Extracted

• • Target
    Payload/Blocked.app/7s.png
  • Size 345B
  • SHA256 e2cfc1bc51d084ad43300a412d9140fa982ab73fcd2c8d6e3afbb2dcb675e5c4
  • MD5 0f96aa57f10c42f37742d62bd944a197
  • SHA1 779d0c7a75648e184b08eb9d2522004fbec55151
  • SHA512 6e157f012501dc7af7f93a0cebb5c7b051552ece56bdfd0d8f109abf5bade6331568ded02c8cd26185abbb0968ce3ae71d5a6dbc03f960f202eb850524f716e2
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral1
• • Target
    Malware-1-master/GunMayhem1unblocked.swf
  • Size 5.7MB
  • SHA256 f85f970882bc6667749e219a13736c9ec21b8c9c24b8b72bfe272f33be4248f1
  • MD5 bbbd8262dda1516961e2b9d936e20583
  • SHA1 2dc9e8ec267747d75bf98779b95e606f64357944
  • SHA512 047d4a3e730543180922e73aa392c78da9f14117589bb787cec97e171c42dc8111647541c495bd7844a650ad580e131bccc6a76da55acc51400306a3084eff0f
  • SSDEEP 98304:LMcKfaqSDrXuv/jEC39YRofE8X0QC6x2aAN3+FDNYsCPnXLH+bB7kpV4r5N5RUBa:ocnre3YC31fpu6x2aSqDNYpXL+dwV4X/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral2
• • Target
    Malware-1-master/MEMZ-Clean.exe
  • Size 12KB
  • SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
  • MD5 9c642c5b111ee85a6bccffc7af896a51
  • SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
  • SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
  • SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral3
• • Target
    Malware-1-master/MEMZ-Destructive.bat
  • Size 13KB
  • SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
  • MD5 4e2a7f369378a76d1df4d8c448f712af
  • SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
  • SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
  • SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  bootkitdiscoveryexecutionpersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral4
• • Target
    Malware-1-master/MEMZ-Destructive.exe
  • Size 14KB
  • SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
  • MD5 19dbec50735b5f2a72d4199c4e184960
  • SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
  • SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
  • SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  bootkitdiscoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral5
• • Target
    Malware-1-master/README.md
  • Size 123B
  • SHA256 fb39bb4709cdc96c648555b44956551859f4196be099b477e90046197005f1de
  • MD5 cb8fa03ac09f49a98bbd4a44a99b0f06
  • SHA1 6e15df00c743d477b88fe3949130c03b2f79d4ce
  • SHA512 f73d51525739041f0ebf056299823c53b1506bc861db0d3c051fcc07771b65813242b0ad55cfc704c081f9fe181be98f0ba54b89fafacbbd5bd3194d474fb82e
  • MD5 SHA1 SHA512

  Score

  3^/10
  behavioral6
• • Target
    Malware-1-master/TX3_ojTHxaEidvzTZOAvBPqzTUsyZYJYhArok5hFTyw
  • Size 87B
  • SHA256 05a2b68c52dcc91875f3ec3855a0a8c230651b41c11e38d49e528bc366cbf3e1
  • MD5 81cb1000925451233a8af5095365b70b
  • SHA1 0bdee5fa3f5fb81a61f1f295b95d9c66f958ab14
  • SHA512 d284915f40d0b40ca7b7a1253daf92621eb61cac6ee772ca8349b41d025065e7aa5f2a9103e6037e2db51fc57e1c21f6554f34714d51b1b749df48bbb1bd64fe
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral7
• • Target
    Malware-1-master/Win32.EvilClusterFuck.exe
  • Size 64KB
  • SHA256 c9b98408ca67d08e1986d1855c4d99944caad5580533d18496cd8de86dd0885f
  • MD5 2e84f71165225ba0f7f8187c0b2f0f37
  • SHA1 3c9bf036163ede4b7f9152d04d1a83b7253dd029
  • SHA512 82c39aaef6103877c8472a55eab6270d57f4d7c46830aedf5fbb5661d7e3fd7aee2e172cdc830cba22cd9034f37784a8cc34f70a5918491bccf148ee923db389
  • SSDEEP 768:S5ohpPUa2T1VZj4jkVQu7MKquVspXKCxiJrFnMWDmLfe9NZ+OAhaptX/71tXHHi4:tcd1Pl7ZVsw3rFiLfe9NZmAP5ZC6N+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral8
• • Target
    Malware-1-master/apache.exe
  • Size 252KB
  • SHA256 1117f585985ca4ddd03695876522f80951c919cb41db5854f013923f62285c09
  • MD5 8e747a4c115ac090e54dfa899c287129
  • SHA1 a1c523ad0a2fa1b533fb752a25aa48ff1cd4e1e3
  • SHA512 049fae2cccf4e1afc79d9e72e016f27d7714ad8b747c28ec3ad520bc25ff319f12aced97d16dbbe863aaab11514a9e90477656983fd67939c0e6d2ddb93558b3
  • SSDEEP 6144:ZcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQc:ZcWkbgTYWnYnt/IDYhPn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guest16defense_evasiondiscoverydarkcometpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral9
• • Target
    Malware-1-master/butterflyondesktop.exe
  • Size 2.8MB
  • SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
  • MD5 1535aa21451192109b86be9bcc7c4345
  • SHA1 1af211c686c4d4bf0239ed6620358a19691cf88c
  • SHA512 1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
  • SSDEEP 49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoveryinstallerpersistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral10
• • Target
    Malware-1-master/fear.png.exe
  • Size 66KB
  • SHA256 101678f77a65b5b5830a128e4c737b2aaaea5be95327ec68213ebb92e4251170
  • MD5 60ffde3dd3003cd24feeba26e47e6571
  • SHA1 e6c57a55ca93b1f6ebccb8c5fe9757fd0801eea3
  • SHA512 0a448886296c1f67760f2e09cbc226955c5abd833b6e7b2ce146cc673ddacca7bfbc59f2fa3f3a83381e7d67a0a677c487fc343833e3834dce84e00a6d286ca5
  • SSDEEP 768:AQyHrxwRjWjPc/u1SDSepzEtYcF6HKc6K:AJHrOWjPcmSDSepz46Kcl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  • Legitimate hosting services abused for malware hosting/C2

  behavioral11
• • Target
    Malware-1-master/getr3kt.bat
  • Size 13KB
  • SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
  • MD5 4e2a7f369378a76d1df4d8c448f712af
  • SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
  • SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
  • SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  bootkitdiscoveryexecutionpersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral12
• • Target
    Malware-1-master/iimo3.exe
  • Size 1.7MB
  • SHA256 5ac017285572c24fc8b77324a52ca484e83c3622c61bea80a74a6850f0a16061
  • MD5 4f8767983d865a5e706ae3c6aa5ab6c5
  • SHA1 535bc0a1cf7140176fd6e6a205f3394d146c2ba3
  • SHA512 a88e5fd993d2fdde869ef32a5271d5bbd222f2174217bf4e2c4cea6fad624d237b3528478b70ab1ec5011bd031fc93319865f5877e06fb3efcc53cc5c7e786a3
  • SSDEEP 49152:ZgTJ84RvagaNgNu5W05jvIAo69PnaLgnMu4x:ZgmmygtNfCvjf58
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoverytrojan

  • UAC bypass

    defense_evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral13
• • Target
    Malware-1-master/qOA7iZJcoB8.exe
  • Size 400KB
  • SHA256 6b111be3c180de78849b4f1c2d39ee0045695e22d339b50879a769351b1e6b31
  • MD5 7a58e7f8cd91b372af614ffe5db58eca
  • SHA1 8e341ffcfcb4b60b93700996b037c35f0221ec39
  • SHA512 c89d62ddcc79d0e1a42dc090b3a149483e91f61c9aa9aaa489535dc32462d55d6accc2f55a255c42579c89a78afdd62f271dbcb4aab6c075b8cb70f6a143b5bf
  • SSDEEP 3072:bQgo+/qo6aiN3HKwkRF9kl+BHpQB8ID0msCJhp4Swm5WXDtVL3d0:2+/qo6f9kRFyl+BJM8ID0pCr/wm5S
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankerdiscoveryemotettrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Emotet family

    emotet
  behavioral14
• • Target
    Malware-1-master/wintonic.exe
  • Size 1.6MB
  • SHA256 a0375c241cebcf6c4a0293f45a5dc0ce1150fe8169ea410c818af67e6f487b4c
  • MD5 c7cc7175fa6a305036ecd68cfb4c970c
  • SHA1 c440e7653a4811935222651dfe61e56a70e5b92a
  • SHA512 0fe4873d7cf6be5fcae7cefd545205ea58a977679b2183ec5caabd47920e3b66813e31e6e545d585f15d3a17d21846b042cd40a507d662c19a2bc58fbfbe4fff
  • SSDEEP 49152:+h+ZkldoPK8YakOvfcrEb8XCOEU5fwr9K:X2cPK83vkrEb8XCfU5AM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  adwarediscoveryspyware
  behavioral15