Overview

overview

10

Static

static

10

Court.Proj....1.rar

windows11-21h2-x64

7

Court Proj...ME.txt

windows11-21h2-x64

1

Court Proj...IO.exe

windows11-21h2-x64

7

Court Proj...ct.exe

windows11-21h2-x64

9

discord_to...er.pyc

windows11-21h2-x64

3

get_cookies.pyc

windows11-21h2-x64

3

misc.pyc

windows11-21h2-x64

3

passwords_grabber.pyc

windows11-21h2-x64

3

source_prepared.pyc

windows11-21h2-x64

3

Court Proj...oS.txt

windows11-21h2-x64

3

Court Proj...fo.exe

windows11-21h2-x64

3

Court Proj...ing.py

windows11-21h2-x64

3

Court Proj...ker.py

windows11-21h2-x64

3

Court Proj...ep.txt

windows11-21h2-x64

3

Court Proj...mer.py

windows11-21h2-x64

3

Court Proj...de.txt

windows11-21h2-x64

3

Court Proj...za.txt

windows11-21h2-x64

3

Court Proj...at.txt

windows11-21h2-x64

3

Court Proj...ch.txt

windows11-21h2-x64

3

Court Proj...ab.txt

windows11-21h2-x64

3

Court Proj...up.exe

windows11-21h2-x64

6

Court Proj...one.py

windows11-21h2-x64

3

Court Proj...pic.py

windows11-21h2-x64

3

Court Proj...ox.txt

windows11-21h2-x64

3

Resubmissions

01/11/2025, 17:32

251101-v4e3vaey7f10

01/11/2025, 17:25

251101-vzl1laej5y10

09/03/2025, 02:31

250309-cz3z1aw1gv

09/03/2025, 02:31

250309-czqdxaw1fy

25/12/2024, 11:40

241225-ns1f3ssmct10

16/09/2024, 14:19

240916-rm5emascmp

16/09/2024, 14:18

240916-rmcplsscjj

01/08/2024, 04:21

240801-eyvcks1grk

30/06/2024, 22:00

240630-1wpj7szfnn

20/06/2024, 19:48

240620-yh42mavcpg

Sharing

Copy URL Twitter E-mail

General

  • Target
    Court.Project.V1.1.rar
  • Size 89.8MB
  • Sample251101-v4e3vaey7f
  • SHA256 aa2bc6bdab3c1cd9cc94e92a00f2501ffd6bef384e69e605b9533ee4a9af2fcc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
pysilondefense_evasiondiscoveryexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target
      Court.Project.V1.1.rar
    • Size 89.8MB
    • SHA256 aa2bc6bdab3c1cd9cc94e92a00f2501ffd6bef384e69e605b9533ee4a9af2fcc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    defense_evasiondiscovery

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1
    • Target
      Court Project V1.1/@README.txt
    • Size 208B
    • SHA256 83d7d13a55b4696bd0021c76dab1f99eceb54d3357ca2b9a3af64d4b164c4e7d
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral2
    • Target
      Court Project V1.1/AIO.exe
    • Size 17.7MB
    • SHA256 22e7c140c849ad87f0d9f9624374045712c8a2f4c38befa85a92330fe2382316
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    defense_evasiondiscovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral3
    • Target
      Court Project V1.1/Court Project.bat
    • Size 75.3MB
    • SHA256 26cf8403cb6124796a98eb4644b3d75569bea2ba156456d0dd1b0b04ad3b3572
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral4
    • Target
      discord_token_grabber.pyc
    • Size 8KB
    • SHA256 fa4ec025ef2d20b6ebd19803e7131f6b540a7ba14d6769bfd62c37fb875a134b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5
    • Target
      get_cookies.pyc
    • Size 5KB
    • SHA256 f7e8a57b54489b5b3de66a1d21534ced3d2a2fb1ce8d03c69d4672e62aa00dca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral6
    • Target
      misc.pyc
    • Size 2KB
    • SHA256 572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral7
    • Target
      passwords_grabber.pyc
    • Size 4KB
    • SHA256 589d438226abfec8f71ab7724c68011303f82febb6786fd0c57571b0769764f3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral8
    • Target
      source_prepared.pyc
    • Size 65KB
    • SHA256 a99b29abc5cebb9e2efadb3aee5fc573a205503a67ecf8b71f580e61813202c8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral9
    • Target
      Court Project V1.1/DDoS.txt
    • Size 551B
    • SHA256 c347c884be71e7f0523e46820142750d3c22906c774472cf892c2a7d8e0c8325
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10
    • Target
      Court Project V1.1/Doxinfo.exe
    • Size 90KB
    • SHA256 cc2028db9daecfc962308f695bca0d46ea2e451984e4762c14dd8c3f3f055bae
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11
    • Target
      Court Project V1.1/Doxing.py
    • Size 4KB
    • SHA256 40628d75875a6a3c0f64180b9d9d717662c43f736aeb698477b239faa7561731
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral12
    • Target
      Court Project V1.1/Doxtracker.py
    • Size 11KB
    • SHA256 8828ec1c99732a088ceceb9b3cdc6e63d96971e560f5afa65387a2002c9b1577
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral13
    • Target
      Court Project V1.1/FireDep.txt
    • Size 300B
    • SHA256 f2281d044d3940f48d0c5cc94d59d4c9e887343c4c0a706008d261d88d46e215
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral14
    • Target
      Court Project V1.1/GmailSpammer.py
    • Size 5KB
    • SHA256 8b81d375b6d2131d0341a796eedb18f68b6db3a4d1b4134bc239bfcd401d70f2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15
    • Target
      Court Project V1.1/Guide.txt
    • Size 97KB
    • SHA256 ea856a7e663ab58fc986be184c7ee0013c40a0e1b4346fd2efab9da04dd50c47
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral16
    • Target
      Court Project V1.1/Pizza.txt
    • Size 775B
    • SHA256 cb5655fd124c9a7d49247efe88e775c9da983b5f4313d9345e8877711c11e32a
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral17
    • Target
      Court Project V1.1/Swat.txt
    • Size 422B
    • SHA256 f26a8a9545ac2629feee21af5b4d6b5beeeacfba8d0ebab69f516f3ca0937ae6
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral18
    • Target
      Court Project V1.1/databreach.txt
    • Size 333B
    • SHA256 56e06f74e3ed8699bc7aa16cb50a68ccfa6406ed2db91a377589115e79d000b3
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral19
    • Target
      Court Project V1.1/grab.txt
    • Size 159B
    • SHA256 25cd723e2546ca366c223a9ba298c6a794b5de67a8371427b4615a15d6b7f243
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral20
    • Target
      Court Project V1.1/iplookup.exe
    • Size 2.1MB
    • SHA256 49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral21
    • Target
      Court Project V1.1/phone.py
    • Size 913B
    • SHA256 879a15ee153cfd588b61bf07fc56e5fd8a6c3f6bcb42230acfee2e22f19ce536
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral22
    • Target
      Court Project V1.1/reversepic.py
    • Size 754B
    • SHA256 f0729606e3e1f981f2c1453f3658fb6af59d69b5cf80b51d2b12b562680e5fb4
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral23
    • Target
      Court Project V1.1/roblox.txt
    • Size 112B
    • SHA256 0a9a420c5e57db96b6075a8ab5affad756a2b26a3188c870b5f23224020098fc
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Browser Information Discovery

1
T1217

File and Directory Discovery

1
T1083

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks