Extracted

Extracted

Extracted

• • Target

    The-MALWARE-Repo-master/Trojan/MEMZ.exe

  • Size

    14KB

  • MD5

    19dbec50735b5f2a72d4199c4e184960

  • SHA1

    6fed7732f7cb6f59743795b2ab154a3676f4c822

  • SHA256

    a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

  • SHA512

    aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

  • SSDEEP

    192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

  Score

  7^/10

  bootkitdiscoverypersistencephishingevasion

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6

• • Target

    The-MALWARE-Repo-master/Trojan/Mobile_Legends_Adventure.apk

  • Size

    4.0MB

  • MD5

    42585ccd2b7867c12052653e4d54b7cc

  • SHA1

    a9348c3aabcc0171d1e35edeb37fd2da0fff0ad4

  • SHA256

    b47bcc55ca8dc0625a145d6809cfa3ad78e9e3b4f33bc608b5bcaf7e9e1e5827

  • SHA512

    e270bd1fbbaaccf3382048e9ac2489444a735ed32fb83f7681526a1edb0b7847d6adb8d75064b065309293ef75c45e2ea85fb132a1c12afd08b3a1346caad550

  • SSDEEP

    98304:1kDC5i3mO2jB5qJYNXV6lDysPmkMZHG9dqO/J:1x2ZW5eYN4lDy2xwHG9dfJ

  Score

  1^/10
  behavioral7

• • Target

    The-MALWARE-Repo-master/Trojan/MrsMajors/BossDaMajor/BossDaMajor.exe

  • Size

    1.9MB

  • MD5

    38ff71c1dee2a9add67f1edb1a30ff8c

  • SHA1

    10f0defd98d4e5096fbeb321b28d6559e44d66db

  • SHA256

    730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a

  • SHA512

    8347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9

  • SSDEEP

    49152:veG3J7FtM9SbJakTiTBMGSARaspyyx979PSxgKFdGlYU:2GZxSoJrTiTBMGtRa8t7EFddU

  Score

  10^/10

  defense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Modifies system executable filetype association

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral11behavioral12behavioral13behavioral8behavioral9

• • Target

    The-MALWARE-Repo-master/Trojan/elite.apk

  • Size

    533KB

  • MD5

    9f01767647e2e72f446d374bbcb20c53

  • SHA1

    f6b1adcd7723b525418a05bcede5c671366d7ab3

  • SHA256

    fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1

  • SHA512

    4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed

  • SSDEEP

    12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ

  Score

  1^/10
  behavioral14behavioral15behavioral16

• • Target

    The-MALWARE-Repo-master/Trojan/mobelejen.apk

  • Size

    549KB

  • MD5

    45be5a7857a4fa1c5eadd519e9402e8a

  • SHA1

    36feb0809c1853f9a1f6d587302691abd7ce90e9

  • SHA256

    7d59e24f4bdf28a846d21e2608796f7e91389c4778bec75369d7b05e3f8449a5

  • SHA512

    46c869051e0c97b68f4388b87caecd82bf7362110a34ebb28ddc5fcd6c8a0e339eeaafbfce54d22593e245457fae7ec4c36b49a8556d3327ba7f90a40dd96a73

  • SSDEEP

    12288:9cVS3EVqPlR6i0Ci3jM34D9zSxjRH6+O//n3tKpSsM+1HA+3De7:9OS3EW6i0C+M3SziN6+ONjstgYDe7

  Score

  1^/10
  behavioral17behavioral18behavioral19

• • Target

    The-MALWARE-Repo-master/Trojan/vi4a.apk

  • Size

    37KB

  • MD5

    5f616a8fb9ce44ed75834487405be446

  • SHA1

    8ae9c48e6a8a21b4c8068e0b8855240978637fdf

  • SHA256

    b0ff5690c31f160808a869a14fa55f9e38c82de81cf98b895badc88c997ee45c

  • SHA512

    0ad658d53c455f7e68c3a4722f475bba65c22f17fd2c330a1ed34bff384462ceae9096c2d2e9cb4ad35168c551d579ca6b7335728432e94661dc8f65cdd14c58

  • SSDEEP

    768:DZ1Z9LApP6PUxxV9L2WSkwvCjSsPVxa8D74gV8:DZPBAB6mIWSjSSszj4D

  Score

  1^/10
  behavioral20behavioral21behavioral22

• • Target

    The-MALWARE-Repo-master/Virus/Mabezat/Mabezat.exe

  • Size

    141KB

  • MD5

    de8d08a3018dfe8fd04ed525d30bb612

  • SHA1

    a65d97c20e777d04fb4f3c465b82e8c456edba24

  • SHA256

    2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb

  • SHA512

    cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a

  • SSDEEP

    3072:k8sjSpy0bShLy8gXvzJ9k8a/o3z4aBy5chynHa3Ifn9xJY:Fsjl0bu+NxjJBRhyHJfO

  Score

  3^/10

  discovery
  behavioral23behavioral24behavioral25behavioral26behavioral27behavioral28