Overview

overview

10

Static

static

10

uploaded/0...de.exe

windows10-2004-x64

7

uploaded/0...03.exe

windows10-2004-x64

7

uploaded/0...74.exe

windows10-2004-x64

5

uploaded/1.exe

windows10-2004-x64

6

uploaded/123.exe

windows10-2004-x64

10

uploaded/1...f7.exe

windows10-2004-x64

5

uploaded/1...7b.exe

windows10-2004-x64

6

uploaded/1...1e.exe

windows10-2004-x64

1

Archivo_20...87.doc

windows10-2004-x64

10

Refusal-21...1.xlsm

windows10-2004-x64

10

uploaded/222.exe

windows10-2004-x64

10

uploaded/2...29.doc

windows10-2004-x64

10

uploaded/2...34.exe

windows10-2004-x64

3

uploaded/2...47.exe

windows10-2004-x64

7

uploaded/2...b2.exe

windows10-2004-x64

5

uploaded/3...92.exe

windows10-2004-x64

3

uploaded/3...a4.exe

windows10-2004-x64

8

uploaded/3...02.exe

windows10-2004-x64

5

uploaded/4...41.exe

windows10-2004-x64

7

uploaded/5...38.exe

windows10-2004-x64

6

uploaded/6...08.xls

windows10-2004-x64

10

uploaded/6...bb.exe

windows10-2004-x64

5

uploaded/7...77.exe

windows10-2004-x64

7

uploaded/7...4d.exe

windows10-2004-x64

7

uploaded/8...46.exe

windows10-2004-x64

5

uploaded/8...e0.exe

windows10-2004-x64

7

uploaded/8...70.exe

windows10-2004-x64

7

uploaded/8...33.exe

windows10-2004-x64

3

uploaded/9...ty.exe

windows10-2004-x64

3

uploaded/9...5z.exe

windows10-2004-x64

8

uploaded/A...-K.exe

windows10-2004-x64

6

uploaded/A....0.exe

windows10-2004-x64

7

Resubmissions

02/06/2025, 23:08

250602-24hx3aek6z

02/06/2025, 22:44

250602-2pacdabk2110

Sharing

Copy URL Twitter E-mail

General

  • Target
    250602-2hkjrsymt2.bin
  • Size 466.8MB
  • Sample250602-2pacdabk21
  • SHA256 bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratdarkcometmodiloadernanocoreneshtaorcusumbralxwormdefaultemvlatestnewnoob nonameroblox script injectoraspackv2bootkitdefense_evasiondiscoveryexecutionmacromacro_on_actionpersistenceratspywarestealerupx

Malware Config

Extracted

Family

  • orcus

C2

  • 192.168.171.129:10134

  • pont9245.ddns.net:7777

  • 147.185.221.16:18244

  • hostip00.duckdns.org:10134

  • 91.218.65.24:10134

  • s7vety-27063.portmap.host:27063

  • kissmyasshole.myddns.me:1012

Mutex

  • 186d21ec80e143edb3384fa80d4ee7f8

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Extracted

Family

  • orcus

Botnet

  • Roblox script injector

C2

  • youcantfindmelol.ddns.net:10134

Mutex

  • de0e17d469cc46849280a8cd4d643763

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Java\Java.exe

  • reconnect_delay

    10000

  • registry_keyname

    Java

  • taskscheduler_taskname

    Java Updater

  • watchdog_path

    Temp\Java Updater.exe

Extracted

Family

  • orcus

Botnet

  • NEW

C2

  • 122.186.23.243:10134

Mutex

  • c7798e5973374c92859ce651077d0576

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %windir%\Desktop Window Manager.exe

  • reconnect_delay

    10000

  • registry_keyname

    Program

  • taskscheduler_taskname

    Windows

  • watchdog_path

    AppData\OrcusWatchdog.exe

Extracted

Family

  • orcus

Botnet

  • EMVLATEST

C2

  • 3.tcp.eu.ngrok.io:22028

Mutex

  • 699ea505fbd445a7924b6888db7a5f2a

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Windows Security\Microsoft Defender.exe

  • reconnect_delay

    10000

  • registry_keyname

    javaservice

  • taskscheduler_taskname

    win10service

  • watchdog_path

    AppData\javaforwin.exe

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

Botnet

  • Default

C2

  • friendlyman69.ddns.net:55042

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    lsass.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 127.0.0.1:5555

  • hostz.hopto.org:5555

  • 172.65.175.19:443

  • 127.0.0.1:7000

  • council-amp.gl.at.ply.gg:59436

  • 28.ip.gl.ply.gg:65453

Mutex

  • Nyv6QFoXtqKjtLri

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    DMA Driver.exe

aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • 90.120.50.244:2518

  • 127.0.0.1:2518

Mutex

  • 6baeca53-6eec-4a83-8679-c479f2f1a649

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-11-20T17:31:41.353489336Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    2518

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    6baeca53-6eec-4a83-8679-c479f2f1a649

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    90.120.50.244

  • primary_dns_server

    8.8.8.8

  • request_elevation

    false

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    false

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • xworm

C2

  • studies-license.gl.at.ply.gg:48057

  • dpwekwpd-58261.portmap.io:58261

  • 127.0.0.1:7000

  • 127.0.0.1:2321

  • 133.23.21.222:2321

  • 28.ip.gl.ply.gg:65453

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

aes.plain

Extracted

Family

  • umbral

C2

  • https://discord.com/api/webhooks/1367163929452613703/0Ot4VsdGUKWdMg4T-pgsrzxgFAOyvGEFGDEYD7_CrEfiWkjJTQFitsIjIZavpL8rfypz

Extracted

Family

  • orcus

Botnet

  • NOOB NONAME

C2

  • 26.223.23.213:25565

Mutex

  • 378fcdd4ef824c7db5946dd1cf8ec64f

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    Temp\OrcusWatchdog.exe

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    http://www.toteteca.com/qzkiodlofm/5555555555.jpg

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://zenithcampus.com/l/yQ/
  • exe.dropper

    http://hbprivileged.com/cgi-bin/kcggF/
  • exe.dropper

    http://localaffordableroofer.com/ralphs-receipt-f2uhf/qTT5DC/
  • exe.dropper

    https://johnhaydenwrites.com/track_url/P/
  • exe.dropper

    https://nahlasolimandesigns.com/nahla3/d/
  • exe.dropper

    https://football-eg.com/web_map/n/
  • exe.dropper

    https://vietnhabienhoa.com/wordpress/QUTy/

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://zhongsijiacheng.com/wp-content/jn5/
  • exe.dropper

    http://artistascitizen.com/wp-content/Bx3cr6/
  • exe.dropper

    http://ombchardin.com/archive/V/
  • exe.dropper

    https://apsolution.work/magneti-marelli-zkkmb/toq7Eiy/
  • exe.dropper

    https://happycheftv.com/wp-admin/z6uGcbY/
  • exe.dropper

    https://careercoachconnection.com/tenderometer/4K/
  • exe.dropper

    https://tacademicos.com/content/JbF68i/

Targets

    • Target
      uploaded/057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de.exe
    • Size 2.7MB
    • SHA256 057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1
    • Target
      uploaded/0f0d2abea57c5403fb538eef2e42d5003.exe
    • Size 409KB
    • SHA256 f7f8ca0ae4af42baa3586561ce73cea45445e439eec867091704a696de334e96
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral2
    • Target
      uploaded/0fec46875e62cf4c572c4cc4cc7e84374.exe
    • Size 73KB
    • SHA256 d423b582ccf801825bf5a60d1c0a0ffdf5b06704507f327873d4790029753ffe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3
    • Target
      uploaded/1.exe
    • Size 913KB
    • SHA256 6b4adc3f05b6f7968d826b26b6a472ad3906a5b659eae167bd3a922415c6133d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Drops desktop.ini file(s)

    behavioral4
    • Target
      uploaded/123.exe
    • Size 903KB
    • SHA256 94ad5e95fc0167221e93b241d4890649158fb8a59272d9e96ad741d3b7e51fff
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    behavioral5
    • Target
      uploaded/1546d38e814b5348b877ade61fa7cc0f7.exe
    • Size 73KB
    • SHA256 ba06a9df44bb8d2439f9ec8ef3cf7ab8349abdc9dc60593f5718785ceb4e7e76
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral6
    • Target
      uploaded/1812b1b80810a47d68157ec25c3a44e7b.exe
    • Size 124KB
    • SHA256 790353165b689048a77a6aa76010b561db500d85e3d3509b1ce869204129de49
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitdiscoverypersistenceupx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7
    • Target
      uploaded/19a972ce0137c326e9a800096bc442276468096ad02c6dec2aba37564d0e441e.exe
    • Size 1.9MB
    • SHA256 19a972ce0137c326e9a800096bc442276468096ad02c6dec2aba37564d0e441e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      Archivo_2001_2021_49-381887.doc
    • Size 158KB
    • SHA256 89680559595f62f12bfdd9338c525133244ea6b7f23bb9b5b798ce04232817f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral9
    • Target
      Refusal-217432546-01212021.xlsm
    • Size 25KB
    • SHA256 70a5d9ef163f6e6c7e32c366363d7d4e9a6cbb06df84802edd177acb907fe092
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10
    • Target
      uploaded/222.exe
    • Size 907KB
    • SHA256 b2f324d6ae851aa65773d233201d58ac5230d525281afd1775e0b82514ac9645
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    behavioral11
    • Target
      uploaded/2531 2212 2020 QG-826729.doc
    • Size 213KB
    • SHA256 3a15b42c4692483aedb912298719b52e5513cf3d2a58ffca07c78fa8c48b536c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral12
    • Target
      uploaded/25f2c4054d0680fd51f2cf860055f2234.exe
    • Size 162KB
    • SHA256 b3fb1ae7923313ad51ec2101c28fd1f1417cc987f33272227fdc1745c5e5261b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral13
    • Target
      uploaded/2bb792ea1927ddd3a5a245eaf96c06ca2598191f670750c24d5b9ed47f20e147.exe
    • Size 9.8MB
    • SHA256 2bb792ea1927ddd3a5a245eaf96c06ca2598191f670750c24d5b9ed47f20e147
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral14
    • Target
      uploaded/2e5473aa5ebf01ac5ce00c7ad537ddcb2.exe
    • Size 73KB
    • SHA256 43e54d4e4f485f789739694024b6136f5e5215172555a846608abc8f5386c19a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15
    • Target
      uploaded/387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092.exe
    • Size 144KB
    • SHA256 387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral16
    • Target
      uploaded/3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4.exe
    • Size 11.8MB
    • SHA256 3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral17
    • Target
      uploaded/3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002.exe
    • Size 1.4MB
    • SHA256 3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral18
    • Target
      uploaded/4c6265723661653d2fdab12a0d5d7e841.exe
    • Size 409KB
    • SHA256 8e0bf3262f19da58a5e045c85d918e4a35b873dc1ac3a8c26dc7aa2fa07b59de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19
    • Target
      uploaded/5b518173a571366bfdce5cdd282738a38.exe
    • Size 124KB
    • SHA256 fa2e2163cadd8dfefa97026e2f8c53540c436f05c7a0c60d25fec0025d39bf65
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitdiscoverypersistenceupx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral20
    • Target
      uploaded/6a4af3ace8066e79a1020e27b2c1cc3f81d6cd8d68d1329e67b93e44b9d3d008.xls
    • Size 173KB
    • SHA256 6a4af3ace8066e79a1020e27b2c1cc3f81d6cd8d68d1329e67b93e44b9d3d008
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral21
    • Target
      uploaded/6fecc453c515bb03d82132650d3d4c6bb.exe
    • Size 73KB
    • SHA256 89a22cb4f3cd4a8d122bf5198642cd5ddfc8fcab309e6b0ee284a8d679da6aaa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral22
    • Target
      uploaded/70730f33f4db9f15399c6e4a510a5c4eec3bf100206535155001a2b3adbb3077.exe
    • Size 9.1MB
    • SHA256 70730f33f4db9f15399c6e4a510a5c4eec3bf100206535155001a2b3adbb3077
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral23
    • Target
      uploaded/70e835f3140dc2fbc211273727a8a8b4d.exe
    • Size 489KB
    • SHA256 aae4696fa35c74a7aa3e9b75ae37d4ffa9a81f64bf647c801252f3abb29c21d8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral24
    • Target
      uploaded/83682a6a473ca2135d14cbc52c584fb46.exe
    • Size 73KB
    • SHA256 6d37a9d452090fd4ff8fccff8242473ffc4c7a90946faab6f31e06c5d725f5e5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25
    • Target
      uploaded/882f4c1313d37351d72004caa3ef1aee0.exe
    • Size 409KB
    • SHA256 c164cd72d5927e12bbfa5946b3f9526e27bfe37b1d57fc595c3eb3e94c40b395
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral26
    • Target
      uploaded/8e751b8765f733f3f7682fd1247a27a70.exe
    • Size 489KB
    • SHA256 aa169fb465a49976694ffa3d8795d73dab23bc3e11209ddc70aa07577e675d4b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral27
    • Target
      uploaded/8f6b416bb42a3f168bf083c67687bd533.exe
    • Size 162KB
    • SHA256 12087c047dbf2d70e90611276bcb454052ab21643806d90ef2873fd050a97759
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral28
    • Target
      uploaded/93h9j2xi5z-safety.exe
    • Size 191KB
    • SHA256 08cfd565e6c1b0df6b97b2f0d4a1db78726d3fee08409d05fc628aeb7218a8df
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral29
    • Target
      uploaded/93h9j2xi5z.exe
    • Size 195KB
    • SHA256 043d231d940ab029f8325d828de3b02c13db7df44cbbe4f062068296e2e193a5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    bootkitdefense_evasiondiscoverypersistence

    • Disables RegEdit via registry modification

      defense_evasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral30
    • Target
      uploaded/AC27_Build3001-UP7-K.exe
    • Size 764KB
    • SHA256 e1c91d5cf10150965a98834642fd7c3cefb83cbb8a30e6edcb409641d0da46f3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral31
    • Target
      uploaded/ATR Tool 2.0.exe
    • Size 2.5MB
    • SHA256 239a024acf03ff8106556ffd3784b9142c6d51611634a035505da705c725987b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

upxmacromacro_on_actionroblox script injectornewemvlatestratdefaultaspackv2noob nonameorcusasyncratneshtadarkcometmodiloaderxwormnanocoreumbral
Score
10/10

behavioral1

discoverypersistence
Score
7/10

behavioral2

discoverypersistenceupx
Score
7/10

behavioral3

discoveryupx
Score
5/10

behavioral4

Score
6/10

behavioral5

orcusdiscoveryratspywarestealer
Score
10/10

behavioral6

discoveryupx
Score
5/10

behavioral7

bootkitdiscoverypersistenceupx
Score
6/10

behavioral8

Score
1/10

behavioral9

execution
Score
10/10

behavioral10

Score
10/10

behavioral11

orcusdiscoveryratspywarestealer
Score
10/10

behavioral12

execution
Score
10/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
7/10

behavioral15

discoveryupx
Score
5/10

behavioral16

discovery
Score
3/10

behavioral17

execution
Score
8/10

behavioral18

discovery
Score
5/10

behavioral19

discoverypersistenceupx
Score
7/10

behavioral20

bootkitdiscoverypersistenceupx
Score
6/10

behavioral21

execution
Score
10/10

behavioral22

discoveryupx
Score
5/10

behavioral23

discovery
Score
7/10

behavioral24

discoverypersistenceupx
Score
7/10

behavioral25

discoveryupx
Score
5/10

behavioral26

discoverypersistenceupx
Score
7/10

behavioral27

discoverypersistenceupx
Score
7/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

bootkitdefense_evasiondiscoverypersistence
Score
8/10

behavioral31

discovery
Score
6/10

behavioral32

discovery
Score
7/10