Overview
overview
10Static
static
10Armageddon...ty.exe
windows7-x64
8Armageddon...ty.exe
windows10-2004-x64
8Armageddon...ht.dll
windows7-x64
1Armageddon...ht.dll
windows10-2004-x64
1Armageddon...ax.dll
windows10-2004-x64
7Armageddon...ub.exe
windows7-x64
1Armageddon...ub.exe
windows10-2004-x64
1Armageddon...ip.dll
windows7-x64
1Armageddon...ip.dll
windows10-2004-x64
1Armageddon...er.exe
windows7-x64
8Armageddon...er.exe
windows10-2004-x64
8Armageddon...k1.exe
windows7-x64
1Armageddon...k1.exe
windows10-2004-x64
1Armageddon...ub.exe
windows7-x64
1Armageddon...ub.exe
windows10-2004-x64
1AttWorm/AT...ed.exe
windows7-x64
8AttWorm/AT...ed.exe
windows10-2004-x64
8AttWorm/Jint.dll
windows7-x64
1AttWorm/Jint.dll
windows10-2004-x64
1AttWorm/js.exe
windows7-x64
1AttWorm/js.exe
windows10-2004-x64
3AttWorm/sk...et.dll
windows7-x64
1AttWorm/sk...et.dll
windows10-2004-x64
1AttWorm/sk...ip.dll
windows7-x64
1AttWorm/sk...ip.dll
windows10-2004-x64
1AttWorm/sk...er.exe
windows7-x64
8AttWorm/sk...er.exe
windows10-2004-x64
8AttWorm/skci/att.exe
windows7-x64
3AttWorm/skci/att.exe
windows10-2004-x64
3Aurora Wor...1N.exe
windows7-x64
8Aurora Wor...1N.exe
windows10-2004-x64
8Aurora Wor...ip.dll
windows7-x64
1Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2025 16:58
Behavioral task
behavioral1
Sample
Armageddon Stealer 1.0 by Krusty/Armageddon Stealer 1.0 by Krusty.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Armageddon Stealer 1.0 by Krusty/Armageddon Stealer 1.0 by Krusty.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Armageddon Stealer 1.0 by Krusty/mfc100cht.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Armageddon Stealer 1.0 by Krusty/mfc100cht.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Armageddon Stealer 1.0 by Krusty/mstscax.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Armageddon Stealer 1.0 by Krusty/stub.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
Armageddon Stealer 1.0 by Krusty/stub.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Ionic.Zip.dll
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Ionic.Zip.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Launcher.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/ak1.exe
Resource
win7-20241010-en
Behavioral task
behavioral13
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/ak1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/stub.exe
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/stub.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
AttWorm/ATTWorm Cracked.exe
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
AttWorm/ATTWorm Cracked.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
AttWorm/Jint.dll
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
AttWorm/Jint.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
AttWorm/js.exe
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
AttWorm/js.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
AttWorm/skci/Extreme.Net.dll
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
AttWorm/skci/Extreme.Net.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
AttWorm/skci/Ionic.Zip.dll
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
AttWorm/skci/Ionic.Zip.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
AttWorm/skci/Launcher.exe
Resource
win7-20240729-en
Behavioral task
behavioral27
Sample
AttWorm/skci/Launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
AttWorm/skci/att.exe
Resource
win7-20241023-en
Behavioral task
behavioral29
Sample
AttWorm/skci/att.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
Aurora Worm v1/Aurora Worm v1-Cracked by RoN1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
Aurora Worm v1/Aurora Worm v1-Cracked by RoN1N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
Aurora Worm v1/settings/Ionic.Zip.dll
Resource
win7-20241010-en
General
-
Target
AttWorm/skci/att.exe
-
Size
251KB
-
MD5
e4eed29dd468222723ce4281beb497b2
-
SHA1
670a2b409e3b2be3145c2a1409f3483d1f143302
-
SHA256
881cb0fb1d8fc32e7cc636c40602a189101f20f5926a7618658453b2d9318d63
-
SHA512
297effe85c3d1f0e0f040fb10308a7ff29d2a0f30fd72559d02af94f01ed7097603afe9599da6908fd600a7a874ce58b19271553884d10aa6462c118ddb1703e
-
SSDEEP
3072:1mSN+RTX2EO3FgZCkUlXtzFFi/1E1udxFxOq5JYAI:1B+TkgZCV9zf8d7JI
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language att.exe