darkcomet | b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Sharing

Copy URL

Twitter E-mail

General

Target

The-MALWARE-Repo-master.zip
Size

198.8MB
Sample

241213-wlvk9awpgz
MD5

af60ad5b6cafd14d7ebce530813e68a0
SHA1

ad81b87e7e9bbc21eb93aca7638d827498e78076
SHA256

b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1
SHA512

81314363d5d461264ed5fdf8a7976f97bceb5081c374b4ee6bbea5d8ce3386822d089d031234ddd67c5077a1cc1ed3f6b16139253fbb1b3d34d3985f9b97aba3
SSDEEP

6291456:wNl3aFW2h9/fiTwCzCLS6iilVkLZgAEtknRzq:wDaFd//Orcpi4VkL6AfRG

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Geforce

startitit2-23969.portmap.host:1604

Mutex

b9584a316aeb9ca9b31edd4db18381f5

Attributes

reg_key
b9584a316aeb9ca9b31edd4db18381f5
splitter
Y262SUCZ4UJJ

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

nickman12-46565.portmap.io:46565

nickman12-46565.portmap.io:1735

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Userdata.exe
copy_folder
Userdata
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%WinDir%\System32
mouse_option
false
mutex
remcos_vcexssuhap
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Targets

- Target
  
  The-MALWARE-Repo-master/Trojan/XCSSETMacMalware/TrojanSpy.MacOS.XCSSET.A.6fa938770e83ef2e177e8adf4a2ea3d2d5b26107c30f9d85c3d1a557db2aed41
- Size
  
  2KB
- MD5
  
  3b0257a1a7e8b7e66840888db18be1cd
- SHA1
  
  c65988d03ad13a0bf889cddeacde3ba1638bd77b
- SHA256
  
  6fa938770e83ef2e177e8adf4a2ea3d2d5b26107c30f9d85c3d1a557db2aed41
- SHA512
  
  f6beeecee684f4a089b785c956aa614d3e467476edd88c4e6304f97f2ece73432bb4279b0fef210bd9faed380ff3a350e27ea4198473d9503adb2a96414b0a0c
Score

3^/10
behavioral1
- Target
  
  The-MALWARE-Repo-master/Trojan/XCSSETMacMalware/TrojanSpy.MacOS.XCSSET.A.ac3467a04eeb552d92651af1187bdc795100ea77a7a1ac755b4681c654b54692
- Size
  
  21KB
- MD5
  
  48d5f141c857e6779c7c4a01b3bf32fb
- SHA1
  
  04b823a72f134918f64cd6bbac8251f95a42b052
- SHA256
  
  ac3467a04eeb552d92651af1187bdc795100ea77a7a1ac755b4681c654b54692
- SHA512
  
  8fcdfec06e2aa7bf61fdf87e4b3af765c6ef88e35288d9a6ee615b1f964b8d6849adbbbaa0840c20ebc399089be3173cb87f6c51694dd0b6762ee40ce3761f30
- SSDEEP
  
  192:K49FWBrdjgJl9mgxUdmcX+OBKccXlWKEx07pX8bQ1xKgwvmFkXyfgZ/JQAaKxkC6:/UjG8g2m0+OBK7X7lKUuy4NC/KxV9
Score

3^/10
behavioral2
- Target
  
  The-MALWARE-Repo-master/Trojan/XCSSETMacMalware/TrojanSpy.MacOS.XCSSET.A.d11a549e6bc913c78673f4e142e577f372311404766be8a3153792de9f00f6c1
- Size
  
  21KB
- MD5
  
  e5299d8d7159103a3741157c5160edd4
- SHA1
  
  102229386892fd0aa16ca349919cd9b20db30dc8
- SHA256
  
  d11a549e6bc913c78673f4e142e577f372311404766be8a3153792de9f00f6c1
- SHA512
  
  ea2bf21b4e66399675e999ef8dd58b3ca6957e16b57ebe62aef4f1f3a8ad3bec97afb9c30db94368cb8acdf10bf8309e2ea7eccccb257afa0b6da5253c67a313
- SSDEEP
  
  192:M9LZmrdv5lgJUSsKcxXlWK8NfFH7b6dh2KT0MwA7fXPC5g9D4tSb0s:MUv5lisKsX29vMh2KAMXzPQg8
Score

3^/10
behavioral3
- Target
  
  The-MALWARE-Repo-master/Trojan/Zika.exe
- Size
  
  5.6MB
- MD5
  
  40228458ca455d28e33951a2f3844209
- SHA1
  
  86165eb8eb3e99b6efa25426508a323be0e68a44
- SHA256
  
  1a904494bb7a21512af6013fe65745e7898cdd6fadac8cb58be04e02346ed95f
- SHA512
  
  da62cc244f9924444c7cb4fdbd46017c65e6130d639f6696f7930d867017c211df8b18601bfdaaee65438cee03977848513d7f08987b9b945f3f05241f55ec39
- SSDEEP
  
  98304:Xpkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0Funwh6DsN2PIpCr/:Xpkr2dY/aBcjJOBHOBIQBajMtWvoJiLf
Score

7^/10

discovery
- Executes dropped EXE
behavioral4
- Target
  
  The-MALWARE-Repo-master/Trojan/elite.apk
- Size
  
  533KB
- MD5
  
  9f01767647e2e72f446d374bbcb20c53
- SHA1
  
  f6b1adcd7723b525418a05bcede5c671366d7ab3
- SHA256
  
  fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
- SHA512
  
  4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
- SSDEEP
  
  12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ
Score

3^/10
behavioral5
- Target
  
  The-MALWARE-Repo-master/Trojan/mobelejen.apk
- Size
  
  549KB
- MD5
  
  45be5a7857a4fa1c5eadd519e9402e8a
- SHA1
  
  36feb0809c1853f9a1f6d587302691abd7ce90e9
- SHA256
  
  7d59e24f4bdf28a846d21e2608796f7e91389c4778bec75369d7b05e3f8449a5
- SHA512
  
  46c869051e0c97b68f4388b87caecd82bf7362110a34ebb28ddc5fcd6c8a0e339eeaafbfce54d22593e245457fae7ec4c36b49a8556d3327ba7f90a40dd96a73
- SSDEEP
  
  12288:9cVS3EVqPlR6i0Ci3jM34D9zSxjRH6+O//n3tKpSsM+1HA+3De7:9OS3EW6i0C+M3SziN6+ONjstgYDe7
Score

3^/10
behavioral6
- Target
  
  The-MALWARE-Repo-master/Trojan/vi4a.apk
- Size
  
  37KB
- MD5
  
  5f616a8fb9ce44ed75834487405be446
- SHA1
  
  8ae9c48e6a8a21b4c8068e0b8855240978637fdf
- SHA256
  
  b0ff5690c31f160808a869a14fa55f9e38c82de81cf98b895badc88c997ee45c
- SHA512
  
  0ad658d53c455f7e68c3a4722f475bba65c22f17fd2c330a1ed34bff384462ceae9096c2d2e9cb4ad35168c551d579ca6b7335728432e94661dc8f65cdd14c58
- SSDEEP
  
  768:DZ1Z9LApP6PUxxV9L2WSkwvCjSsPVxa8D74gV8:DZPBAB6mIWSjSSszj4D
Score

3^/10
behavioral7
- Target
  
  The-MALWARE-Repo-master/Virus/Floxif/Floxif.exe
- Size
  
  532KB
- MD5
  
  00add4a97311b2b8b6264674335caab6
- SHA1
  
  3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec
- SHA256
  
  812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f
- SHA512
  
  aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70
- SSDEEP
  
  12288:l86GkvJFajbhjTpHjq0dfpT1Oc02XEfGdnGwVUNUnEnAE3F:l8lT9PdpwO0fkGwVUSnEnAoF
Score

10^/10

floxif backdoor discovery trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral8
- Target
  
  The-MALWARE-Repo-master/Virus/Gnil/Gnil.exe
- Size
  
  73KB
- MD5
  
  37e887b7a048ddb9013c8d2a26d5b740
- SHA1
  
  713b4678c05a76dbd22e6f8d738c9ef655e70226
- SHA256
  
  24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b
- SHA512
  
  99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af
- SSDEEP
  
  1536:UGNxwGlpPADH11dcbvbc7ysHJq18/H0UMC96hIoUShbs:UGNJA73dcbvbc7jpe8/UoRhes
Score

8^/10

discovery
- Drops file in Drivers directory
- Executes dropped EXE
behavioral9
- Target
  
  The-MALWARE-Repo-master/Virus/Mabezat/Mabezat.exe
- Size
  
  141KB
- MD5
  
  de8d08a3018dfe8fd04ed525d30bb612
- SHA1
  
  a65d97c20e777d04fb4f3c465b82e8c456edba24
- SHA256
  
  2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb
- SHA512
  
  cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a
- SSDEEP
  
  3072:k8sjSpy0bShLy8gXvzJ9k8a/o3z4aBy5chynHa3Ifn9xJY:Fsjl0bu+NxjJBRhyHJfO
Score

3^/10

discovery
behavioral10
- Target
  
  The-MALWARE-Repo-master/Virus/MadMan.exe
- Size
  
  2KB
- MD5
  
  a56d479405b23976f162f3a4a74e48aa
- SHA1
  
  f4f433b3f56315e1d469148bdfd835469526262f
- SHA256
  
  17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23
- SHA512
  
  f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a
Score

1^/10
behavioral11
- Target
  
  The-MALWARE-Repo-master/Virus/Melissa.doc
- Size
  
  40KB
- MD5
  
  4b68fdec8e89b3983ceb5190a2924003
- SHA1
  
  45588547dc335d87ea5768512b9f3fc72ffd84a3
- SHA256
  
  554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca
- SHA512
  
  b2205ad850301f179a078219c6ce29da82f8259f4ec05d980c210718551de916df52c314cb3963f3dd99dcfb9de188bd1c7c9ee310662ece426706493500036f
- SSDEEP
  
  384:gfLAmQKcIc719x1XG4rFmWfFlmipS/pwlyIuD9AR49lz02gzIK1Q0jZMuapZtRPl:e1g19/X5fUpMyI4ACIv1nacWPiE
Score

1^/10
behavioral12
- Target
  
  The-MALWARE-Repo-master/Virus/Walker.com
- Size
  
  4KB
- MD5
  
  93ceffafe7bb69ec3f9b4a90908ece46
- SHA1
  
  14c85fa8930f8bfbe1f9102a10f4b03d24a16d02
- SHA256
  
  b87b48dcbf779b06c6ca6491cd31328cf840578d29a6327b7a44f9043ce1eb07
- SHA512
  
  c1cb5f15e2487f42d57ae0fa340e29c677fe24b44c945615ef617d77c2737ce4227d5a571547714973d263ed0a69c8893b6c51e89409261cdbedff612339d144
- SSDEEP
  
  96:1WcFwC9mRPCoErxXV0c9pZTvze9nIg95ShfzP03vj:NFwAm9CjxPXvKnIaS5r07
Score

1^/10
behavioral13
- Target
  
  The-MALWARE-Repo-master/Virus/WinNuke.98.exe
- Size
  
  32KB
- MD5
  
  eb9324121994e5e41f1738b5af8944b1
- SHA1
  
  aa63c521b64602fa9c3a73dadd412fdaf181b690
- SHA256
  
  2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a
- SHA512
  
  7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2
- SSDEEP
  
  384:4cr14oKDP9KDviKDeTngwz9zmDAQE4KDJKDv5KDPP4vWe:92FgwBzMAbb3
Score

3^/10

discovery
behavioral14
- Target
  
  The-MALWARE-Repo-master/Virus/Xpaj/xpaj.exe
- Size
  
  219KB
- MD5
  
  d5c12fcfeebbe63f74026601cd7f39b2
- SHA1
  
  50281de9abb1bec1b6a1f13ccd3ce3493dee8850
- SHA256
  
  9db7ef2d1495dba921f3084b05d95e418a16f4c5e8de93738abef2479ad5b0da
- SHA512
  
  132d8c08f40a578c1dc6ac029bf2a61535087ce949ff84dbec8577505c4462358a1d9ef6cd3f58078fdcae5261d7a87348a701c28ce2357f17ecc2bc9da15b4e
- SSDEEP
  
  6144:Gqmg/v4y/MqGs38KHF1SubUriPOKAJnP:jmgXxXGNKHC
Score

7^/10

bootkit discovery persistence spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral15
- Target
  
  The-MALWARE-Repo-master/Virus/Xpaj/xpajB.exe
- Size
  
  520KB
- MD5
  
  bd76fc01deed43cd6e368a1f860d44ed
- SHA1
  
  a2e241e9af346714e93c0600f160d05c95839768
- SHA256
  
  e04c85cd4bffa1f5465ff62c9baf0b29b7b2faddf7362789013fbac8c90268bf
- SHA512
  
  d0ebe108f5baf156ecd9e1bf41e23a76b043fcaac78ff5761fdca2740b71241bd827e861ada957891fbc426b3d7baa87d10724765c45e25f25aa7bd6d31ab4ec
- SSDEEP
  
  12288:Kbx6vZrcRsEQNMnnGpL0zTnPzCFjBL0C2k8apE:Kbx6vam9innGWzUB
Score

7^/10

discovery spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  
  The-MALWARE-Repo-master/Worm/Bezilom.exe
- Size
  
  28KB
- MD5
  
  8e9d7feb3b955e6def8365fd83007080
- SHA1
  
  df7522e270506b1a2c874700a9beeb9d3d233e23
- SHA256
  
  94d2b1da2c4ce7db94ee9603bc2f81386032687e7c664aff6460ba0f5dac0022
- SHA512
  
  4157a5628dc7f47489be2c30dbf2b14458a813eb66e942bba881615c101df25001c09afb9a54f88831fa4c1858f42d897f8f55fbf6b4c1a82d2509bd52ba1536
- SSDEEP
  
  384:1gc4XlUUWiY1SN6oHN64iKZz+ZBEKTzEv819YSHOuSsAR/+eR4517wNwEb:1nREWEFsI+wAJw2E
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral17
- Target
  
  The-MALWARE-Repo-master/Worm/Blaster/607B60AD512C50B7D71DCCC057E85F1C
- Size
  
  15KB
- MD5
  
  607b60ad512c50b7d71dccc057e85f1c
- SHA1
  
  a657eb27806ffe43a0b30aa85f5c75dac0e41755
- SHA256
  
  3e363d76d3949cc218a83a2ee13603d643e3274d3cff71247e38b92bdb391cfa
- SHA512
  
  fc8035bb2c7cc28e091d5c2ae35f31771af3df5d12c54c643aff613e0483c0c82f918f78a35f09877d4f431cf9a4d2619b05ba50596d76cfa9f9c8e33a54bd7b
- SSDEEP
  
  192:46202U0W5+klkphhGp3KVdKIElJRBq/t/QHRzDG5VXPP:4aBLY5VdK/lJRBqt/QH85Vn
Score

5^/10

discovery
- Drops file in System32 directory
behavioral18
- Target
  
  The-MALWARE-Repo-master/Worm/Blaster/8676210e6246948201aa014db471de90
- Size
  
  6KB
- MD5
  
  8676210e6246948201aa014db471de90
- SHA1
  
  86b30d1a8b7515dcab6c8d2781b85c6983709dbf
- SHA256
  
  2e481059b9bc9686c676d69a80202eed5022c9a53ecd8cac215e70c601dd7fdc
- SHA512
  
  5130e6ea6c5e1924af7d630a7b1c6e614b1482edcad3117a8dc56371269260b97793a7ccdbf3249054815b7c3b9c364b30e73e0f8e4cc230502b01d0d2f70bda
- SSDEEP
  
  192:P+szB8G1PO6jgVFpXbWMBpbw/jsaW6HmI:P+szyLVFdbWsbKtWqmI
Score

9^/10

discovery persistence
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Adds Run key to start application
  persistence
behavioral19
- Target
  
  The-MALWARE-Repo-master/Worm/Blaster/8a17f336f86e81f04d8e66fa23f9b36a
- Size
  
  162KB
- MD5
  
  8a17f336f86e81f04d8e66fa23f9b36a
- SHA1
  
  f9465db9573fea92a9224b7600872e8a6d864cbf
- SHA256
  
  93bce533854e3dd53551048403450ae1f03f44c938b1bacaf3d58c45e7e4d957
- SHA512
  
  7ee88762e687403ff08d27c8bbe63f0b8524af0889f34ac044c7d8e0393f8735438da88e6dcf2e0826d48dd8648a3a48fc8c68c8a4b91dd55c995af9a8c5e5e4
- SSDEEP
  
  3072:6bhU1YeFd+bShONEk1ee1eeeemidw4kEPHQdTUQLeosRYghjudju2fZTiusOChCW:6bhUmeFd7W1ee1eeeem+LkEPHg6osRYg
Score

9^/10

discovery persistence upx
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral20
- Target
  
  The-MALWARE-Repo-master/Worm/Blaster/DComExploit.exe.vir
- Size
  
  36KB
- MD5
  
  d68cf4cb734bfad7982c692d51f9d156
- SHA1
  
  fe0a234405008cac811be744783a5211129faffa
- SHA256
  
  54143b9cd7aaf5ab164822bb905a69f88c5b54a88b48cc93114283d651edf6a9
- SHA512
  
  eb25366c4bbe09059040dd17ab78914ff20301a8cd283d7d550e974c423b8633d095d8a2778cfb71352d6cb005af737483b0f7e2f728c2874dc7bdcf77e0d589
- SSDEEP
  
  384:fqiTD8SZzK3+RsiqnZImlYEyx1ml8z0iuKo9oMbNp8SNYLJJ:3D8kK3ViqZx1MuKo9od
Score

3^/10

discovery
behavioral21
- Target
  
  The-MALWARE-Repo-master/Worm/Bumerang.exe
- Size
  
  26KB
- MD5
  
  b6c78677b83c0a5b02f48648a9b8e86d
- SHA1
  
  0d90c40d2e9e8c58c1dafb528d6eab45e15fda81
- SHA256
  
  706fce69fea67622b03fafb51ece076c1fdd38892318f8cce9f2ec80aabca822
- SHA512
  
  302acca8c5dd310f86b65104f7accd290014e38d354e97e4ffafe1702b0a13b90e4823c274b51bcc9285419e69ff7111343ac0a64fd3c8b67c48d7bbd382337b
- SSDEEP
  
  768:K8uYMZTBv1/nGyURhRkCxnjC0VjDT9zG:KbTpBlUnRfhfT9
Score

7^/10

discovery upx
- Executes dropped EXE
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral22
- Target
  
  The-MALWARE-Repo-master/Worm/Fagot.a.exe
- Size
  
  373KB
- MD5
  
  30cdab5cf1d607ee7b34f44ab38e9190
- SHA1
  
  d4823f90d14eba0801653e8c970f47d54f655d36
- SHA256
  
  1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f
- SHA512
  
  b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3
- SSDEEP
  
  6144:Bjrk71gCl5D0nIMpAP40ShG4TmvgFNwUQs4zTBrgDYZJPSLJXaUtjk10he1:S79l5DixAPzwjegFNwVJzTLPSLJXT
Score

10^/10

adware defense_evasion discovery evasion persistence privilege_escalation stealer
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral23
- Target
  
  The-MALWARE-Repo-master/Worm/HeadTail.vbs
- Size
  
  33KB
- MD5
  
  e0a3ab130609c80b452ee423d3a55355
- SHA1
  
  f5408df5f8d2765738db8f5080bb88cab105c038
- SHA256
  
  af1de4b7c65071f490cfd1425c45c9538fd7888cb7dc509304d8ec11cb046649
- SHA512
  
  9326653d66a9866d517cdcdeb1abdf3fb8fdb2a8bc8c2324c916c10aabc7d5ca417c54c7409f0df6454041ad4c446b06b56510e7cc1eaa2b3cf54ec47cb79ae4
- SSDEEP
  
  384:qKNaNYf1S4FeNnbtFrN+rSNENOfX1h8Z6SLWqnLTNgH1N+qN+u0gjL7N:bGYf1S4YnJFZ+r+kOflh8fLBQ+2+uL7N
Score

10^/10

evasion spyware stealer
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral24
- Target
  
  The-MALWARE-Repo-master/Worm/Heap41A.exe
- Size
  
  451KB
- MD5
  
  4f30003916cc70fca3ce6ec3f0ff1429
- SHA1
  
  7a12afdc041a03da58971a0f7637252ace834353
- SHA256
  
  746153871f816ece357589b2351818e449b1beecfb21eb75a3305899ce9ae37c
- SHA512
  
  e679a0f4b7292aedc9cd3a33cf150312ea0b1d712dd8ae8b719dedf92cc230330862f395e4f8da21c37d55a613d82a07d28b7fe6b5db6009ba8a30396caa5029
- SSDEEP
  
  12288:gr3ZBIRB4heEAiRsdUaaSV2qmw0iOanTrA:8ZB2B4hlIMSIqDrA
Score

8^/10

discovery persistence upx
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25
- Target
  
  The-MALWARE-Repo-master/Worm/Mantas.exe
- Size
  
  40KB
- MD5
  
  53f25f98742c5114eec23c6487af624c
- SHA1
  
  671af46401450d6ed9c0904402391640a1bddcc2
- SHA256
  
  7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705
- SHA512
  
  f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048
- SSDEEP
  
  768:rz4RBkfbi/FG9Of8Ejex0a6zALVlXt32KtYFPYA3HxAnIIGSEsu:4Ciw9a8EG05zMt3jKYA3xAYns
Score

6^/10

discovery persistence upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral26
- Target
  
  The-MALWARE-Repo-master/Worm/NadIote/Nadlote.exe
- Size
  
  240KB
- MD5
  
  57aecbcdcb3a5ad31ac07c5a62b56085
- SHA1
  
  a443c574f039828d237030bc18895027ca780337
- SHA256
  
  ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3
- SHA512
  
  7921f184411f898a78c7094176fa47368b1c6ba7d6a3f58df4332e6865325287f25622f1d13765fd08d499d34974461b2ee81319adc24ce3901cc72d132b3027
- SSDEEP
  
  6144:fFzclWnzp5DFV0FuS5hPGR/CnA1G+Ghgav/06hyTu:RcURxR/CnA0rhgaJy
Score

7^/10

discovery persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral27
- Target
  
  The-MALWARE-Repo-master/Worm/Netres.a.exe
- Size
  
  372KB
- MD5
  
  d543f8d2644b09445d9bc4a8a4b1a8c0
- SHA1
  
  72a7b4fb767c47f15280c053fba80de1e44d7173
- SHA256
  
  1c0e2b7981ffa9e86185b7a7aac93f13629d92d8f58769569483202b3a926ce5
- SHA512
  
  9cd77db4a1fe1f0ec7779151714371c21ed798091d9022cec6643c79b2f3c87554a0b7f01c4014e59d0d1a131922a801413d37236ef1c49506f8e1aa5b96e167
- SSDEEP
  
  6144:YEo6WDhsj7atyB3FATvzOdy9uyEP4TpDaO5pHCclI0SCVsMHAiBq2R:IzDhmatywCdy9uxPI75C0VVsUBq
Score

3^/10

discovery
behavioral28
- Target
  
  The-MALWARE-Repo-master/Worm/Nople.exe
- Size
  
  50KB
- MD5
  
  7d595027f9fdd0451b069c0c65f2a6e4
- SHA1
  
  a4556275c6c45e19d5b784612c68b3ad90892537
- SHA256
  
  d2518df72d5cce230d98a435977d9283b606a5a4cafe8cd596641f96d8555254
- SHA512
  
  b8f37ecc78affa30a0c7c00409f2db1e2fd031f16c530a8c1d4b4bffaa5d55ac235b11540c8a611ae1a90b748b04498e3954cfb1529236937ef693c6b20e893b
- SSDEEP
  
  768:7mlllC8F/EKXZ13YXcEWLwpjwRCzbaHRgIvkM:7ClCJKJRqcEiwpcsmgIvkM
Score

3^/10

discovery
behavioral29
- Target
  
  The-MALWARE-Repo-master/Worm/Vobfus/Vobus.exe
- Size
  
  384KB
- MD5
  
  966bb4bdfe0edb89ec2d43519c6de3af
- SHA1
  
  7aa402e5241ff1ca2aeabeeda8928579902ad81a
- SHA256
  
  ef12832d67a099282b6aad1bf2858375dd4b53c67638daf12a253bc9f918b77f
- SHA512
  
  71b8cf14055caee1322976dc0ac777bdd0f9058ee37d30d7967bdc28d80f66d0d478c939501be5f9c70245e5b161c69ad36721a7c6454fea9abe76786934db66
- SSDEEP
  
  3072:rtyFjchUoBENcPCkTaVYD3CbbTDMo6ZWbBrM/LqibDdjGRc32R7srGADv1FSJl:rqJVYD3KDN6ZWbBrM/GiDoO3IsrTvI
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral30
- Target
  
  The-MALWARE-Repo-master/rogues/AdwereCleaner.exe
- Size
  
  190KB
- MD5
  
  248aadd395ffa7ffb1670392a9398454
- SHA1
  
  c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5
- SHA256
  
  51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc
- SHA512
  
  582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e
- SSDEEP
  
  3072:15TDpNFVbxDSXJFFGhcBR1WLZ37p73G8Wn7GlDOg+ELqdSxo5XtIZjnvxRJgghaR:157TcfFPB6B3GL7g+me5aZjn5VlI9T/
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral31
- Target
  
  The-MALWARE-Repo-master/rogues/SpySheriff.exe
- Size
  
  48KB
- MD5
  
  ab3e43a60f47a98962d50f2da0507df7
- SHA1
  
  4177228a54c15ac42855e87854d4cd9a1722fe39
- SHA256
  
  4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f
- SHA512
  
  9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f
- SSDEEP
  
  768:18Gch4aqHnKckG0HrloMOInk3RicH0wDrF5X9gFEvkk3p:1hN/k/ZomkhewDR5NVvkk3p
Score

3^/10

discovery
behavioral32