anchordns | ba18ff142bae31457031ca49e772b10792ad3a5bdead90cb2c1d37e2a6c2fd59

Resubmissions

09/03/2026, 14:37

260309-rzdsfaev8z10

13/04/2024, 01:05

240413-bfw7nshd5810

Sharing

Copy URL Twitter E-mail

General

Target
possible malware.zip
Size 682.3MB
Sample260309-rzdsfaev8z
SHA256 ba18ff142bae31457031ca49e772b10792ad3a5bdead90cb2c1d37e2a6c2fd59
MD5 ba06cb72b125a0a353b87008d95e86ca
SHA1 9b4d7e2f1087ccbe73012c8237b0609f10576806
SHA512 3270783c7b42014ecfa3be771d675cffe75a0ba65cf7d4e0f5e1d61e65a4cee2c6f2e471c0e95ef23799c6a7b2eb7edbca8393d59353f4d6531099dd4def909e
SSDEEP 12582912:Bo4WyWq2xPQ3JjlAd9hpopjS5j/5i7Pdst6n8+fLOzV0fPWc+afxK6kKuq:BoJqJ5Bs9hpop25bvTGLeVJc3xgdq
TLSH
T12E79334BE4934A68D306B43FED910914A2F47187814ABCE986686307E5CA3D3E777C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://webmail.lax.co.il/owa/auth/Current/Script/jquery-3.5.1.min.js

Extracted

Family

revengerat

Botnet

Guest

voly.ddns.net:88

Mutex

RV_MUTEX-BUPRawrSNddXxdY

Extracted

Family

spynote

voly.ddns.net:1988

Extracted

Family

sandrorat

voly.ddns.net:1962

Extracted

Family

njrat

Version

Hallaj PRO Rat [Fixed]

Botnet

HacKed

voly.ddns.net:81

Mutex

23e6d18d0fa7e25eb8844687c5ca5f5c

Attributes

reg_key
23e6d18d0fa7e25eb8844687c5ca5f5c
splitter
boolLove

Extracted

Family

cobaltstrike

Botnet

http://summerevent.webhop.net:443/safebrowsing/rd/tnOztRgLx1ugKt8uumGcreRFm5CqXD9ge-zzz5sA6WzhC

Attributes

access_type
512
beacon_type
2048
crypto_scheme
256
host
summerevent.webhop.net,/safebrowsing/rd/tnOztRgLx1ugKt8uumGcreRFm5CqXD9ge-zzz5sA6WzhC
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAIAAAAAgAAAAhQUkVGPUlEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAfQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQAAAAoAAAAeQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlAAAABwAAAAAAAAAIAAAAAgAAABJVPXNSdjg1VUhpakJycldpSHoAAAACAAAACFBSRUY9SUQ9AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
jitter
3840
maxdns
247
polling_time
6600
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmFvK6fWzx+zTnQqAkZAQv6Eqwme1a80cwMNtrYEJShrKKbgpTy71w5Zd9u7EdBClno3HF9U4/9/tkBRw6PPPRa+W6bgpf97I3/Y0z36I5E/h+UP8h076IkzaWyPHbS1QMOiE6AXC3rCERjgirkn1LKUs+Q+zj0LeN8/QHEq/ZqQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/safebrowsing/rd/r8l4jO3947jVxa5wBhEijGc0y77iX4oFy
user_agent
Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
watermark
0

Extracted

Family

jupyter

Version

DR/1.4

http://45.146.165.219

Extracted

Family

jupyter

Version

DR/1.0

http://45.135.232.131

Targets

- Target
  Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/0d0ccfe7cd476e2e2498b854cef2e6f959df817e52924b3a8bcdae7a8faaa686
- Size 179KB
- SHA256 0d0ccfe7cd476e2e2498b854cef2e6f959df817e52924b3a8bcdae7a8faaa686
- MD5 6627918d989bd7d15ef0724362b67edd
- SHA1 21e29034538bb4e3bc922149ef4312b90b6b4ea3
- SHA512 83ee751b15d8fd8477b8ecf8d33a4faf30b75aceb90c0e58ebf9dbbfc1d354f7e772f126b8462fd5897a4015a6f5e324d34900ff7319e8cc791fb239ca603ddc
- SSDEEP 3072:7PR4kaQOrd41zdruwiAyr/Ta1XxKH3zVrWvcfWslmOLdXFKY8SIMjUPpF5:3aQLgwiAyr/TiXxMsvcrxbnjUPP5
- TLSH
  T18604127AA122FB41509FB3338799AB1B79BD97C09C25C4710E2673722D5C2EE8453B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/363ea096a3f6d06d56dc97ff1618607d462f366139df70c88310bbf77b9f9f90
- Size 154KB
- SHA256 363ea096a3f6d06d56dc97ff1618607d462f366139df70c88310bbf77b9f9f90
- MD5 8cf683b7d181591b91e145985f32664c
- SHA1 f0a20aaf4d2598be043469b69075c00236b7a89a
- SHA512 b75401d591caee812c5c1a669ce03c47f78f1c40a2fa31cf58a0318ffbfc032b82cb1b6d2a599ce1b3547be5a404f55212156640b095f895a9aac3c58ec4bad8
- SSDEEP 3072:fRxYk0d5+6/kdGyfitoxNsUZE2XZ+4Duz6fCKmjjwF5PaT:JqkoiGiZxE4qRKqgIT
- TLSH
  T10CF323A629BC9113AFAC21239DF70C2EC1EA075CA47DA05738518ED573CFF9C5AD1606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/4a0688baf9661d3737ee82f8992a0a665732c91704f28688f643115648c107d4
- Size 42KB
- SHA256 4a0688baf9661d3737ee82f8992a0a665732c91704f28688f643115648c107d4
- MD5 6aa08fed32263c052006d977a124ed7b
- SHA1 9a6795333e3352b56a8fd506e463ef634b7636d2
- SHA512 179e9d9ccbc268cc94a7f6d31f29cf0f7a163db829a4557865f3c1f98614f94ceb7b90273d33eb49ef569cfc9013b76c7de32d7511639a7ab2c352f3137d51b6
- SSDEEP 768:uGRVnBnwS5kBKsl4anxKFhx3W3kGmifmUED7Bn5f6dBywFmZb:fDeSnbx3okvxVwFI
- TLSH
  T1C8135C007190C473E1A6163544B99B629A3F3D42ABF490CB7FF916B9AFB17C05A39363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/6e6d3a831c03b09d9e4a54859329fbfd428083f8f5bc5f27abbfdd9c47ec0e57
- Size 49KB
- SHA256 6e6d3a831c03b09d9e4a54859329fbfd428083f8f5bc5f27abbfdd9c47ec0e57
- MD5 4ec8e16d426a4aaa57c454c58f447c1e
- SHA1 5c89629e5873072a9ca3956b67cf7b5080312c80
- SHA512 284e0dff33f4ffb6d55f2fdb1de81d5644fb2671aa358dfb72b34a50632f708b7b071202202efec0b48bc0f622c6947f8ccf0818ebaff7277eda854cee67eeaa
- SSDEEP 768:DN5oCkAI3effi5djegTXLzAl78S3ge0eYUi3EaQkDdXptOKeosAmMotwEX1:DN5oCk1eyTXn+qXUi3pptJMwE
- TLSH
  T10933290932A440B5E16793B9C8F39E45E773F8429376638F536842AE2FA37D14A39731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Malware-Feed-master/2020.08.03_CISA-Chinese_RAT_TAIDOOR/README.md
- Size 57B
- SHA256 664146b80800229b268722d618ac4ddcef9bd4a29715e3b7ddd36a21a0012500
- MD5 df252a327feefa31802dc9f84a688bf0
- SHA1 b093b9b797144a73472fb76604207f184211f487
- SHA512 5e09a77ba50edfd011fe2a9a274393bccebc878342b3cb0ccf00526146394695f674cca37a966777b053e6f47854d4178cc762f80a846ede631dbef424158811
- TLSH
  T1BD9002E2450C0EDD87540BDE7458708DE591570F0EE01C558496065089554749001959
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10