Size

      19KB

    • MD5

      519310853c0ee273a3f8787d7518dd2e

    • SHA1

      22c4e25c4c4c2b5654d05cd6a1e737c6bcb588d8

    • SHA256

      a23c852d3ed4148044708925e56e17246cdb88d6ecaaa375503fa1f915ba1272

    • SHA512

      30e51202416ab2d0bac9cd294d08c12d7973e75696283b1823c6442033698f85075d14dcd79fb1f56886f4491981b1e278d3a506e5e458a1eee6bb372d5e683d

    • SSDEEP

      192:ZsCrRJUlWDSnYe+PjPxucwwSoDvucwwfih5H0JOqxEV1a//bZ28WhTEn:GGOZnYPLxoAjo4S+JNY1cAhhY

    Score
    1/10
    • Target

      FSE2.exe

    • Size

      50KB

    • MD5

      c2fe7c92a8fc763407233203b49685f9

    • SHA1

      d2f199e71eb7531caa71f85a679e49fa400cc401

    • SHA256

      f55d5cb9968bcb875dc39cc84153bd52375f4cf8a680e0f5eb53a57a7e532561

    • SHA512

      f74d29f4520ae0c9aa153f3649bdf80c1ed882a61add7267eafaecb2d036f43fc44434279e3dacd763ebc42fedc78ec3ad52a11b55d14b224b01a8bebca0f6b5

    • SSDEEP

      768:YhiPG/qDcpEr7+zQ3Eo8P0gsH8Ufj02e0r/oEbkG3wR:ozKcy3+z7o88gsH5fjyXR

    Score
    3/10
    • Target

      Fiddler.exe

    • Size

      3.5MB

    • MD5

      87bc17f56e744e74408e6ae8bb28b724

    • SHA1

      3aa572388083ff00a95405d34d1189c99c7ff5be

    • SHA256

      ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057

    • SHA512

      cbeee155c97b87a22b92b808f86fee25c18db51ab43a36b657d532d2d47d3a7db2f4507a699b72af904bf6d5ed851d1ae1fcfb4833a57096e6c7787211c0f35d

    • SSDEEP

      49152:cbvLSgf+VOdx3Vw5+mbSgwJKI0Qpvs3c2KTn4Xj9Bh:cTmgf+VOdc5vbSgwJKDP24Rf

    Score
    4/10
    • Target

      ForceCPU.exe

    • Size

      19KB

    • MD5

      b982a103b0d4e0db856026a163124bf3

    • SHA1

      40772be00068bbd394ff0fccd551151a822f3e70

    • SHA256

      2d209c2b823e350c1f1661f87a3a013804302477afe56877f94adbafe7a2e06d

    • SHA512

      214ecdf348e2093e91a489c0541f05eb3356e2531c1840a99d9f727caf1130f5041ccbc6356a7bc31fb4dece927d3fee2fa9e4689d2badbe680fd40104a9d327

    • SSDEEP

      192:fHtIemmfltxD5WLtWwiyT5hNGnYe+PjPxucwwyibSucwwQJk35H0JOqxEV1a//bG:xD5WLZ5qnYPLxoDfoDg+JNY1cAhhv

    Score
    1/10
    • Target

      GA.Analytics.Monitor.dll

    • Size

      52KB

    • MD5

      6f9e5c4b5662c7f8d1159edcba6e7429

    • SHA1

      c7630476a50a953dab490931b99d2a5eca96f9f6

    • SHA256

      e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

    • SHA512

      78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

    • SSDEEP

      768:7su21mzJ3+LDDke5WcsvOvHOQ+5bQZdKXJccxYi:7qmByvke5Wcs22QRGKLi

    Score
    1/10
    • Target

      ImportExport/BasicFormats.dll

    • Size

      111KB

    • MD5

      58a251d92731afb962b29636a887b9c7

    • SHA1

      e54785f1804c9613b0e5b1728aee97f49b6d66ad

    • SHA256

      28a908ac2d08de1dd2ae55edfa417ff72f535ec9207226a9ff4a0134871429f3

    • SHA512

      4831534feba39a30e7cf86e496c41ff7661d44784aa80b6ce1562b71bc36eae38308dda46e76209b919952e5e615ab5b8ad80cc349b78522f6e87e4a45f1b421

    • SSDEEP

      3072:T5zlHe5PmH2YVy3zhKOupG9g1rERA1Ten6V++HOHv7w:Lg/d2Z

    Score
    1/10
    • Target

      ImportExport/VSWebTestExport.dll

    • Size

      44KB

    • MD5

      03fcff4a49159e5c405420df08b37757

    • SHA1

      89b0bc35a78f56212e53556e45d1f9039d2488d1

    • SHA256

      5566857f213582ddca5d202bc19a1b649061437fbfd7e699afd64986fea5fb61

    • SHA512

      8cb0d400b848d01e74a0050cdd779224d96db3b87ea393a098a5e75c52c16fd3b3bf20f49196da976af61960c865620ef82ff0295774e2e67ac5c92949c248c4

    • SSDEEP

      768:obJ9YyrdngGT7Enn/IRXILJtGiU83aTwBmxCnF0Cxf1mlD0Z:EyEw/LtrU83aImx4fIIZ

    Score
    1/10
    • Target

      Inspectors/QWhale.Common.dll

    • Size

      192KB

    • MD5

      ac80e3ca5ec3ed77ef7f1a5648fd605a

    • SHA1

      593077c0d921df0819d48b627d4a140967a6b9e0

    • SHA256

      93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

    • SHA512

      3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

    • SSDEEP

      1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc

    Score
    1/10
    • Target

      Inspectors/QWhale.Editor.dll

    • Size

      816KB

    • MD5

      eaa268802c633f27fcfc90fd0f986e10

    • SHA1

      21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

    • SHA256

      fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

    • SHA512

      c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

    • SSDEEP

      12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB

    Score
    1/10
    • Target

      Inspectors/QWhale.Syntax.Schemes.dll

    • Size

      284KB

    • MD5

      681abb88692a8d2662c527eab350744b

    • SHA1

      58bf5fdfa668c2add65a6b7edbb43eab47648821

    • SHA256

      9ad5749ba1914101cd4cf2736d0e74bbb8c7abbe93fd5e83377d5cbf33ddb78d

    • SHA512

      5f2a370b4bd64e03469ddaa90b7ebd75e588033dbe48ae1b111fa537e56aa13b5bd7e067126d3cc543faf45cd0595ea2355d8fa412197b61f18754e4f9876823

    • SSDEEP

      1536:/YiCDgqGqtbeBLmTnNLUSgk9NPOEbg0hIc2Vrl2XuPtlPpXB1sJOm8M93f2AkkgW:abMmTnNLUSgk9NPOEL2Wg1TOV

    Score
    1/10
    • Target

      Inspectors/QWhale.Syntax.dll

    • Size

      228KB

    • MD5

      3be64186e6e8ad19dc3559ee3c307070

    • SHA1

      2f9e70e04189f6c736a3b9d0642f46208c60380a

    • SHA256

      79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

    • SHA512

      7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

    • SSDEEP

      3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V

    Score
    1/10
    • Target

      Inspectors/Standard.dll

    • Size

      246KB

    • MD5

      2f2dcf9a8bea903a95abb95808066201

    • SHA1

      98b473a015e874638d35731710b5790fe8ec9df9

    • SHA256

      e7f653b706f4d083d089670b8862b579f888450d3184085bc970daa3ff040012

    • SHA512

      228f56acea5ac941dcb192775f8e8e8230c0b0e24487f135bfb5025b1a1bf64ee8cc733c44f5dcdc8eb2f63a9040e9a8ec251ec3e105f81e3007d31a15608344

    • SSDEEP

      6144:5DdXkVTfwIyE8W+pb7fUQ/51ftYx2Ngzs2L3NUR/m1N:5DdXkiIyEV+pb7Znrxmb

    Score
    1/10
    • Target

      Inspectors/SyntaxView.dll

    • Size

      68KB

    • MD5

      49c71e4f9141cc77798718e41ec8a0d3

    • SHA1

      84bf7e9f3a462dbbe7ee3e627a83422cf0df4d08

    • SHA256

      9c5178b2aab92a79be9e4b31e2214d6650961b53bbdc48d952d20725e473b2fe

    • SHA512

      ed7d35e6929670cd181a398b4c09fdf444b7eacff147a9be3bc783944e65541ebf883629fc23d6c6b642eb6719e8e9fa8a4d1c4c9ef65ba78d1ea5539f9f4843

    • SSDEEP

      1536:KSYKCJHDFPc0WIo1zf2tr7OWzKxrCfIP:K2CRDFYIo1zfBgG/

    Score
    1/10
    • Target

      Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      195ffb7167db3219b217c4fd439eedd6

    • SHA1

      1e76e6099570ede620b76ed47cf8d03a936d49f8

    • SHA256

      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    • SHA512

      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

    • SSDEEP

      12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

    Score
    1/10
    • Target

      Plugins/NetworkConnections/Telerik.NetworkConnections.Windows.dll

    • Size

      33KB

    • MD5

      5889357424d717c8629c8bfabcd0be50

    • SHA1

      87e7047a40e24bd5ac23f89e072ee39a14a53023

    • SHA256

      3564b25b24569b8d8a0128f2f4bddec89c0b8986da7542d9c64aac730360a600

    • SHA512

      1af458742cefd4730d64b19ecc05460354f0e47a79cdcd7794877aa0f6c56cfb92f37a0daf66fedaec2a579eb0187d774b7d5ba1fff65d6ab1504df4c3668fad

    • SSDEEP

      768:2LpjNBBUyOzcB7RZbkTg+jO4HmBWKNTjNTlfKaE:2LB9VRpOg+jmBPFjF0aE

    Score
    1/10
    • Target

      ScriptEditor/Analytics.dll

    • Size

      32KB

    • MD5

      1c2bd080b0e972a3ee1579895ea17b42

    • SHA1

      a09454bc976b4af549a6347618f846d4c93b769b

    • SHA256

      166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

    • SHA512

      946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

    • SSDEEP

      384:gpeCB0nVQ/EMq7+Zi9nQwnHgfLtVUEoBXejF6XFlnwnYPLYyTcGq1y2h33XcQ7:/U0VQMMrZi9QiHWtVxOFxwxGqXR7

    Score
    1/10
    • Target

      ScriptEditor/GA.Analytics.Monitor.dll

    • Size

      52KB

    • MD5

      6f9e5c4b5662c7f8d1159edcba6e7429

    • SHA1

      c7630476a50a953dab490931b99d2a5eca96f9f6

    • SHA256

      e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

    • SHA512

      78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

    • SSDEEP

      768:7su21mzJ3+LDDke5WcsvOvHOQ+5bQZdKXJccxYi:7qmByvke5Wcs22QRGKLi

    Score
    1/10
    • Target

      ScriptEditor/QWhale.Common.dll

    • Size

      192KB

    • MD5

      ac80e3ca5ec3ed77ef7f1a5648fd605a

    • SHA1

      593077c0d921df0819d48b627d4a140967a6b9e0

    • SHA256

      93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

    • SHA512

      3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

    • SSDEEP

      1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc

    Score
    1/10
    • Target

      ScriptEditor/QWhale.Editor.dll

    • Size

      816KB

    • MD5

      eaa268802c633f27fcfc90fd0f986e10

    • SHA1

      21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

    • SHA256

      fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

    • SHA512

      c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

    • SSDEEP

      12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB

    Score
    1/10
    • Target

      ScriptEditor/QWhale.Syntax.Parsers.dll

    • Size

      1.1MB

    • MD5

      9fe6e9cfedb661c61a2c70fa75008ec3

    • SHA1

      0f6a0f4e7fc5552088d3f2dd0c0adf6f6c45b686

    • SHA256

      acff23204982780d844f5b0cbfe0bf1849c1dfe782cb4084ba2bdc9bf53f026c

    • SHA512

      a8864ee43628f667d6e0acf071fbba414ff768fe9dd302e6f9498432b3ce48a22deecfe438099a3caa684ad8e9588fae111de752c37c158eebd76e48ab67e02d

    • SSDEEP

      6144:DDsAkHPWoMvThdMlLQtRZfScxaHrlXnp55VAWvRY02OCo6+shEd2qxrGa:DDs7uounM5WSNAG2otTh

    Score
    1/10
    • Target

      ScriptEditor/QWhale.Syntax.dll

    • Size

      228KB

    • MD5

      3be64186e6e8ad19dc3559ee3c307070

    • SHA1

      2f9e70e04189f6c736a3b9d0642f46208c60380a

    • SHA256

      79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

    • SHA512

      7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

    • SSDEEP

      3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V

    Score
    1/10
    • Target

      Scripts/FiddlerOrchestra.Addon.dll

    • Size

      47KB

    • MD5

      465761effbd26e70fb83595cb5f8a20a

    • SHA1

      9b98750ebbc7ce144a2f8150f3b1d8201a53a2af

    • SHA256

      38a7fa0c13d5700eec8178db2116a51c7e23d97871dbd159fb16104f91c0bfee

    • SHA512

      063c93d8cfc0dd17d56abccb25c00c430066a117e993205ceb0161260214a104627672eaac0ea2ec6c8be488cd2056b92cf002c94c873efcf464efe35efbda7c

    • SSDEEP

      768:h/M61OLoQSR1KWAEI086vCNVTFzQyx0yHjNbpV+5y43hDxnTxiDTxf1mlQh5VdJs:h/cBEI08WCNVT7Hjdv+hhDxn9WfI+vIz

    Score
    1/10
    • Target

      Scripts/FiddlerOrchestra.Connection.dll

    • Size

      1.8MB

    • MD5

      19d00193a0df0b4d0734d209989f594c

    • SHA1

      1adaabf30ef7350df16b7fed023bd980809f4086

    • SHA256

      7a041deb6934864bc3c057d1440f00e2e56104018069e57201f0fc877ef78713

    • SHA512

      6402fa43a1b0e5a96f3270751f18be7b22774fa59a1a6737a0c1549642ef4f148765eaf30776c46f371d5dff69a164454b908ad00fc371d8bdeeddc52f7c9789

    • SSDEEP

      49152:pkLbcPdI5jVkVyEf8qLFlBPdl7KsQ3+rLmk54aqJJd:YEPFXYzd

    Score
    1/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      192639861e3dc2dc5c08bb8f8c7260d5

    • SHA1

      58d30e460609e22fa0098bc27d928b689ef9af78

    • SHA256

      23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

    • SHA512

      6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

    • SSDEEP

      192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr

    Score
    3/10
    • Target

      virus/FrozenPerm_CRACKED.exe

    • Size

      64.8MB

    • MD5

      26500f10c8ceeae8d462d6a3086ab5d3

    • SHA1

      5a61e0551ff00378c3d633170b67403e50a9d425

    • SHA256

      a8c756a4059a6be18b3a44802403fd388d938ab33677e1a6032d1c6c7741ac0b

    • SHA512

      b1198bd575726753782e85334a1250a1fce770cad303941048801a0ac2e70ae680076535faf0c37e19644d561b3b9cc77407c23a358872e7d1c17893eecfcf09

    • SSDEEP

      786432:BYS6GKaTYIGiYk+KjotgDqanrcHJB5hOq29p2DrhUcVqttPemFt/W:NmijZpgHJnhOdGrKYmFt/W

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

static1

blankgrabber
Score
10/10

behavioral1

discoveryevasionpersistenceprivilege_escalation
Score
9/10

behavioral2

discoveryevasionpersistenceprivilege_escalation
Score
9/10

behavioral3

discovery
Score
3/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

discovery
Score
7/10

behavioral8

Score
1/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
4/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

discovery
Score
3/10

behavioral32

xmrigcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionminerpersistenceprivilege_escalationspywarestealerupx
Score
10/10