6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27

Sharing

Copy URL

Twitter E-mail

General

Target

Oneclick-main.zip
Size

1.7MB
Sample

250121-xl1b6sxjez
MD5

b5284dfa8dda5391cb11c1d428ee403a
SHA1

b6a89f9718ae3a894aaf03ffefbfc9c57af721aa
SHA256

6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27
SHA512

c86c92ccad1f112fb0dee768e529bc7a92326574c70626641d4eb2b29cc7b5108407cb728ce62f0b5975b47fbc03e36799ec89780460db76f5424db7ad44d7ff
SSDEEP

24576:hFuTk2CVpuhzK+paNNH2lTnEBvq/JXT/G7agj0HRm7FGYgyKZdyxBh5hOY3i/TwN:hF72Wd+TEZwpi26IRu6yKnyxBFOV/T3C

Score

10^/10

Malware Config

Targets

- Target
  
  Oneclick-main.zip
- Size
  
  1.7MB
- MD5
  
  b5284dfa8dda5391cb11c1d428ee403a
- SHA1
  
  b6a89f9718ae3a894aaf03ffefbfc9c57af721aa
- SHA256
  
  6740d0ca97c88527b23da8c7f6e03066f9c529d0a2e8ff88ddbfed5f0fd34b27
- SHA512
  
  c86c92ccad1f112fb0dee768e529bc7a92326574c70626641d4eb2b29cc7b5108407cb728ce62f0b5975b47fbc03e36799ec89780460db76f5424db7ad44d7ff
- SSDEEP
  
  24576:hFuTk2CVpuhzK+paNNH2lTnEBvq/JXT/G7agj0HRm7FGYgyKZdyxBh5hOY3i/TwN:hF72Wd+TEZwpi26IRu6yKnyxBFOV/T3C
Score

1^/10
behavioral1 behavioral2
- Target
  
  Oneclick-main/Downloads/AMD.bat
- Size
  
  364B
- MD5
  
  4f432879f0b02c48301741a208cd1309
- SHA1
  
  12f08180a3e9479e3ede245aa7904b1c85a61d37
- SHA256
  
  0617bbd07889ed453dffaf7ccefd7bbf1f092ca6dcb1d9d354efab231f8d385f
- SHA512
  
  9971d9076b038cd453e70b90cd408802a7ca4279ce1fc01395dcd9a341bca3d21b7d37491a1525935456816a20aba889586c6594da2bdcb44bba601627e1eedf
Score

1^/10
behavioral3 behavioral4
- Target
  
  OneclickTools/Amd/AMD.bat
- Size
  
  364B
- MD5
  
  4f432879f0b02c48301741a208cd1309
- SHA1
  
  12f08180a3e9479e3ede245aa7904b1c85a61d37
- SHA256
  
  0617bbd07889ed453dffaf7ccefd7bbf1f092ca6dcb1d9d354efab231f8d385f
- SHA512
  
  9971d9076b038cd453e70b90cd408802a7ca4279ce1fc01395dcd9a341bca3d21b7d37491a1525935456816a20aba889586c6594da2bdcb44bba601627e1eedf
Score

1^/10
behavioral5 behavioral6
- Target
  
  OneclickTools/DPC Checker/dpclat.exe
- Size
  
  299KB
- MD5
  
  b3849adedca497a29e4b1a13f6851d45
- SHA1
  
  38438d73c378fd410d8d51ee954231f73ce9aa1d
- SHA256
  
  00a7c7b88877bf59dbaa70de734fcd3f287f1eb92caff4571a4c8e67a5dc0aca
- SHA512
  
  9fd6df7f1173bf8258f54d9153505dc648dd7a8b99e4c995ebb37965795d8467dd560beff035c2d33d0a047a43c280b4fa22e7fee019767e9190453c7769a425
- SSDEEP
  
  3072:/3epwRoNb3H6oy98nu6zp+4uhv9UKBLk4TZKVLIh0MRtcwuKohGjBf8i3Jn:/8eso8FnqSKB1K07Y2eun
Score

8^/10

discovery
- Drops file in Drivers directory
behavioral7 behavioral8
- Target
  
  OneclickTools/Dcontrol/dControl.exe
- Size
  
  447KB
- MD5
  
  58008524a6473bdf86c1040a9a9e39c3
- SHA1
  
  cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA256
  
  1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- SHA512
  
  8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP
  
  6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
Score

10^/10

discovery upx defense_evasion evasion trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies security service
  defense_evasion
- Windows security modification
  defense_evasion trojan
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  
  OneclickTools/NSudo/NSudoLG.exe
- Size
  
  174KB
- MD5
  
  423129ddb24fb923f35b2dd5787b13dd
- SHA1
  
  575e57080f33fa87a8d37953e973d20f5ad80cfd
- SHA256
  
  5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
- SHA512
  
  d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
- SSDEEP
  
  3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
Score

1^/10
behavioral11 behavioral12
- Target
  
  OneclickTools/OOshutup10/OOSU10.exe
- Size
  
  1.9MB
- MD5
  
  4803e06db91fdb8b6d1b65c0010d2f87
- SHA1
  
  f6d68a7dcc9c46e663f586341e8ba8d1be6b0f9c
- SHA256
  
  beb7becc38ccc7ed37c47fe607b25a966a5f71aabd36ab945c3cba15451dfa7b
- SHA512
  
  f34195e4dd2b9a0dc4847e94547b3b4f0ee13009878f0e88954e6a070234b902814a7bdc018782cbaddb52e31e19f30bc2273d1b2ed1071f0695563e070c58c6
- SSDEEP
  
  49152:zE6D5EyNuGVUJEJTJxJROfOrV3rukAanKZCWumEjlGLsmt8MR+zh:TykAWKZCfmMMR+l
Score

1^/10
behavioral13 behavioral14
- Target
  
  OneclickTools/Orca/Orca.bat
- Size
  
  3KB
- MD5
  
  3f9804cf3854d5c1e336870a487cb8c7
- SHA1
  
  ffa2298677dd21d93526ed39425d269a3ca5638d
- SHA256
  
  cffdb0f5c379fa9e714befd6028a5bd56e69751f1edd21d35858569d85937f2d
- SHA512
  
  469a716264bfd0db2ef7862b95f26438a1ae934d5fb17fb6648ddd2ac46c9a46a05303d3471f6fe9a875b8c010478fec34fcb11a0494b40f3f9a28229577cf6c
Score

1^/10
behavioral15 behavioral16
- Target
  
  OneclickTools/Sound/Sound.bat
- Size
  
  1KB
- MD5
  
  aa79a42a515c7013ee6d746bc2033af8
- SHA1
  
  f703e84f64c5d8061f2aea7f636e57576b5bb2c6
- SHA256
  
  9989b6443318155275d5e8011e6395f57a9723444f06c7de78ad1a07a8049c6e
- SHA512
  
  4bcf14e930fa090d0efbad5416ea48bcdb162ddef00baf9433186736a238c3e1ff28c1fc8447a4749af2413856dd597257dbed3f7b80340d1ff0a63144c90e43
Score

4^/10
behavioral17 behavioral18
- Target
  
  OneclickTools/Timer Resolution/SetTimerResolution.exe
- Size
  
  137KB
- MD5
  
  29446c868a831614e6304dbc4159fa41
- SHA1
  
  3ce2b1e65ac65736c637bdbf6f9bfd642a54729b
- SHA256
  
  62418c793aca2d4eb5413aea702884cfec5048d27cb5d18fc1b3b029766c80bf
- SHA512
  
  b7b3e8f3d672e107fee23ad41f51c1fef7717487db82bf7e47534f2ab48615502b30ebf1788dc0c71b21caf1d908edf6561ec3a0ee2d31b1e9060b8521973569
- SSDEEP
  
  1536:knvX69yPilkEs4mVs588WHGF3jmVUukpT+RuoDgcTlbbJcQDEqnOU6gl0:knF6ls4Us588WHGFT/T+tM4VCU1y
Score

1^/10
behavioral19 behavioral20
- Target
  
  Oneclick-main/Downloads/OpenShellTheme.xml
- Size
  
  1KB
- MD5
  
  eb7ea67ba6153d37282b8558780c0ca6
- SHA1
  
  352f11a44041e29f673153c93ac61097e8862080
- SHA256
  
  0746b463c94a10b4008361e1fb57f647296d4b51b91fb893665829a7135bf244
- SHA512
  
  53bc748ab9da90825bc255617fc3586252ee7a2e219e51909a2b927c6da9393d4b162bb31909a86ef344a44cc685f26eb5c8b5844efa885ebb6f2221ebdef8e9
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  Oneclick-main/Downloads/Orca.bat
- Size
  
  3KB
- MD5
  
  3f9804cf3854d5c1e336870a487cb8c7
- SHA1
  
  ffa2298677dd21d93526ed39425d269a3ca5638d
- SHA256
  
  cffdb0f5c379fa9e714befd6028a5bd56e69751f1edd21d35858569d85937f2d
- SHA512
  
  469a716264bfd0db2ef7862b95f26438a1ae934d5fb17fb6648ddd2ac46c9a46a05303d3471f6fe9a875b8c010478fec34fcb11a0494b40f3f9a28229577cf6c
Score

1^/10
behavioral23 behavioral24
- Target
  
  Oneclick-main/Downloads/Sound.bat
- Size
  
  1KB
- MD5
  
  aa79a42a515c7013ee6d746bc2033af8
- SHA1
  
  f703e84f64c5d8061f2aea7f636e57576b5bb2c6
- SHA256
  
  9989b6443318155275d5e8011e6395f57a9723444f06c7de78ad1a07a8049c6e
- SHA512
  
  4bcf14e930fa090d0efbad5416ea48bcdb162ddef00baf9433186736a238c3e1ff28c1fc8447a4749af2413856dd597257dbed3f7b80340d1ff0a63144c90e43
Score

4^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Modifies Windows Defender DisableAntiSpyware settings

Modifies security service

Windows security modification

AutoIT Executable

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26