954e2d48ca5d85cb2bc38d398e956b697937eea140654476e429210887694b4a

Sharing

Copy URL Twitter E-mail

General

Target
RexVolt.rar
Size 14.7MB
Sample260603-ehe8qaay2j
SHA256 954e2d48ca5d85cb2bc38d398e956b697937eea140654476e429210887694b4a
MD5 b60f3eb135900d5ae6a37eede014ac74
SHA1 408365ef4fdb4d089cd48551a88711aeb46c6fcd
SHA512 35f929ee2bbd62432a21032a857b6f480d5742b3a713f7716da49321ec3662959a36a75f23831f729e88d1e41a5dac1d3c1be523730d32dde60430656784fc14
SSDEEP 393216:LOCLvIBrQA6BOQeXppOqjhb8DQL5Y0UjFBXd:Ll8BrKOQeXHOqj98DYY0URBXd
TLSH
T1A0F6337461199093BE135FBCA0E506EB2783B9CFEA8697CB391C15C40E8E1D13456BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution

Malware Config

Targets

- Target
  RexVolt/Bin/Decompiler.exe
- Size 9.4MB
- SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
- MD5 a109790efbe0542dddf63ef0415dd508
- SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
- SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
- SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
- TLSH
  T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  RexVolt/Bin/Xeno.dll
- Size 2.3MB
- SHA256 f00f1e8b8752812f99965d6c660b2c09b23e1dc114cf045de859dc5a7d115daa
- MD5 d645d8f6df97a9cbf19c18e536e327c5
- SHA1 fdeb90b995a8949b41c4f45ea204b08c2de60963
- SHA512 f8ec53ef57306ac5ce242e6144c6ef9b5d66cbf9d3b9b010f12dd5b89f13b63aac0cf89bf0bc5167f00010e64db199157e02f14fca6bef9c7f1e633bd24dbe91
- SSDEEP 49152:T1oSFUx782Yfvh8w4DiBctM+Tjypmd+Fu9sJ3c8KE0:TOoOzgGPyyX
- TLSH
  T10FB58E17A69900ECD076D1F88A5B5513E7B17C4903316BEF02E0B9656F23AE68F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  RexVolt/Bin/libcrypto-3-x64.dll
- Size 7.1MB
- SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
- MD5 b47c9988a203a596803837c128853517
- SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
- SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
- SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
- TLSH
  T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  RexVolt/Bin/libcurl.dll
- Size 637KB
- SHA256 8645f1b6bec48f061e54941ec1d9c5e4b8096ce1a80d8ea0a0353e4cb557f8f5
- MD5 8c14feded4b94c4b72af1f710f236778
- SHA1 62dd8f17cff9916faa792a8188f8e82ed6edf9c8
- SHA512 c0222d788aef2be7eb205f923302a79b59ec6018210944cf6d807b073fcd2c08182f42e4a1766b7e42e190ac4ebb090f6afe026a52e5bb11f585db180bbe0fc8
- SSDEEP 12288:EzbJ84IyhxblduSGHhphyfiuEkatR5YI80OdnmqKENG:EzbJ84pjbWSGHz1uEkatR5YI80Odnmqt
- TLSH
  T13CD46C56B3F414A9D1A7C17CC6538227E3B2B0542361A7DB12B4CBBA6F13BE2573A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  RexVolt/Bin/libssl-3-x64.dll
- Size 1.4MB
- SHA256 bfc059e16951fa90cc14489a8263f35c6703e762f2f5413682b4f7935bbced57
- MD5 754fff93ed112eb26bd4a6b0e8300deb
- SHA1 de9edf5c9ac80b1f26dcc91d89791065097a7d23
- SHA512 05d215d1e0cd65a98cf55a2a5e123992e5719006eb346261c0c03a629cfe2cde910765a1a87a3f5a93d2371ea9c15d677277b903d55c24731bcc7c7eed87a71a
- SSDEEP 24576:CV6b+rLptrBSFH+tK8olR+WmXWdEVB36eVE:CV6bedt9UlIzWdEVB3a
- TLSH
  T1F1656CAAA7B8019CD5B6C17CC2934B23D2B6F4162370A7DF0A658A781F63BD5173D384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  RexVolt/Bin/zlib1.dll
- Size 88KB
- SHA256 f6b58fdde3bfef2c25c7254fadfed12d86d81c4a5c962262715868c48063fc76
- MD5 68cf6f98cb8b227814a59ff3f909a0af
- SHA1 0383a4d7a74417d3ec90526e61b7637256e0bb57
- SHA512 b59f9eeededd1f76f048b57ae753f79227aead32006fc649532a9bae3f441515bab85338d25b26e5002c54c65d661c0c3048f5c3c1ded6274638ee950afb4744
- SSDEEP 1536:QvkS6XmTzqbKxfXOTBpp/foyUaDmjGI23aIOcIOZhhkxBJNJ5:PdXozwBppnqG3oSZfkxBJNJ5
- TLSH
  T1C5936B4AAAB412A5D6F78178D8D207ADC331701407A44BDF9648A7691F23BE41F363FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  RexVolt/Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 fcc07f6b8ddb7c90915dbeaa2d959880bc52266dd49d7fab082f9da698f2bf0c
- MD5 4b1eb3789190ad2ea2b4c55355ccf9f5
- SHA1 8a2b1ed289b31a38f017b461a64b1744fa640fa1
- SHA512 35ff527147e280bfc46fd4b8acef77b74a9c2e1219b1038532ab6f48af5e759b50915cf9bdc27cd2529bf4ab993a7d8b1556d8470c7e48239b7209495d95b016
- SSDEEP 12288:gj5LLzRypN2KetpO4Rq4PjETh0SvY7YRqJ2GrO0APBULx/XwyqFRNAv6zrP322yw:o/wj7
- TLSH
  T19DD4302223FD4619F6F67FB55A780B608BFABC96B978D34E4598112D0D72F4099A0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  RexVolt/Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 71ac279e33b91d777daad9d50ba19e3905f4f8913a9cd0138bd8e82434f93aee
- MD5 c619a1500c3c1aec988c4afbd3e56239
- SHA1 ae01018242dee58dde1722427ba0e2628bb9bc86
- SHA512 72a754adbdc352bf1d3433a3d63bda766d0821fcc506083ce5437648d444e3205cd5be7198a376f90e7b4df1dfc3fd34fd386a3704fb0dca76f4045481023eed
- SSDEEP 768:BcaNb2/itGt3JrbYbyQzZDgcEST3p4Jjrjh2je+SG2au8vxJKia5/Zi/wGQSxKFv:/b2/D8GQzZDgcEST3p4Jjrjae+SG2auj
- TLSH
  T114034C4043ECC527E6EF6E78A9B482A207BABEC37DA1D7990D84F0990C7379056113B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  RexVolt/Microsoft.Web.WebView2.Wpf.dll
- Size 81KB
- SHA256 0ff289bc88a73c69980973912b83ad5bd27dc769aa937552b8cea039024a7443
- MD5 e97d148c681dd6d423079aa234db9128
- SHA1 7185032cc158494b0892e05504911f4f1cbbfc6c
- SHA512 6f2e032250a43f89ba70017ba8c39d936ef3dbef52399aa49a93b6bd03c4fcd3732a0634af74e35c62483380bb57b38a1df4ca16657f73798bc7d80f4b617d2d
- SSDEEP 1536:Nh/Ha+IiqVNEWIGEPNqLYG5WCNhJ8BYYUDHfy7yEW30bpc4Jjr4YeUqTHhvU0sd8:Nh/6+IiqVNEhVNyYGksJ8PUDHfyy30bm
- TLSH
  T1CC836CA163BC4E23C6FF4FB8687441550FB9EB836A53E78F1588B4D81C9778125123AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  RexVolt/Monaco/index.html
- Size 45KB
- SHA256 e53d8af79885c576a48aad23f6558ead36b55356bf71b8836e26bb2ed01c4d18
- MD5 c5d2c00fda2770389a99868701414508
- SHA1 ee464b7858161d1b9eca2dc5fc46fc05708d0e76
- SHA512 97f97fa00bd4b9f4966205ddc8df766dd4e0a6326ed5b07da10e2dd8fc6c156b5005e57e4c71896597266fd7644712ac168e1b645ed4dcc4ba4b4f7d3ca1aaa4
- SSDEEP 384:eDNsfRXbeVuR1zJL+bcK2rCyegdzzGr+Lh88WiLeYY:eefRX4W+dAL1eYY
- TLSH
  T17023925DA60104396637A3AEBBE3930DFB361213AA0117597BECA2500FB179851F6FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  RexVolt/Monaco/vs/base/worker/workerMain.js
- Size 174KB
- SHA256 19b566655d73370a820a7d6fffe7af03dba3af4997016c0983be5bd188603ec2
- MD5 9ce9e46b6d66d8b2dbcabba577cad2ed
- SHA1 397b0e9e7b2bee37a8444e84bb9788a0bdcb023e
- SHA512 f322ea669fa81397066edef062721ae3dd515b3d61c4ad7bef0db0eb3a53f056da298fd4f761bd3e5d613e6f5803a7c35ed056085ac3b97e06c7bfd47fffad49
- SSDEEP 1536:mi5eQeCEwCP1m9JXKmA1xKzyOQJf9X2K7eM9bWXsUK5QSkSoIMQwr+ZjtQYyeTMO:mHTdkKmA1yyOQJl2K7ns6dZ/RVaNzY
- TLSH
  T1C9044CC53265984353E652F5A07B0107FA38B877680C556CF3A8C9DF2D6A88760BBF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  RexVolt/Monaco/vs/basic-languages/lua/autocompletes.js
- Size 2KB
- SHA256 1fbe4337327ef99c9caba74678cfff28652606fd667dbca34f12e809738010d9
- MD5 eb6fde8de905af68c855a2506c8a8204
- SHA1 32b172578f398151be79f78bdeb15eeff4a83020
- SHA512 6e95ecdfbabf20c2e717006ea00fa92d79e577cf262460cef7f3db7bb4fa87585bed99b6a1bd1d865c5e5184044b0244aa0823580c9444b1f2ff013057f54235
- TLSH
  T133517096B7CE6BAF598C33E8E5778406A69FE5336115883DFE0C90C420D3119E2E89F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  RexVolt/Monaco/vs/basic-languages/lua/autocompletes/base.js
- Size 521B
- SHA256 9a6c60193eb2dda7c2682bf9c7ff7e01b0f6000d70881583f0055782c8b2c619
- MD5 29e50887a6f1c445e0f63bed73eefb83
- SHA1 b8e006b9ad14bb6012497e164d9a4f926e2d568d
- SHA512 16cc7fd8b5641d347a6a9e8542a6ab29d71a432dfb2f72dae05b21b274d92208ec7c5a9ad1ba313658f3a68aebd9edc3d0bcbf07a03d0f16eae95568f175dbf4
- TLSH
  T1CCF0976BF78F30CA1E474385A73AC1495C6EDC32D2322035F51CEAA94488C2923468AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  RexVolt/Monaco/vs/basic-languages/lua/autocompletes/classes.js
- Size 33KB
- SHA256 75418233aff9a1401f6c467f8ca20999803436bc1ebb463123d1fb94dcff1f38
- MD5 fabe9b3ec7774eb374f18709ab41c8c0
- SHA1 de6c19413ef008000357bccea90faf0d23ccf605
- SHA512 d7b4a9dbfab0ec55e27b2ded86066b37ebea7d50b3b6b28f44c996f8280463176f1107c6bf15a52fb700f88ac3e0e7b87fb8a50664da9b31fc0e89a38d2055e9
- SSDEEP 768:EDVdzN+yYumzw/Wx5nYCH0e2zBsGMPv3lHhj4MyjKG9jn9/j7NFvHR0hT/YEkd3M:H6/W3YCUpqUDW
- TLSH
  T1E2E231E7F38C3593199B4784A27EC68539BEF6BDE4F10079782C5608079481933AB67A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  RexVolt/Monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
- Size 11KB
- SHA256 ce2e06aaa97355c4f68a0793c41d4e068b3e1a225f5376d9dd3f4016e0441c7a
- MD5 287b74a1ea581434cca8f9009f1489f2
- SHA1 877544929146171e416cc8fb33b0e7e49845df3d
- SHA512 4cd7b324ccde3fbca94ab948c4d831655125d6d4e2b237291b8e68f172cb375002c7ccdc49c3cfcf4ab6b7d65850d1a40bcc3f9979498eec697bae43dec7b54f
- SSDEEP 192:AJCfeXBM5iG6zUMmY7QMlr4qLYFQjG6AcE103aNd9xZAqGQ2qFARewPxHFTX0:9feXB2iG6zUMmY7QM54qLYFQjG6AcE1X
- TLSH
  T1B732BCF7F38D798719438786AB3DDE842E2ED938D93240B8F70C6615258C959232619F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  RexVolt/Monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
- Size 594B
- SHA256 9bd9c85c5d1f476e663889ab2008f83b323c8d794abb0df35d43091c689ef64d
- MD5 4d0ec8edaec389b1eba92c1d18676f09
- SHA1 6eafd8ed47700b9a2ff1e10dd7468e50fab1bf6d
- SHA512 d4c7655d7db8d4f7d4bb2d0add36bef916caf291b2855785685a3e812279369848ce081ac6fb5cc869fb827653a4a1f874273af17bee67987e3c3a441ad368e8
- TLSH
  T10AF0EBBBBF0B3697060B63C8AB3DD740192DC831C4624425F20C5B6040C0C2772360F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32