Overview

overview

10

Static

static

10

Malware-1-...30.exe

windows11-21h2-x64

10

Malware-1-...40.exe

windows11-21h2-x64

10

Malware-1-...32.exe

windows11-21h2-x64

10

Malware-1-.../5.exe

windows11-21h2-x64

10

Malware-1-...91.exe

windows11-21h2-x64

10

Malware-1-...ey.exe

windows11-21h2-x64

7

Malware-1-...ad.exe

windows11-21h2-x64

3

Malware-1-...ti.exe

windows11-21h2-x64

5

Malware-1-...an.bat

windows11-21h2-x64

7

Malware-1-...an.exe

windows11-21h2-x64

4

Malware-1-...ve.bat

windows11-21h2-x64

7

Malware-1-...ve.exe

windows11-21h2-x64

6

Malware-1-...ya.exe

windows11-21h2-x64

Malware-1-...re.exe

windows11-21h2-x64

10

Malware-1-...ry.exe

windows11-21h2-x64

10

Malware-1-...ck.exe

windows11-21h2-x64

3

Malware-1-...he.exe

windows11-21h2-x64

10

Malware-1-...op.exe

windows11-21h2-x64

7

Malware-1-...rb.exe

windows11-21h2-x64

10

Malware-1-...ue.exe

windows11-21h2-x64

1

Malware-1-...ng.exe

windows11-21h2-x64

6

Malware-1-...kt.bat

windows11-21h2-x64

7

Malware-1-...o3.exe

windows11-21h2-x64

10

Malware-1-...ey.exe

windows11-21h2-x64

10

Malware-1-.../m.exe

windows11-21h2-x64

Malware-1-...o3.exe

windows11-21h2-x64

9

Malware-1-...32.exe

windows11-21h2-x64

10

Malware-1-...nf.exe

windows11-21h2-x64

10

Malware-1-.../o.exe

windows11-21h2-x64

3

Malware-1-...B8.exe

windows11-21h2-x64

3

Malware-1-...ic.exe

windows11-21h2-x64

3

Malware-1-...in.exe

windows11-21h2-x64

10

Resubmissions

24/09/2026, 04:14

260924-etscesdg78

12/03/2026, 23:34

260312-3kx4baet7z

03/02/2026, 02:33

260203-c1632sgw6a

06/12/2025, 00:29

251206-as4lvaar3y10

02/12/2025, 16:40

251202-t6s7tavmgx10

02/12/2025, 16:34

251202-t29n1avme110

02/12/2025, 15:52

251202-tbkbesgx7g10

01/12/2025, 15:35

251201-s1m8yabs6f10

14/11/2025, 18:45

251114-xd9kwafp9z

03/11/2025, 07:54

251103-jry5eazjhq10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Malware-1-master.zip
  • Size 45.4MB
  • Sample251028-vkjxpaxrap
  • SHA256 2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
azorultdarkcometemotetgandcrabimminentpetyatrickbotwannacryxmrigguest16sun10adwarebackdoorbankerbootkitcredential_accessdefense_evasiondiscoveryexecutionimpactinfostealerminerpersistenceransomwareratspywarestealertrojanupxvmprotectworm

Malware Config

Extracted

Family

  • darkcomet

Botnet

  • Guest16

C2

  • bibl1234.ddns.net:1604

  • pizdash.ddns.net:1604

Mutex

  • DC_MUTEX-QKPH38W

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    2PaBrGj3TwxK

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

rc4.plain

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Extracted

Path

  • F:\$RECYCLE.BIN\S-1-5-21-1912098173-3310702793-1420386224-1000\ODUHLT-DECRYPT.txt

Ransom Note
  • ---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ODUHLT The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/a01222e98fbf6ad8 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEodc3ppTwrZbMglojTbraEML2qNQeqyQ86OHcY3WCkDm+Ec55QqqG0sXw6Cu4eRBRFfeByZd5hdQPlubLx+wn8nhptvjlIEh2Q8Q08mfrv1hYBAMRJcUuPa7FlkxHmTE/+uozo/SunuxEF4genr+3hZUhy3hz9/+cIrAmoL+5h/WFBtHpKpHgZ/xBitj7E6vwwr9TsaaQQhBOQOs7lvespzvRE6RUvP84cu6sL2U239Pcqh8mkjmUjCr6YFoXttY2Jk7g1YuyHZ2HMYH+AIlZ/w/vkij52RupjEIBECqR1X2g3iou+LVbxbIEnFEo+wyrjPfdYd0yu2PuEh06JbISKo6CQa/u8lG/TmAWne7GMuynFzRgDbu1H3gqARQlmm7TojQYglE4yjVPQPA4J9i4EHf7X7UMhQvT5p1O3v3JPZTEGABAI8AI9WNTb2qvjNLNNlz3sUoEI2+AG/+inpEbSXCLIT4Zo4gB7f99HjfUToR+kqXbAMWgLswHGvATdPX+S6oE89ANJmz7LYCWF525oWXI4D8E3/nNKFNCUXrjoR+cS/4yRBUpVUmSy9haDsK+bAmeh/GuzSC/WpSyrZCu5bJAmGPR/CoqQlWC4L+9V+hTa/N49o9LE/QTVfwJOeg1bWl/VfglitTdf+3oI2kbJrSXUn3Ev0fQljJj/LPQ4qVeDrySej67a7BQcDkf44P3Cg2v7lwZYfnLH7OgO4V3anG5uP1kpfg1Onw4W6j67FP9pFu6ADPB2UU7LLUmD2IWNbBEeSLVpyVzzoSB3+isOwSRn3LKfuzKqy15kFKO2oam/vxofXmHkb9rtPv3BihqODp1hJjjsm4deeNSEQNTYy26n3BGTZyYRYYejnNd0GZMV7M/ve67SVfHv0rT9JKqQ1blmPRzDB241/RIVp07VUF6UjKTTijSvpakAY+4uJWg5OBpRTGk2K/QcmAmkVh1lcp8E6aoIH9V2Hs0JLrglD3qt4DIDoRR4Vk39W59FMYbDTq9Dix4yIb7qPlB+SSgLkEak3KSK+WU9ybJmYbZZz5UxA8/2aiqSq++ax/j5Ae3mryXkeEahmZvbtXNULqyOX+wgfKaxWzqFkhlpwrK9F3yATfn0kApSlMHAhMwNJvCsBxJdvwI3Re5yI7Zmlg67JlsmcLK7RZIrd+58AcSeoBwSYnp71jsml+BEtIY3bW6BwuNXRNeUxHU9qSDRBT9i9zdF2Z0eDD7hRzjvnIERcLUfPQFUceolHXO0AlYPl7gaIZbgp1TNPg5KDeR8/0okl7a46VhXasF+VyOrMMYpNgLmMbndO80HmJ/lBw3bh0IjK5hSmjrY4aIhcr5Fc/brJTzdvEWy9ZcMR/oLi3lFLNw+LtUVU/frHx6bYTC1y15BM8lo8sfq1fGpv//ZkEZge28oCYY8/+ZQ1vx0BgN2e36NFXTBy8J2cMqGZ/fI6I+KjaS1222V58bFt1/dXsWvMCisIIR0ZEiDZ8KIWdwQh51U++ik9Ii4DVuWA3qlqvfKFsEgaPJjHQbipMHQrVm7hlB/4l9d0W3e0NUqaqJvggUgRO66yOFK6r/yACPd/zibmq3zXrg4Od+vR6DN+mw8hBKQxFrcuO6KaQSPspuCoWEBBIljRyHFzMKIv8PGVNgRPeBZLU+CftUSbD/xenPLlMEkollik5U1E5WrgdpnlCbj6nI/cLdolVIXG2i4ws1AdyOnFMEnibHIxEz9snTn8dqy1Yu8dfloDKve1BIQMBzN3nPSvLSSUsZobWW3kApK52+czZ5PzJ4KyWMYG2Z6DgU4sA1jH+7UdHMeZQD7Bqyg3/q8gFbfbKAzCTECdSNBebvFVEliwj9Ypar3j+nwZ11IJfSNvSaCF0dZiy4Iwwx4FX659E07Tn0NAq6h6h3hZ6WKF2510YH42W/Lu37MmgaonxDzSSKjnYw79BVq7Qhtfp5c8r1xU2mJToEaMPUhmO2EMfB/OXXv0E6gMHJbtfFnhxh4JMt/k1jSpq3amYk/ipcpj808P0T+FSxgcnngDFK7LPusPLLBFLnfA54TMBWs63KC67tzqggqLpwpq+AbGYWuNTndbv2AJygwCNxRwXJmRaUaF4fstv7RgoLKaOHsVusETSqAe7DSitQoL/biein+4aAFQLSToi8h8NjjHUaUnQsXh1rLyCHf96pDywmIxKVGxdRIJl1AGvqUnX5HY1OxVc7T3+FHzjsM6OKrtZWxrlWhlFKFY4YPC9LRdW24= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZUTp9RqHYN7mFWo7fWTHGHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBseKk/2c2E+skGtlYOVqKBi/t+xGEEY8bpydD4o24M6b3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFM3vTLNOas1w8ZOHQVRlOKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOdb/HRc8P54k7V/HuibORzJL9NXYCh8sz7uxeRbttC/+YbnzW5+JOXs5ePtQu9FxhOlLD2rpghGmLLQQz3Qtdfjj5QGFTiWwEn7JfT+zb ---END PC DATA---
URLs

  • http://gandcrabmfe6mnef.onion/a01222e98fbf6ad8

Extracted

Family

  • azorult

C2

  • http://216.170.114.4/send/the/index.php

Extracted

Family

  • trickbot

Version

  • 1000312

Botnet

  • sun10

C2

  • 82.202.212.172:443

  • 24.247.181.155:449

  • 24.247.182.39:449

  • 109.234.38.220:443

  • 24.247.182.29:449

  • 24.247.182.7:449

  • 71.14.129.8:449

  • 198.46.131.164:443

  • 74.132.135.120:449

  • 198.46.160.217:443

  • 71.94.101.25:443

  • 206.130.141.255:449

  • 192.3.52.107:443

  • 74.140.160.33:449

  • 65.31.241.133:449

  • 140.190.54.187:449

  • 24.247.181.226:449

  • 108.160.196.130:449

  • 23.94.187.116:443

  • 103.110.91.118:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      Malware-1-master/2530.exe
    • Size 1.2MB
    • SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Drops file in System32 directory

    behavioral1
    • Target
      Malware-1-master/2887140.exe
    • Size 144KB
    • SHA256 dfaf75da62d0561d171217fe893bd818a72ebfccd9d7e7f4c046f5b3ca44794e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan
    behavioral2
    • Target
      Malware-1-master/32.exe
    • Size 1.2MB
    • SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Drops file in System32 directory

    behavioral3
    • Target
      Malware-1-master/5.exe
    • Size 312KB
    • SHA256 66ae33003289d8c6c3dc7c45c1b01110b4820281061292ac076b1783700a1f2d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan
    behavioral4
    • Target
      Malware-1-master/96591.exe
    • Size 1.2MB
    • SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdiscoveryemotettrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Drops file in System32 directory

    behavioral5
    • Target
      Malware-1-master/Amadey.exe
    • Size 49KB
    • SHA256 7fd898dde3a7ed047657e3dc81c3de50ed381857edc53744664332fd98476c54
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    defense_evasiondiscovery

    • Executes dropped EXE

    behavioral6
    • Target
      Malware-1-master/Download.exe
    • Size 247KB
    • SHA256 de2274da8cf00dfc6e6e52db43f82210a1fb7fd30016ebdc81347fb2d1f248fa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7
    • Target
      Malware-1-master/Illuminati.exe
    • Size 1.1MB
    • SHA256 f99e4c9a4dd14d402b16e36988b72f3fe7f34b42157f756dbd14b39c70059336
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral8
    • Target
      Malware-1-master/MEMZ-Clean.bat
    • Size 9KB
    • SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryexecution

    • Executes dropped EXE

    behavioral9
    • Target
      Malware-1-master/MEMZ-Clean.exe
    • Size 12KB
    • SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral10
    • Target
      Malware-1-master/MEMZ-Destructive.bat
    • Size 13KB
    • SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitdiscoveryexecutionpersistence

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral11
    • Target
      Malware-1-master/MEMZ-Destructive.exe
    • Size 14KB
    • SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitdiscoverypersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral12
    • Target
      Malware-1-master/Petya.exe
    • Size 225KB
    • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bootkitpetyapersistenceransomware

    • Detects Petya Ransomware

      ransomware

    • Petya

      Petya is a ransomware written in C#.

      ransomwarepetya

    • Petya family

      petya

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral13
    • Target
      Malware-1-master/Software.exe
    • Size 1.6MB
    • SHA256 e7f04e85236f0caafe518bd96369313021969077dba1c4a6d42e694498dab04f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryimminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Imminent family

      imminent

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral14
    • Target
      Malware-1-master/WannaCry.EXE
    • Size 3.4MB
    • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Sets desktop wallpaper using registry

      ransomware
    behavioral15
    • Target
      Malware-1-master/Win32.EvilClusterFuck.exe
    • Size 64KB
    • SHA256 c9b98408ca67d08e1986d1855c4d99944caad5580533d18496cd8de86dd0885f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral16
    • Target
      Malware-1-master/apache.exe
    • Size 252KB
    • SHA256 1117f585985ca4ddd03695876522f80951c919cb41db5854f013923f62285c09
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guest16defense_evasiondiscoverydarkcometpersistencerattrojanupx
    behavioral17
    • Target
      Malware-1-master/butterflyondesktop.exe
    • Size 2.8MB
    • SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral18
    • Target
      Malware-1-master/crb.exe
    • Size 139KB
    • SHA256 4b5fe7497864d07f78af15fa3e1aa3702b303b89f9644624871d83dd0f484749
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    backdoorcredential_accessdefense_evasiondiscoveryexecutiongandcrabimpactransomwarespywarestealertrojan

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (282) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral19
    • Target
      Malware-1-master/eternalblue.exe
    • Size 886KB
    • SHA256 7f5f447fe870449a8245e7abc19b9f4071095e02813d5f42c622add56da15b8b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral20
    • Target
      Malware-1-master/fear.png.exe
    • Size 66KB
    • SHA256 101678f77a65b5b5830a128e4c737b2aaaea5be95327ec68213ebb92e4251170
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Legitimate hosting services abused for malware hosting/C2

    behavioral21
    • Target
      Malware-1-master/getr3kt.bat
    • Size 13KB
    • SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    adwarebootkitdiscoveryexecutionpersistencespyware

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral22
    • Target
      Malware-1-master/iimo3.exe
    • Size 1.7MB
    • SHA256 5ac017285572c24fc8b77324a52ca484e83c3622c61bea80a74a6850f0a16061
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverytrojan

    • UAC bypass

      defense_evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral23
    • Target
      Malware-1-master/jey.exe
    • Size 744KB
    • SHA256 97cd04af9acddab58cffa58c677d7645f5d894769d76539f44380b9175a67bd4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryazorultinfostealertrojan
    behavioral24
    • Target
      Malware-1-master/m.exe
    • Size 1.3MB
    • SHA256 9ca85dc8b2ff574f775ddc92a45e48a74323c79e8fb2458413decd53cdf47aa6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25
    • Target
      Malware-1-master/mo3.exe
    • Size 1.9MB
    • SHA256 ff4e859d5fa6d8dea84aba8c9c0ccbc58f86be198e4a569f19f60c7844dd4edd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscovery

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral26
    • Target
      Malware-1-master/mo332.exe
    • Size 14.0MB
    • SHA256 f5d20a2ef757dd374b1651a955a80113b33b87578e3484fd3589565d296d55cc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistencetrojan

    • UAC bypass

      defense_evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral27
    • Target
      Malware-1-master/mysqlconf.exe
    • Size 252KB
    • SHA256 cc02e9684f8e78227a2ec631172d32fbb48a4fc2a60fd91d160d2ef5e11c587b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guest16defense_evasiondiscoverydarkcometpersistencerattrojanupx
    behavioral28
    • Target
      Malware-1-master/o.exe
    • Size 110KB
    • SHA256 47b306c80cf27a773d252757397fe9ec0a9571666044276166ede5b5958489ff
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral29
    • Target
      Malware-1-master/qOA7iZJcoB8.exe
    • Size 400KB
    • SHA256 6b111be3c180de78849b4f1c2d39ee0045695e22d339b50879a769351b1e6b31
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral30
    • Target
      Malware-1-master/wintonic.exe
    • Size 1.6MB
    • SHA256 a0375c241cebcf6c4a0293f45a5dc0ce1150fe8169ea410c818af67e6f487b4c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral31
    • Target
      Malware-1-master/youwin.exe
    • Size 379KB
    • SHA256 dfe2c886d9a6e9b26cdddba621fda00832a59def9813177863723e33c8011b0c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankersun10discoverytrickbotpersistencetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot family

      trickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

3
T1562.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

12
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

9
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks

static1

upxguest16minervmprotectdarkcometxmrig
Score
10/10

behavioral1

bankerdiscoveryemotettrojan
Score
10/10

behavioral2

bankerdiscoveryemotettrojan
Score
10/10

behavioral3

bankerdiscoveryemotettrojan
Score
10/10

behavioral4

bankerdiscoveryemotettrojan
Score
10/10

behavioral5

bankerdiscoveryemotettrojan
Score
10/10

behavioral6

defense_evasiondiscovery
Score
7/10

behavioral7

discovery
Score
3/10

behavioral8

discoveryupx
Score
5/10

behavioral9

discoveryexecution
Score
7/10

behavioral10

discovery
Score
4/10

behavioral11

bootkitdiscoveryexecutionpersistence
Score
7/10

behavioral12

bootkitdiscoverypersistence
Score
6/10

behavioral13

bootkitpetyapersistenceransomware
Score
10/10

behavioral14

discoveryimminentspywaretrojan
Score
10/10

behavioral15

defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm
Score
10/10

behavioral16

discovery
Score
3/10

behavioral17

guest16defense_evasiondiscoverydarkcometpersistencerattrojanupx
Score
10/10

behavioral18

discoverypersistence
Score
7/10

behavioral19

backdoorcredential_accessdefense_evasiondiscoveryexecutiongandcrabimpactransomwarespywarestealertrojan
Score
10/10

behavioral20

Score
1/10

behavioral21

Score
6/10

behavioral22

adwarebootkitdiscoveryexecutionpersistencespyware
Score
7/10

behavioral23

defense_evasiondiscoverytrojan
Score
10/10

behavioral24

discoveryazorultinfostealertrojan
Score
10/10

behavioral25

Score
1/10

behavioral26

defense_evasiondiscovery
Score
9/10

behavioral27

defense_evasiondiscoverypersistencetrojan
Score
10/10

behavioral28

guest16defense_evasiondiscoverydarkcometpersistencerattrojanupx
Score
10/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

bankersun10discoverytrickbotpersistencetrojan
Score
10/10