darkcomet | b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Sharing

Copy URL Twitter E-mail

General

Target
The-MALWARE-Repo-master.zip
Size 198.8MB
Sample260222-cdtt7sb16e
SHA256 b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1
MD5 af60ad5b6cafd14d7ebce530813e68a0
SHA1 ad81b87e7e9bbc21eb93aca7638d827498e78076
SHA512 81314363d5d461264ed5fdf8a7976f97bceb5081c374b4ee6bbea5d8ce3386822d089d031234ddd67c5077a1cc1ed3f6b16139253fbb1b3d34d3985f9b97aba3
SSDEEP 6291456:wNl3aFW2h9/fiTwCzCLS6iilVkLZgAEtknRzq:wDaFd//Orcpi4VkL6AfRG
TLSH
T1D9A83364D256BEA0DF4D3671EA7AEA6CF68DB02812D0FD25701183D44AFB4DBDA4700B
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

darkcomet

Botnet

Guest1111

193.242.166.48:1605

Mutex

DC_MUTEX-2QRLPN3

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
Rb5l52XcV9no
install
true
offline_keylogger
false
password
313131
persistence
true
reg_key
winupdater

rc4.plain

Extracted

Family

njrat

Version

0.7d

Botnet

Geforce

startitit2-23969.portmap.host:1604

Mutex

b9584a316aeb9ca9b31edd4db18381f5

Attributes

reg_key
b9584a316aeb9ca9b31edd4db18381f5
splitter
Y262SUCZ4UJJ

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

nickman12-46565.portmap.io:46565
nickman12-46565.portmap.io:1735

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Userdata.exe
copy_folder
Userdata
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%WinDir%\System32
mouse_option
false
mutex
remcos_vcexssuhap
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Targets

- Target
  The-MALWARE-Repo-master.zip
- Size 198.8MB
- SHA256 b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1
- MD5 af60ad5b6cafd14d7ebce530813e68a0
- SHA1 ad81b87e7e9bbc21eb93aca7638d827498e78076
- SHA512 81314363d5d461264ed5fdf8a7976f97bceb5081c374b4ee6bbea5d8ce3386822d089d031234ddd67c5077a1cc1ed3f6b16139253fbb1b3d34d3985f9b97aba3
- SSDEEP 6291456:wNl3aFW2h9/fiTwCzCLS6iilVkLZgAEtknRzq:wDaFd//Orcpi4VkL6AfRG
- TLSH
  T1D9A83364D256BEA0DF4D3671EA7AEA6CF68DB02812D0FD25701183D44AFB4DBDA4700B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  The-MALWARE-Repo-master/Trojan/000.exe
- Size 6.7MB
- SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
- MD5 f2b7074e1543720a9a98fda660e02688
- SHA1 1029492c1a12789d8af78d54adcb921e24b9e5ca
- SHA512 73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff
- SSDEEP 3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9
- TLSH
  T11E66F39B5ECC82E2FD3E05314062F676A6607EE907D24FCB62F80D47FA502E56C7119A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral2
- Target
  The-MALWARE-Repo-master/Trojan/Alerta.exe
- Size 111KB
- SHA256 2d2a22db20a44474afbd7b0e6488690bad584dcae9789a5db776cc1a00b98728
- MD5 e8ed8aaf35e6059ba28504c19ff50bab
- SHA1 01412235baf64c5b928252639369eea4e2ba5192
- SHA512 d007c96b2fad26763d27be8447ca65e0ab890deb6388b90cf83c0b3431e09b225f7424098927b54f15fe34eae953b61b45371b0df4b2d89c60be9c006ffe9034
- SSDEEP 3072:AuDWghj8FVadgTtzB4QMW+ybdBl7Du1T:bDWqY2qTtCQfb3l+1
- TLSH
  T130B3AE13A4944553F23A46B16E973E78A905FA34E8B36BA70112EECF3D752D24D0933B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  The-MALWARE-Repo-master/Trojan/Ana.exe
- Size 2.1MB
- SHA256 117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb
- MD5 f571faca510bffe809c76c1828d44523
- SHA1 7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2
- SHA512 a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51
- SSDEEP 49152:OwVYlfBUDiZx8Fa/Q0NuB3btlnCItWNSwoy:OxPUDQmso0NuBZlnCItM
- TLSH
  T1FDA5239635AD983BE0BE4AF1A0F121581B752A6715B9C7CF3D8420DD49F2BC24E70B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  The-MALWARE-Repo-master/Trojan/ArcticBomb.exe
- Size 125KB
- SHA256 322eb96fc33119d8ed21b45f1cd57670f74fb42fd8888275ca4879dce1c1511c
- MD5 ea534626d73f9eb0e134de9885054892
- SHA1 ab03e674b407aecf29c907b39717dec004843b13
- SHA512 c8cda90323fd94387a566641ec48cb086540a400726032f3261151afe8a981730688a4dcd0983d9585355e22833a035ef627dbd1f643c4399f9ddce118a3a851
- SSDEEP 3072:2f9+exxxz0fAcQ8nJHG5VZYYycEIojDknqhclLD:4u68Mdbw0plL
- TLSH
  T162C3129D9F288103DEA0C23E5F7A5F11AF28C82B015E47862C38768F757C7B25622C2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  The-MALWARE-Repo-master/Trojan/BlueScreen.exe
- Size 9KB
- SHA256 14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160
- MD5 b01ee228c4a61a5c06b01160790f9f7c
- SHA1 e7cc238b6767401f6e3018d3f0acfe6d207450f8
- SHA512 c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140
- SSDEEP 192:+fD9Nr7FhGYGkYPtkavYYGD6eXLeBZOic7b:+z7FUYGkoVRGD60EZOicf
- TLSH
  T14E123B86A3DAD469D89E02322DD34E61547ABC2583A8C3FF1D74028F6E71BC05D3127D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6
- Target
  The-MALWARE-Repo-master/Trojan/Bolbi.vbs
- Size 46KB
- SHA256 ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51
- MD5 99ec3237394257cb0b5c24affe458f48
- SHA1 5300e68423da9712280e601b51622c4b567a23a4
- SHA512 af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkraB:m7BGV95hIG1/d49gsCDsl
- TLSH
  T11B23A78847C164F09150BC09B845FA378375CEC07C6B56BEE953A28EB415A6AF0F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery exploit persistence ransomware trojan
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables cmd.exe use via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral7
- Target
  The-MALWARE-Repo-master/Trojan/Carewmr.vbs
- Size 3KB
- SHA256 2f5d32b3f1990ed53857aba65bc428a3fa33d231c1c059b8a8b2ed09076ad607
- MD5 0eeb59abb53bb2aef4fa819f8437a643
- SHA1 14e9b3223662b5d74aca26edffb4eea27e8c6f23
- SHA512 6397bac318d90a008f54b62410dfd797234be83f8bff8b33392427442885d50f498c40ee0eee97f7272100de68ae917af95d3e75d1902f5fe6ae1b8a14c8b6e3
- TLSH
  T1AB610017BAD651CFC26A1284214635A9D2D401F0D9F04D653D4CEAA82B12DE744FB2FF
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral8
- Target
  The-MALWARE-Repo-master/Trojan/ClassicShell.exe
- Size 6.8MB
- SHA256 a848bf24651421fbcd15c7e44f80bb87cbacd2599eb86508829537693359e032
- MD5 c67dff7c65792e6ea24aa748f34b9232
- SHA1 438b6fa7d5a2c7ca49837f403bcbb73c14d46a3e
- SHA512 5e1b0b024f36288c1d2dd4bc5cf4e6b7d469e1e7e29dcef748d17a92b9396c94440eb27348cd2561d17593d8c705d4d9b51ae7b49b50c6dee85f73dec7100879
- SSDEEP 196608:ck0ZD3wcntby4M7fVy7CXihieDuz+yOQJkC1iZiUvfOR:ckyDgURy4M7fVyutXxUe
- TLSH
  T1DB76224468F0CE64D0349E72E46A35F7491A2E2EFD445D2BB167FFEC76BA0D08107A1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral9
- Target
  The-MALWARE-Repo-master/Trojan/ColorBug.exe
- Size 53KB
- SHA256 775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de
- MD5 6536b10e5a713803d034c607d2de19e3
- SHA1 a6000c05f565a36d2250bdab2ce78f505ca624b7
- SHA512 61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018
- SSDEEP 1536:ynqAKryDLrASOcRw52sjzIUK7RkYrJ2lrKX:SNdMT8Z8cX
- TLSH
  T117333B63F2D08471E173DEBC9C3A8214992BFE312D34944A7BB52E8D0E793949C1A797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence
- Adds Run key to start application
  persistence
behavioral10
- Target
  The-MALWARE-Repo-master/Trojan/DesktopPuzzle.exe
- Size 239KB
- SHA256 1f5a26f24a2bfdd301008f0cc51a6c3762f41b926f974c814f1ecaa4cb28e5e6
- MD5 2f8f6e90ca211d7ef5f6cf3c995a40e7
- SHA1 f8940f280c81273b11a20d4bfb43715155f6e122
- SHA512 2b38475550edee5519e33bd18fea510ad73345a27c20f6457710498d34e3d0cf05b0f96f32d018e7dc154a6f2232ea7e3145fd0ed5fb498f9e4702a4be1bb9c8
- SSDEEP 3072:r/3qftCdbSFtY8Zf8pOk0rHitNWIekbnfFPsr24Cv/Eng9m3ihlCeKH6Fb6aX3WA:WoI/rC0k7ar68nimCYHe3qZr0SlC
- TLSH
  T167345D66F6D04C33D1731B7CDD5797A59C3AFE103E28988A6BE41E4C4D392817A282E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  The-MALWARE-Repo-master/Trojan/DudleyTrojan.bat
- Size 176B
- SHA256 39a075e440082d8614dbf845f36e7a656d87ba2eb66e225b75c259832d2766bc
- MD5 6784f47701e85ab826f147c900c3e3d8
- SHA1 43ae74c14624384dd42fcb4a66a8b2645b3b4922
- SHA512 9b1430a426bf9a516a6c0f94d3d20036a306fae5a5a537990d3bcf29ebf09a4b59043bbe7ef800513ea4ac7fe99af3cac176caa73cd319f97980e8f9480c0306
- TLSH
  T13EC002C3F456CD525BE544536E09385032D78587C2674E05A38B2472667DCD4364C61A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral12
- Target
  The-MALWARE-Repo-master/Trojan/FlashKiller.exe
- Size 4KB
- SHA256 353df4f186c06a626373b0978d15ec6357510fd0d4ac54b63217b37142ab52d3
- MD5 331973644859575a72f7b08ba0447f2a
- SHA1 869a4f0c48ed46b8fe107c0368d5206bc8b2efb5
- SHA512 402662eb4d47af234b3e5fbba10c6d77bdfdb9ff8ecfdd9d204f0264b64ea97fc3b5c54469f537173a26c72b3733550854749649d649bc0153c8fe3faacc50a1
- TLSH
  T1C581546387400FB2DC541E7B32F314A565FB493067F53A001EC0844CD10BA180D7CEE4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13
- Target
  The-MALWARE-Repo-master/Trojan/Frankenstein.doc
- Size 493KB
- SHA256 6be18e3afeec482c79c9dea119d11d9c1598f59a260156ee54f12c4d914aed8f
- MD5 692815cce754b02fe5085375cab1f7b2
- SHA1 732284173858d6b671c2fec0456e3c0fdfc063ce
- SHA512 cecd35f28f862980f89797861bf1e6f1a15556a5575af5fc60623ede0480c027d1525ea6d10516b266e2d9434858f7c0a63dbcca2b8c2778dc5f6623568d4646
- SSDEEP 12288:wnm+zVQtL/5ZMBVlGZ7nthuY7LYdodj32rPf6wHzhrKpF:7+eLRuBVlInbnn1djmrPfl0F
- TLSH
  T154B42324C05D19A2F851ABB62A75D0C4146318D7F4622D6EC58C2791BB32FF93E39D8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  The-MALWARE-Repo-master/Trojan/FreeYoutubeDownloader.exe
- Size 396KB
- SHA256 cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
- MD5 13f4b868603cf0dd6c32702d1bd858c9
- SHA1 a595ab75e134f5616679be5f11deefdfaae1de15
- SHA512 e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
- SSDEEP 12288:jANwRo+mv8QD4+0V16nkFkkk2kyW9EArjaccoH0qzh4:jAT8QE+kHW9EAr+fr4i
- TLSH
  T1B884CF39E2A1C17AC02109B5D84BC1F6B17AAF00DB7804CF77E97E5D783326D1BA5296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral15
- Target
  The-MALWARE-Repo-master/Trojan/Gas.exe
- Size 18KB
- SHA256 da3f40b66cc657ea33dbf547eb05d8d4fb5fb5cf753689d0222039a3292c937a
- MD5 e7af185503236e623705368a443a17d9
- SHA1 863084d6e7f3ed1ba6cc43f0746445b9ad218474
- SHA512 8db51d9029dfb0a1a112899ca1f1dacfd37ae9dec4d07594900c5725bc0f60212ab69395f560b30b20f6e1dffba84d585ef5ae2b43f77c3d5373fe481a8b8fc3
- SSDEEP 192:KtRj6/XFyk9YPdXTH08W8c3LXLtYmEBI9qHVDEV:WV6fFy2Ylz0TiBIw1Dc
- TLSH
  T19282D527F3989B52E09849744CE723209B73BE328F969F1B7111379CBCF26824E67611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  The-MALWARE-Repo-master/Trojan/Grave.apk
- Size 560KB
- SHA256 64c874d0a67387d174fbf18811ef23e9d9b0f532ed7f805e542dacdf3c9d42f9
- MD5 61b29201190909e848107d93063726ca
- SHA1 f6505a3b56fdbbc54e1624793581afe45010c890
- SHA512 a2e8fa752d62e77e20e6fd86b7c6de3e683e41932eef448164944bd5f5dbb91ccf4380b3c13943e5c0264b9127b7f5e471ece68753af541d408caefae1065930
- SSDEEP 12288:Gh5GdDu6h/NyHjgzu7mGN35dGL5guxaAnDgQ0Zy4bPsHG74BS2dYqM4I:G2Du6/N40CaQkDsbsHs4BSKYqMx
- TLSH
  T13FC412A1A7D8421FF4FB66380E7708D013B5BDC12D24D55F2166B06D1ABBBD09B20B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17
- Target
  The-MALWARE-Repo-master/Trojan/HMBlocker.exe
- Size 48KB
- SHA256 2d047b0a46be4da59d375f71cfbd578ce1fbf77955d0bb149f6be5b9e4552180
- MD5 21943d72b0f4c2b42f242ac2d3de784c
- SHA1 c887b9d92c026a69217ca550568909609eec1c39
- SHA512 04c9fa8358944d01b5fd0b6d5da2669df4c54fe79c58e7987c16bea56c114394173b6e8a6ac54cd4acd081fcbc66103ea6514c616363ba8d212db13b301034d8
- SSDEEP 768:xE09MOEzWGoOIx2qCZVZmj+Wg5VK2LDakrDZ5yS/wwHA49kszNAY1XKoJc4P1:t7w73bUNMMkrDry+6Ut
- TLSH
  T1FE23D08AFE9CA6F4C880403DD11A9B25252ECC284871874679EF3DD7FEB340199EB476
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral18
- Target
  The-MALWARE-Repo-master/Trojan/IconDance.exe
- Size 301KB
- SHA256 a4b6e53453d1874a6f78f0d7aa14dfafba778062f4b85b42b4c1001e1fc17095
- MD5 7ad8c84dea7bd1e9cbb888734db28961
- SHA1 58e047c7abecdd31d4e3c937b0ee89c98ab06c6a
- SHA512 d34b087f7c6dd224e9bfe7a24364f878fc55c5368ce7395349ca063a7fd9ac555baed8431bfa13c331d7e58108b34e0f9d84482ce2e133f623dd086f14345adb
- SSDEEP 6144:+gYw2itwtdpXQ9g64B8Ly7Cs1ApMTP8hyLrlre1:8w2itSyV4B9aMQYI
- TLSH
  T1B2646D26F6E04D37D1632A3C9D9B5A64DC3EBE102E2C654A1BED1D4C4E397823938397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  The-MALWARE-Repo-master/Trojan/Illerka.C.exe
- Size 378KB
- SHA256 cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f
- MD5 c718a1cbf0e13674714c66694be02421
- SHA1 001d5370d3a7ee48db6caaecb1c213b5dfdf8e65
- SHA512 ba0ddff47b618740dfcb63024435c36d895889dd3cf6b4559969283ba8100e8063f5c7767e56dfab67a2b5c96e4ae22e141e5b09e81be5cec9aa7ca7827b4b8a
- SSDEEP 1536:IM64RFcdoYicOWtlo4yJDsE4KmtZxq3/1d+DSaumOY6eeLnAGTpZspibfaSuOypE:IMJkoY9lpoaKm2vacPESu/wK3+
- TLSH
  T17D84F726092CDC0ED26078F896B0E5AEE07CDE040D6E5464D7B7BD9A8938B5FED1C18D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral20
- Target
  The-MALWARE-Repo-master/Trojan/L0Lz.bat
- Size 6KB
- SHA256 fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae
- MD5 74f8a282848b8a26ceafe1f438e358e0
- SHA1 007b350c49b71b47dfc8dff003980d5f8da32b3a
- SHA512 3f73c734432b7999116452e673d734aa3f5fe9005efa7285c76d28a98b4c5d2620e772f421e030401ad223abbb07c6d0e79b91aa97b7464cb21e3dc0b49c5a81
- SSDEEP 192:tlYUT1jLPD5mZkRr3TfLQ4/zus8joPRJRqU1jXEmo:tlY85XW
- TLSH
  T173E18C933D1AF621C89915C0CB68B301B106C0930DECAD8EA5B77075A16ACDBA27F7CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral21
- Target
  The-MALWARE-Repo-master/Trojan/LoveYou.exe
- Size 22KB
- SHA256 1edc8771e2a1a70023fc9ddeb5a6bc950380224b75e8306eb70da8eb80cb5b71
- MD5 31420227141ade98a5a5228bf8e6a97d
- SHA1 19329845635ebbc5c4026e111650d3ef42ab05ac
- SHA512 cbb18a6667b377eb68395cfd8df52b7d93c4554c3b5ab32c70e73b86e3dedb7949122fe8eea9530cd53944b45a1b699380bf1e9e5254af04d8409c594a52c0e7
- SSDEEP 384:o4LBivz/4RHCxN3IBUDzfGWCw2cKgDwg7dEsL9s+cLUoHl:o4LBu74Ro9ImnfGWJ2cKgsgZDW+cLUe
- TLSH
  T124A2C81BD6DDB012F529A2B61E2A33B69D2AFCF01D9162C7BE645E4D2D361F1981030F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  The-MALWARE-Repo-master/Trojan/MEMZ.exe
- Size 14KB
- SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
- MD5 19dbec50735b5f2a72d4199c4e184960
- SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
- SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
- SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
- TLSH
  T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware bootkit discovery persistence spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral23
- Target
  The-MALWARE-Repo-master/Trojan/Malum.apk
- Size 2.8MB
- SHA256 b2f3fe699dc862eeb3f471c0ee3075f5edfa7aa9f9eb3815cf34802f24112397
- MD5 28ac5460e68eb83737ae2d3cd4f1d49f
- SHA1 97fc58ce2d7d952fe512856a0d3f52fa68329a9b
- SHA512 1ef7ed4de0157378e07380c6b493da7f53b3b7c5d419fb1d1a60d16a5403cdce38645d22bf0c0d9dc2e2ea2ceee5ccf1b9a8e8e34d88a033fa9ad1ec7a8d73b1
- SSDEEP 49152:Sy/CzDrC83iwfDGubWhgGcWyctCo/vqJoh2Jbbv6G4Xnx+DVI3oVFe:f/srCsTWhg8y3UCJJJnv6FR3ove
- TLSH
  T16FD522A17324BE5AECB645738656C626C3352E8407636FD3775D363C2BBBE800B805A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  The-MALWARE-Repo-master/Trojan/Mist/MistInfected_newest.exe
- Size 22KB
- SHA256 5f7471c215b433f1b28dd4b328b99362099b6df7cb9e5c1d86a756388e0c7aeb
- MD5 1e527b9018e98351782da198e9b030dc
- SHA1 647122775c704548a460d6d4a2e2ff0f2390a506
- SHA512 4a11c811f30016218075d43a9f983fa7a484a06f22d625b1bd2d92b4cfabbfb142945ca0a9ca1cf91391a3e73c154f6121140d2f1d42aa35ad7f10817534a21b
- SSDEEP 384:qosO55gUoO4D+DFBCd6GyhETw62O0OnYPL3p+:XsOkUoO4Dsbc22
- TLSH
  T1EEA26D078B500627EFE28AB0197FD018F73661A3437483E717B6D9A8E884B65FD9550F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Drops file in Drivers directory
- Executes dropped EXE
behavioral25
- Target
  The-MALWARE-Repo-master/Trojan/Mist/MistInstaller.exe
- Size 83KB
- SHA256 323060680fed9a3205e3e36d2b62b7b5b6c6e6245e4555dcc733cf6ef390f41c
- MD5 8813125a606768fdf8df506029daa16f
- SHA1 48e825f14522bd4d149ef8b426af81eec0287947
- SHA512 9486a027029a27cbf0424760625c08d73aa62e28e45081751c5bada7c07ca05b4e44239da7774cf4f76298fb6b71769ae62595ae439b470c8308d39e1b2289d8
- SSDEEP 1536:IyD2eyujEyC5YYafh1Mc8/gsWjcdjl9btC:I+2eytf3B9bQ
- TLSH
  T19A838D03B6D184B0E9F30A310CB9D9504B7FBD664E748E572398669D4E741E0AE39F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Drops file in Drivers directory
behavioral26
- Target
  The-MALWARE-Repo-master/Trojan/Mist/MistInstallerRC.exe
- Size 83KB
- SHA256 95d5594cac9cfa5826e1c0b12fec980ff8a01136364aed2831164b46cbb13ca1
- MD5 d81acaef0db08aac297d4bd3c58ddf50
- SHA1 02e6ac2c001c639078c3e842132f91509a6f7466
- SHA512 45b1f047816f4ba8e730cf6914331f9ced81c1e6614f594a748eb6469efb2f311f0ef86e3241cafb2794b580df14302f9cb279175bc1064e79c6c501fa2dc738
- SSDEEP 1536:ryD2eyujEyC5YYafh1Mc8/gsWjcdjl9btC:r+2eytf3B9bQ
- TLSH
  T128838D03B6D184B0E9F30A310CB9D9508B7FBD664E748E572398669D4E741E0AE39B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Drops file in Drivers directory
behavioral27
- Target
  The-MALWARE-Repo-master/Trojan/Mobile_Legends_Adventure.apk
- Size 4.0MB
- SHA256 b47bcc55ca8dc0625a145d6809cfa3ad78e9e3b4f33bc608b5bcaf7e9e1e5827
- MD5 42585ccd2b7867c12052653e4d54b7cc
- SHA1 a9348c3aabcc0171d1e35edeb37fd2da0fff0ad4
- SHA512 e270bd1fbbaaccf3382048e9ac2489444a735ed32fb83f7681526a1edb0b7847d6adb8d75064b065309293ef75c45e2ea85fb132a1c12afd08b3a1346caad550
- SSDEEP 98304:1kDC5i3mO2jB5qJYNXV6lDysPmkMZHG9dqO/J:1x2ZW5eYN4lDy2xwHG9dfJ
- TLSH
  T19B162341E765E94AE8F658738205C979A2304F50032BBBA6375D322C2BFFB801F45AD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28
- Target
  The-MALWARE-Repo-master/Trojan/MrsMajors/BossDaMajor/BossDaMajor.exe
- Size 1.9MB
- SHA256 730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a
- MD5 38ff71c1dee2a9add67f1edb1a30ff8c
- SHA1 10f0defd98d4e5096fbeb321b28d6559e44d66db
- SHA512 8347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9
- SSDEEP 49152:veG3J7FtM9SbJakTiTBMGSARaspyyx979PSxgKFdGlYU:2GZxSoJrTiTBMGtRa8t7EFddU
- TLSH
  T1E0952336F7697951D14202B148A26BA0AA304C36E7205CDB7AE57B0FFC722FD563326C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion persistence privilege_escalation trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies system executable filetype association
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  The-MALWARE-Repo-master/Trojan/MrsMajors/MrsMajor3.0.exe
- Size 381KB
- SHA256 4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69
- MD5 35a27d088cd5be278629fae37d464182
- SHA1 d5a291fadead1f2a0cf35082012fe6f4bf22a3ab
- SHA512 eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5
- SSDEEP 6144:Th3idhONY259BH1DzJ5PzVNtGgc+F9TBd096cTKAsLEbqqbd+VWM8AHiKn9SlXNA:Th3iXPw9Tc6kVXMHHLEf8l7
- TLSH
  T1F884AD2272904588C5B5A2BAC611D72AD2713EA51B21D3EB37B57BB73E365818F3C3D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

agilenet defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
behavioral30
- Target
  The-MALWARE-Repo-master/Trojan/Offiz.js
- Size 2KB
- SHA256 d0806a3f935b9ca64041102958975f4b66d9cedd843b1f48bdc9e38d2f559bba
- MD5 3ff1855e571558f709d7b69f1fef3e1e
- SHA1 ae26203998506ff223ecd7b5f82c945a5f5e7d77
- SHA512 85773239ad953810796789d60436caff5d98dd2ccd5db0e00e362835c327756653b4fc1de67648a11d8a36972d384a69cffcec06fe078e9e252e1494d672e2a0
- TLSH
  T16D51468CB5A16046842A6A754BEBB61473F09003A254D841BB6CC5E0DFB42BFBB15D4C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31
- Target
  The-MALWARE-Repo-master/Trojan/PCToaster.exe
- Size 411KB
- SHA256 85a58aa96dccd94316a34608ba996656a22c8158d5156b6e454d9d69e6ff38c3
- MD5 04251a49a240dbf60975ac262fc6aeb7
- SHA1 e211ca63af2ab85ffab1e5fbbdf28a4ef8f77de0
- SHA512 3422a231e1dadb68d3567a99d46791392ecf5883fd3bbc2cae19a595364dac46e4b2712db70b61b488937d906413d39411554034ffd3058389700a93c17568d2
- SSDEEP 3072:quJFS5Aqu+WwjxeI/0gVnfKl0FA+aPobO24yNz88iu8vDYHTlI5EJD5Hbibfd6PK:/JM0mCsWq1/qpz+nF5c
- TLSH
  T14A946082EA1681E8F82B72F1669D3CC418A25C9D94C6D61FB1B735109933783DD7BA0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32