Overview

overview

10

Static

static

1

Resolute 16x.zip

windows10-ltsc 2021-x64

8

Resolute 1...rt.jpg

windows10-ltsc 2021-x64

7

Resolute 1...it.txt

windows10-ltsc 2021-x64

1

Resolute 1...ts.txt

windows10-ltsc 2021-x64

1

Resolute 1...erties

windows10-ltsc 2021-x64

3

Resolute 1...ga.png

windows10-ltsc 2021-x64

7

Resolute 1...erties

windows10-ltsc 2021-x64

3

Resolute 1...t8.png

windows10-ltsc 2021-x64

7

Resolute 1...00.png

windows10-ltsc 2021-x64

7

Resolute 1...01.png

windows10-ltsc 2021-x64

10

Resolute 1...02.png

windows10-ltsc 2021-x64

7

Resolute 1...03.png

windows10-ltsc 2021-x64

7

Resolute 1...04.png

windows10-ltsc 2021-x64

7

Resolute 1...05.png

windows10-ltsc 2021-x64

7

Resolute 1...06.png

windows10-ltsc 2021-x64

7

Resolute 1...07.png

windows10-ltsc 2021-x64

7

Resolute 1...09.png

windows10-ltsc 2021-x64

7

Resolute 1...0a.png

windows10-ltsc 2021-x64

7

Resolute 1...0b.png

windows10-ltsc 2021-x64

7

Resolute 1...0c.png

windows10-ltsc 2021-x64

7

Resolute 1...0d.png

windows10-ltsc 2021-x64

7

Resolute 1...0e.png

windows10-ltsc 2021-x64

7

Resolute 1...0f.png

windows10-ltsc 2021-x64

7

Resolute 1...10.png

windows10-ltsc 2021-x64

7

Resolute 1...11.png

windows10-ltsc 2021-x64

7

Resolute 1...12.png

windows10-ltsc 2021-x64

7

Resolute 1...13.png

windows10-ltsc 2021-x64

7

Resolute 1...14.png

windows10-ltsc 2021-x64

7

Resolute 1...15.png

windows10-ltsc 2021-x64

7

Resolute 1...16.png

windows10-ltsc 2021-x64

7

Resolute 1...17.png

windows10-ltsc 2021-x64

7

Resolute 1...18.png

windows10-ltsc 2021-x64

7

Resubmissions

07-01-2025 19:20

250107-x14m5swqdr 1

06-01-2025 20:49

250106-zmb23szjgp 8

06-01-2025 20:34

250106-zcfyaayqbp 10

06-01-2025 20:12

250106-yyyjsawpbs 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Resolute 16x.mcpack

  • Size

    7.6MB

  • Sample

    250106-yyyjsawpbs

  • MD5

    b9e57b369a3b919d3d2513db78dd29fe

  • SHA1

    a60a15aeae76b01d9b026650ebdb02bd05cb3412

  • SHA256

    c6004a404cddb4408610b0394b3c133ad1c1bfe5eee08aa5f2836969230612db

  • SHA512

    3e19eb776d11dc4d08c606a28733cd7118f464f01ff08ae1612d08aababb6e18087d0351004012cd34c2ec24c5a91b834d9623a880d32d3efc7999810479840b

  • SSDEEP

    196608:zCPskbMDiJmVU0qsmIuAfdJ8ZHnp3/XFOfOgtk6O:zCbki/0qEFetnp3/XF4OZ

Score
10/10
xmrigcredential_accessdiscoveryevasionexecutionminerpersistencephishingspywarestealerupx

Malware Config

Targets

    • Target

      Resolute 16x.mcpack

    • Size

      7.6MB

    • MD5

      b9e57b369a3b919d3d2513db78dd29fe

    • SHA1

      a60a15aeae76b01d9b026650ebdb02bd05cb3412

    • SHA256

      c6004a404cddb4408610b0394b3c133ad1c1bfe5eee08aa5f2836969230612db

    • SHA512

      3e19eb776d11dc4d08c606a28733cd7118f464f01ff08ae1612d08aababb6e18087d0351004012cd34c2ec24c5a91b834d9623a880d32d3efc7999810479840b

    • SSDEEP

      196608:zCPskbMDiJmVU0qsmIuAfdJ8ZHnp3/XFOfOgtk6O:zCbki/0qEFetnp3/XF4OZ

    Score
    8/10
    credential_accessdiscoveryphishingspywarestealerupx

    • Downloads MZ/PE file

    • A potential corporate email address has been identified in the URL: [email protected]

      phishing

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

    • Target

      Resolute 16x/color chart.png

    • Size

      145KB

    • MD5

      0fa2928b5b13de6f1787d0ed8f010b7c

    • SHA1

      24f6f66af1e26cd1e8e172316f791c83ff5dbee8

    • SHA256

      6eade1b9b073923e87a23157bda525a6ab776bb42cc1dbc5887f14bfd6b69b03

    • SHA512

      f2ad1bbbcfe7c1344b98a803febc8e2149aec33a49128f97383bbcb9e6c909d154353bd671df23e8e69fda0c5246aefbb11b434618976b03fc17e0eb88eafd0d

    • SSDEEP

      3072:1v8vvZ2lQXGQQQQQdtFDrDDDDAMsB2P4PAglSwr8QI5tU9Wr6bR6:1v8vvZ2lQXGQQQQQdtFDrDDDDAv2P4Yf

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral2

    • Target

      Resolute 16x/credit.txt

    • Size

      178B

    • MD5

      b97b62904acbb476bf5da0a3513c6afa

    • SHA1

      0038788a167a1c47f0de7165a13af7516ab7c6ae

    • SHA256

      367f8ba93f591e751e70e402220bb574fae82d0c61248fb18a82b0b095be851c

    • SHA512

      1762475a1c12d773773dda7718528a890e67b321b70a111debf5bc7303f43fac8107f3f9423b4cf70edf7cf1c806d5a2f6c87adb67ea2666b4e3c030bb96260d

    Score
    1/10
    behavioral3

    • Target

      Resolute 16x/credits.txt

    • Size

      451B

    • MD5

      600ff9e89d20b6658661a0fe55c71d26

    • SHA1

      559580d80dbb3227fc01c0058181dad568018d1f

    • SHA256

      3a6a84b05e304f0457c009003c752f9b87e1ab9c9af930ef418454f2b4f632f8

    • SHA512

      d9955d1e4b0fb1dfda63fe700e9ec0c8fdd5635de6e0b10a60c58ee6b1c275754f3a6cb780c478b4dabc1484312ccc9be79ab3ffe889a44ed0ecc015881be0b0

    Score
    1/10
    behavioral4

    • Target

      Resolute 16x/font/ascii.properties

    • Size

      1KB

    • MD5

      62a9b1e877ae16bd77c111d66968bff7

    • SHA1

      d9d0d0feca38b492ecb92270968afe06c5bea3c6

    • SHA256

      a7c021c825887ae780b2762d05f5585a0dfeb42c9b1d8b8cecdf1b5eedd9bd60

    • SHA512

      18dc669984ecff33382c11aca058a29e33ded8fbd8bd0c0335a31a3e6182d0f65eaed71d443ff4c01d809b87e9a82b8171c243851311867000da17f423aa9678

    Score
    3/10
    behavioral5

    • Target

      Resolute 16x/font/ascii_sga.png

    • Size

      4KB

    • MD5

      1aaab2144b27bff62f9fc29e1e63f7ba

    • SHA1

      fffa622509844f11e484757b7f4ff721f9ee1a57

    • SHA256

      2fad4288b675aa01a90d67f7b464c5928f699a6751ce8afbd8c1d27f8c8c2b2c

    • SHA512

      b7afc57f9b34da5dd71dd58c6e55c0363d6c46cc1ba03e2b89b9f112b3dec7b75d304b33b5aa173f1b9fc9de3437fe2cf02231cf4cb7d263c8c00658852ee3a0

    • SSDEEP

      96:UXHt+JcNgOSiS4XsAYNpf2ESNtnTzgRDZQYQ9uSnW/iMQ9u/:MoONgOLPXsAYnHtXQ9M/HQ9O

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral6

    • Target

      Resolute 16x/font/ascii_sga.properties

    • Size

      645B

    • MD5

      73c6c0a9c8960a4f9b573cfb81814737

    • SHA1

      93b6fd5d504e0a1f44a02739f9d1bade7cde6cb3

    • SHA256

      36795be5d2101d2c724d97ef5b2b788bfa7696e62b1904346dceb98f23f0488f

    • SHA512

      71da31e6bd605450cece1e27a6af76e4b2b1e887bb45aa747856f56640304fa5577cef7c53a471c1ee5bcf3e2850470a2b8e16eab4dd9932ebd1ba3d71b9e85e

    Score
    3/10
    behavioral7

    • Target

      Resolute 16x/font/default8.png

    • Size

      6KB

    • MD5

      0f813f693e2a5b31f96a197fbe391c90

    • SHA1

      0c429684906608596848d96ebb4b384966c9aae2

    • SHA256

      91c502bc0ea699657fc09ee03677d9ebff642b1cabbdd60530c02b1d08a8ff30

    • SHA512

      5e4265a2598254c6ce6a71479560ad563aed173a3d71657eb5925053b5afa2afd733dbd09abae70fcb34dc35b170d0aab27e08649d8f06c9641f7b0e57a030d5

    • SSDEEP

      96:ZU74QFIZkidXJDGzdqDkX9TKydCSHj0YZog9yUARA1jHZjlYWO9R63vAdmBNZFp6:fWok6J6zdOkX9XPZjEG11Cl74v+m//tO

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral8

    • Target

      Resolute 16x/font/glyph_00.png

    • Size

      4KB

    • MD5

      524a327412eaf624310806ae89bf4a20

    • SHA1

      f9caf77069b742e33486a1a1f32517df942cbfe2

    • SHA256

      55068cd9b3197fc344cad07af2e20f04b3b2fa2ec40e97517b4e4d69aca52f59

    • SHA512

      4b4306cb1795da77ddcd604b43b5e81b21daad3828471fe253d494919927306d0d0bffa6e8c816cdba209e99dd23f544a489b61731e51a1cbacb7a3b9cdeffaf

    • SSDEEP

      48:CqxJYra1QM/eBJqdJyK0hmXkXjJWpeC2Dw7w7w7xBfgTuld0fAIdSYu6A0ZerjpT:CqxOaq+MJq3yKB1eCB6iO41tB/pT

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral9

    • Target

      Resolute 16x/font/glyph_01.png

    • Size

      2KB

    • MD5

      4d5e6983f7d9cbb8dc13df4bdb4d9159

    • SHA1

      1ce71baa8a2d3ac951fb461abbfe3c7f1c7d4451

    • SHA256

      f1e806bf87683c23218582a3389c529aafb687f7106899456679fd1dc5ffe3cf

    • SHA512

      e8781e11285a4f12071bc8162d9ede699dd825490b47a69568fc8a7ff527121cb56421c19f8855f6df26a866e85d31f7960a051b16c09c76fcf3ae667b1946f5

    Score
    10/10
    xmrigdiscoveryevasionexecutionminerpersistenceupx

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Creates new service(s)

      persistenceexecution

    • Downloads MZ/PE file

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10

    • Target

      Resolute 16x/font/glyph_02.png

    • Size

      2KB

    • MD5

      8b4c933204b775524ad6c10ed86e410c

    • SHA1

      641fe15d5d2ea95bdd6e7698b97fe8871263e6a7

    • SHA256

      7687398a7b72cd6c10c8405e033c7a9f9265d800a5df53db98ee8f1e0dcc4dcd

    • SHA512

      a3311a30335574915b02e1fa681b864d5b01c26ce663e66c0ad0ac2ca51ac3319cd9fea238d9c3bf6b99de1a2ccda2464eaa3231d335b48f2ed6d4db01d76608

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11

    • Target

      Resolute 16x/font/glyph_03.png

    • Size

      1KB

    • MD5

      bd0c08085f4cc0a23dc246c0ac64afff

    • SHA1

      a9f0df0e4b7d514b65606ca9437789fda7dc2d86

    • SHA256

      54c9a08a938384995f57876eae07a77679953b57d34c1064639e71845253b9b6

    • SHA512

      913bdb0e42a3f0df154f1b3c148f3de0e852791d6a5aac432cf4175c0367bc39f56e50c177e9a8e2ce038f05344234896bb90171135d43cb5999d5cbd403a7c8

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral12

    • Target

      Resolute 16x/font/glyph_04.png

    • Size

      2KB

    • MD5

      9a80f10b701f32d7e1a1c0631c9acb27

    • SHA1

      b5d975d51afea0a9b6ffe23119ae88fab88ff7b6

    • SHA256

      7512d339baf8052848b0e9d654d9f4361dbfacebc5ddb0a8a621e7b1a2185f8e

    • SHA512

      86f0396bebc4199cdf37ab9673f6d8c33e5f2d508ed0b081ba85fe14b24cd867f6499bb59865d0d30fbcbce3ed143a452f129c4122d9fab7943ce39c1053ed03

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral13

    • Target

      Resolute 16x/font/glyph_05.png

    • Size

      1KB

    • MD5

      f2a380924c1e5be75dd78b74c3ec1369

    • SHA1

      83cbf7006899ba1806287b3be1d71f1a4c6c216b

    • SHA256

      e4f9f28446563af43cf5eb3bc4fe8d79fc154e52477713e1dec3f44a8a14f33e

    • SHA512

      beb2518bed7527b56864e7331e0b6800ace5937bcbefa2b99b70dbfd34b0664f417e9f0f798fef994417d7323e9de48df3a9f5255639b91db989190fe772e31a

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral14

    • Target

      Resolute 16x/font/glyph_06.png

    • Size

      2KB

    • MD5

      a8f4b2aaa92af8186fa3097ac0b2810e

    • SHA1

      3e41802b68a5486664ebaed8adae508730a36ea2

    • SHA256

      6484723e120e75b9c24d91ba3180f441806794571be6cc9584860991665104a6

    • SHA512

      a740e64edd25591bc3a232360a79c2d73a9484b477fc2db86f03577c8adfffdb602d21ab086b3afc857936bdf013c3aab470d05c892e6d7f3f8f3550a83b2323

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral15

    • Target

      Resolute 16x/font/glyph_07.png

    • Size

      2KB

    • MD5

      34528bc2ab732cfa85af52d731dad4b9

    • SHA1

      9e535c29ac378826adb349d4c32f3796ae357c46

    • SHA256

      1dcaa32dfc8d5bee78c7b671c2acc3c08f280e98f0bcee36bba0ec66c70ed401

    • SHA512

      11ecbd69b70fd5896d6d4992e1aa15e3f9a0e44206e1c2ba622c60775cc881ff208102560286de29aaf82f41d39effe3dfb0b9b9447d7a934c12e333098de802

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral16

    • Target

      Resolute 16x/font/glyph_09.png

    • Size

      3KB

    • MD5

      488540bbb2f326ad2bc10d0ffbaa209c

    • SHA1

      db11b0c69bb94bf3980f4f598e75b9ba57435574

    • SHA256

      32b8cc57ee97e75b37f13251140232a7c9540ead6d5476ea754bb3dedf5145da

    • SHA512

      8aa1292932d1935caec4411d1202996374bcad64036b5a1c3923accaee57107a6498e0c11251a3bed3f6c7ee586addea475809008d40a0acdc1d17651cf7ed11

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral17

    • Target

      Resolute 16x/font/glyph_0a.png

    • Size

      2KB

    • MD5

      c39ab3180273818c871031e67915efea

    • SHA1

      44c8ae0382e044fbc37c60db08f8d265338ccba1

    • SHA256

      c7e0b4b108624173d80fe8a6d12f67ed80fdca5075136b5c7eee6770ac2f4c8a

    • SHA512

      a1cd6e88678a91262c717406eaf0f785b5a2791172febea0637d2b91caac8ed42aa2fdd1d16527be5ed76f6d22ab7e9021423f4d9829c3cf9c7734df5eb1ea53

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral18

    • Target

      Resolute 16x/font/glyph_0b.png

    • Size

      2KB

    • MD5

      ce5d8cb7681f0cb6d2a93088ee13f48d

    • SHA1

      cac46e28ba52b87f40dbe28b64148603ae763d12

    • SHA256

      f265ea6f72124c57392cd652494867ee698c840b515f2dc0f67aabc8dd5408ae

    • SHA512

      4fbfa4b3c19e99884ab951738957add34b5d8d5cbdff968017d7907c66935fcc806e365901ca607ea3081866ad80dd8697fd99810e230d249f17b532d89234c4

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral19

    • Target

      Resolute 16x/font/glyph_0c.png

    • Size

      2KB

    • MD5

      3369a1ac676119ad174c83c9623b708c

    • SHA1

      776e77afab53896da98fb1379d2f5353ef0652f9

    • SHA256

      4a6aa7f5b80c9e8d67f308775ed92964881b4fffbab1110b8c1be785909c5dd2

    • SHA512

      e2128e368177ab909b19d05002ddf6544cfb948b474d5a11fec2a441006d29ceeb57fdf23bf78ca203775f8770c7f9701db0a22815a7d282141ffbd6b8ff7a13

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral20

    • Target

      Resolute 16x/font/glyph_0d.png

    • Size

      2KB

    • MD5

      5b7b5307561d8629af4882db50cf9bae

    • SHA1

      5c53feb7f44ee270db611d078b3d2b0161de3883

    • SHA256

      a7a71b242df3db80d1a5f1b770c7bd2b2b944645d8a5167df2b318bd9bf028b6

    • SHA512

      c223123ef4b48e7b8d2ca289997af26eda133a894a256fd7e30c37d36136785a2ae77d61e7dc4baba08735fda3ece70267ad3761c77a52892efb4b80f18c7deb

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral21

    • Target

      Resolute 16x/font/glyph_0e.png

    • Size

      1KB

    • MD5

      6bc9827ca26eca283e46a764dbe268c5

    • SHA1

      b48591b46dc03238816c6534bd15d97809f58b95

    • SHA256

      1c3fac200316095e095b4e4db792eb432685d5b24762980dbb6c1eca465a1023

    • SHA512

      c8b64384eaadb1bb533413f0d655f564316dff9af7a633c38f67c32acb7b2806b1674baa33e4bdc449537477aae7a2717989738f43f268fc384440596a99a84b

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral22

    • Target

      Resolute 16x/font/glyph_0f.png

    • Size

      2KB

    • MD5

      55c1e6dcb98b2941a4f79de3942c29fd

    • SHA1

      c52d73eaad574ee16fd41253d6724c96a371ac3b

    • SHA256

      8fb729d0da32a4c48bf110d8f33321e8b6a2483fdbfadf6d73bcc64e5914a0a6

    • SHA512

      9ec31bf623c5a607154ddf08f548aa467c1569da16b1fa0de1d41ee679392333e584c484ff8dfec5b3c1f4de94a3b617947ed499bbb9a9e7f0a068988b7f3f9c

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral23

    • Target

      Resolute 16x/font/glyph_10.png

    • Size

      2KB

    • MD5

      f5dc038cbb0648d0ebc499111e748338

    • SHA1

      c4e4de74e8e52c1feb83e8f381844ac709a0e7bd

    • SHA256

      e57e76775bf1455dbe1a73fe32288326039a9e54a4ae55d849b49247a737a1a8

    • SHA512

      ddd371f4dd195ab625433e9ea3b7eb9278300a01cdad55781c8422f62a5a590c1c9bab5c31f616c18c26650611cd607e2384b5934c578c2c9a4eef7dd0c26701

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral24

    • Target

      Resolute 16x/font/glyph_11.png

    • Size

      1KB

    • MD5

      82ad8c33e676c697b7ad6c6759c62413

    • SHA1

      a42c08f726990f096f563b06aaa3464763bd3237

    • SHA256

      68ce44e61e755c6539deab8442455a29c022b3503a89f193247b874298aeebf3

    • SHA512

      f1350e266329dc84af24ea853aba399ee97110533e52a2c9b3192365c738b3da2dd9b15d9a2a65a741c018c316f6f502adabd5e93cccf244028d78c937aae4f0

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral25

    • Target

      Resolute 16x/font/glyph_12.png

    • Size

      2KB

    • MD5

      0fef829dda07af9726dd6aa5e37cffd2

    • SHA1

      9bc79d4a0334414b777edcfcb6056e9deb5b4fc7

    • SHA256

      c8a05dc8eea810726dfda1956cfa63dc9bfdaad283867e4eb6371117bbc56a2d

    • SHA512

      1e2ecec415bfac3746e9620b7869ff619328bc84d50df579e3550056620abc74681fde5f8b649e1fdab1f69e68ea23dd6f266510618c5ede9fafa32a79c433bc

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral26

    • Target

      Resolute 16x/font/glyph_13.png

    • Size

      2KB

    • MD5

      b4c8bb772e04dffaa3815751498f78f9

    • SHA1

      64d3819ec017a086a18a8f5a8cf643208169217b

    • SHA256

      c4900f2efd11570cbe6203c02a13f804d5335aae424491c34cf9b741a32f7c5f

    • SHA512

      57abcf733fc9722a6f72b01918da50662635a4bbe0b7ad2fd0f31db328f0557cacd72efd0588c90381c8dbbd96961ad7cf93059a79afd2f29a9d05ebe3ffdbd4

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral27

    • Target

      Resolute 16x/font/glyph_14.png

    • Size

      1KB

    • MD5

      265a41df9b4838a580caa06154078c91

    • SHA1

      ff88819a3743ae5c8ae81725324e88e712ab2cca

    • SHA256

      fa3b80134bb9eb43893f96269a3eb9ac08809d145d786b73ef16e42028480e29

    • SHA512

      c66153ab46f9f30ca6143c1302c9eab744a5d5f1c15b28b305fc0f98c582e7d3eb6fffac3f12eacc20da42140e3ba299f744e3cc7688459f0c053ef50cdcfaaf

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral28

    • Target

      Resolute 16x/font/glyph_15.png

    • Size

      2KB

    • MD5

      3b30226970234574de49c21129c5da41

    • SHA1

      9368b52fd54aafd27be2781861cd02a8d732dd45

    • SHA256

      5f047bcd1c9674ce029843e3fdcb53766d4f43acd4c1ddf04b51a7b269bf2b03

    • SHA512

      540a85faa4a069624262cf76facf357fe1495af3930305c6c58d3db56742a5b05050f3aeb8a2f3b80aac760c872e7427eb9dc62da62eb8cc6a66105565394402

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral29

    • Target

      Resolute 16x/font/glyph_16.png

    • Size

      2KB

    • MD5

      23b1fdf11f54aca40fcb2578dbd3cf2a

    • SHA1

      426459d1c838d71d117590650c14a55964d606d0

    • SHA256

      9de1fec4efd3678794f7cfda3dc9ac411e4c3b687c5bb8569625cb13d134fd84

    • SHA512

      04f8454e8a07a8d25743fab35a7179543ee0934e74d162991613f1a1a47dac199d1e863309e0a6c62ac337569fb4b6425cc943649328af009076b671d8256086

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral30

    • Target

      Resolute 16x/font/glyph_17.png

    • Size

      2KB

    • MD5

      e365356a47d7547af4a9b0c4ce36caf7

    • SHA1

      448b638cb2bcf05ead487f9ee5beafc007a62de1

    • SHA256

      8607db973a1c93fbae481e0986ce90a6bca74a8404952bc3bbf260a428839239

    • SHA512

      f3bf65ad37865241c0684eb3fb5ab4840471a23c6240b49dec380ec4564c09eb1c42d515ea1206bf659fbeea85ed665a0366ce62ce3fe6ffd49bac6e77c102ac

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral31

    • Target

      Resolute 16x/font/glyph_18.png

    • Size

      1KB

    • MD5

      5553432cff529786feaf8c6f99e705d8

    • SHA1

      f134ca0ce23f5d48019fc93d31f966c2b538f884

    • SHA256

      650f3512c9df9c36471885b0cdeb5742893a5b5939ad07f5f7b10034b911fd8a

    • SHA512

      cb9e14c6cb2bba3a4183744e647750c24e667001ad974ec8a8d51c29aa6214100938ea34432496d5413a04c13e5dca35895081cc061e49db9fe71d68244c174c

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

5
T1012

Remote System Discovery

1
T1018

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Service Stop

1
T1489

Tasks

static1

Score
1/10

behavioral1

credential_accessdiscoveryphishingspywarestealerupx
Score
8/10

behavioral2

Score
7/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
7/10

behavioral7

Score
3/10

behavioral8

Score
7/10

behavioral9

Score
7/10

behavioral10

xmrigdiscoveryevasionexecutionminerpersistenceupx
Score
10/10

behavioral11

Score
7/10

behavioral12

Score
7/10

behavioral13

Score
7/10

behavioral14

Score
7/10

behavioral15

Score
7/10

behavioral16

Score
7/10

behavioral17

Score
7/10

behavioral18

Score
7/10

behavioral19

Score
7/10

behavioral20

Score
7/10

behavioral21

Score
7/10

behavioral22

Score
7/10

behavioral23

Score
7/10

behavioral24

Score
7/10

behavioral25

Score
7/10

behavioral26

Score
7/10

behavioral27

Score
7/10

behavioral28

Score
7/10

behavioral29

Score
7/10

behavioral30

Score
7/10

behavioral31

Score
7/10

behavioral32

Score
7/10