b158afc4fb23356c156bb596602b68871c52ed7c8a5c3a14c5c7da4dd0f44b9b

Sharing

Copy URL Twitter E-mail

General

Target
archive.zip
Size 4.3MB
Sample260603-jgbw5ab18k
SHA256 b158afc4fb23356c156bb596602b68871c52ed7c8a5c3a14c5c7da4dd0f44b9b
MD5 3e59f5134174756398c9f2272e0c2dd6
SHA1 7c8efef481a317a663baba5f0eaf492f90bdc79a
SHA512 1a97295a0c7f07fc00c6eb6002095c89e5877e090250692b23c7263913dde78f183873d1b1a7b64f4acb2292ea9ec3490a9747e4ea1dabfa6728ff1b523179f9
SSDEEP 98304:sxMU9+E3wyKINmlNAf0pHMPVuHtI+ZFHEsoWVc1BZz2:SMUF3wyKIU8vPVuNXZFFyF2
TLSH
T11E2633533A1A41279FA73ED0E8F1B1C56E4EF945D4BA36A4296F00FA826347D4CD93E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Aurora Worm v1-Cracked by RoN1N.exe
- Size 1.1MB
- SHA256 8cf921b743dbd651ff117768246dd1a851603e9ced1300a85a4eff94658cccc0
- MD5 6b8e9f4c10370aaaa30ea40a1a6b2cc4
- SHA1 e3c56f4a16291adaea2a626e0ad428bca8a2136d
- SHA512 78bf19e981b5795f1cebfd829b3a5de76da51189836d2d018b91edd53c21a613dcccb66044b23cbfcfe36d34d746b89b8fe05c9c9984a04d4581f2a474fe5ae9
- SSDEEP 24576:BflidXj4kthTE6mBcrcP5cCcMfVwHackDDsfouPLSuGlkh:BdiVx7+V77f4qsguPlGlkh
- TLSH
  T15A3523657714C01EE411BAB2C89DC33833756D2147862B06B5DFBEAFFF2A2494E122B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  FYI Worm v1.0 Cracked.exe
- Size 1.0MB
- SHA256 48f281b5cdad1a15f8f1e291ef4411e0ae851ca3307ab1cf6e9836d78c286b73
- MD5 557113d12f17a827d6591e7f462e0dfc
- SHA1 462887fddace5a8e092bca64e15b442931fad5bb
- SHA512 00a4e819791cbbb111ce62c82822e10e8a28856fd3a17ac1f96620278f3f2beb12ae9b99450004a9a55bbe9ceee07b4519e40365b851a5180b90a78473e00320
- SSDEEP 12288:9x8l/0f6v9CfjSfhhVTYEzd219eecijWmRgpuI9QLrpj7Ghcqk0ckwf/tV9frCZ5:9al/DYr2jdecijWmKKt0ckwflV9T4iQ
- TLSH
  T19E356C496E95C985F16EB7FE91159218DB72FC8126437B5AD971BC3222BB6BBCC000CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Uranium Worm.exe
- Size 1.2MB
- SHA256 19a1bde4c4af9240212d3b7d85117eb16d782d16c8f6b78fd1979b1fd5ada66f
- MD5 1b7b0cde5290b8c78fbcc93aea12b011
- SHA1 22768da558ea8a77169684ae07e2dd9a916c7533
- SHA512 ad93fd44e144bf81bac374abfda828843d44ec0ad5c6ff7faa364807f04fbcc1876f0d9b6938a4b35a0f002c1e719af58071f0b3bbad187c9a47e1b05faa94de
- SSDEEP 6144:GBy67Mvg3ujvyfOP5A0zWwk1+3UnH49t+J7g3ujvyfOP5A0zoW0lRg3ujvyfOP57:GBy672xvyfm56w84sxvyfm5exvyfm5
- TLSH
  T135454A63F88493F2D96D4632D097E5304B2B7EA78F110E297598738845F7260B726F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Worm.exe
- Size 2.1MB
- SHA256 36cb7ab2c9ae591155cca29fd718f88c8437607a9df08993199ce8a2c750b01e
- MD5 f34d63ee4d9edf5129c4b6b516cf84b6
- SHA1 209cbf06b01cc8773e4ef3f75104ea1cefdbb28f
- SHA512 f075a94698f15a6ef2f29c1d81360a8df9fec337d002e7b39429b445223ea27338333654ee715b7a607b81ea694271a1676545a45f4c5ab2fe1cb6851cefea15
- SSDEEP 49152:rOS9GqgWEJe5M1/3CKUW9Oje420ZXh9S8ivyIvaIAA4:iSodtJe5M1/8i4zZx9EbAA4
- TLSH
  T191A533BE12671421E6BD1D32217A5331E9783C69F9E0E8C3BD96D933DF34288DB1446A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  attworm/ATTWorm Cracked.exe
- Size 251KB
- SHA256 881cb0fb1d8fc32e7cc636c40602a189101f20f5926a7618658453b2d9318d63
- MD5 e4eed29dd468222723ce4281beb497b2
- SHA1 670a2b409e3b2be3145c2a1409f3483d1f143302
- SHA512 297effe85c3d1f0e0f040fb10308a7ff29d2a0f30fd72559d02af94f01ed7097603afe9599da6908fd600a7a874ce58b19271553884d10aa6462c118ddb1703e
- SSDEEP 3072:1mSN+RTX2EO3FgZCkUlXtzFFi/1E1udxFxOq5JYAI:1B+TkgZCV9zf8d7JI
- TLSH
  T1EC44601D37854A06CC58BAF889F6AD3443F05D854739CB876E78B1897A3A2E3CF8464D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  attworm/cracker.exe
- Size 243KB
- SHA256 6465bfa52574947bc3ae862896ef10562db3c3d8e8a990ed994049a6260cc5d4
- MD5 21f52e21e1f82e5c58665f3f6ef1faa8
- SHA1 a2058cfaf00ddaf6b7cfded0b9c9d7171eec15ef
- SHA512 70e38c752d08d8a2564ffda04621734ed847740d06a027744c107c46b454d7d232544e9fd39df5f32e3a851e6010a021c077b99ef9f128c542e49c12d282ea0f
- SSDEEP 3072:Q0SXzzBBs/kaT16qIPUDUT3OWzmDMG/y1R2ogli9pYYYYYYYYYYUAAAPj3i2z3Mw:TSDdBs/TG8o3b4MG/y6XW3iU
- TLSH
  T192345B863FD4C2A7D9BFA6F2AC6BC4659DB1B80916C6C1895EE7338518B3721018FF44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral11 behavioral12
- Target
  d4ta.exe
- Size 21KB
- SHA256 fa47cd33a4252fd92794182216f5295d45ee9ab29d9f2d26c192ceec5d66c36f
- MD5 eddb4cfd77fce7992305c228538d4259
- SHA1 49cd5b40c7dc2ee963bc4c05c197aaca267d5f1e
- SHA512 23b03c166db2313713286500e5b0ce5e09f4d1b9eb9fc680c0fa2271dac48e154719a24981f70dab68ee4637a6c6b3b5209fa01d4fd11b16147c48bc2777eaf4
- SSDEEP 384:trkZ4kg6bGY63fbvqU4ALf48XiQfstZY16pXVyXFY:tK4kXGYkfbvv4EN6jN
- TLSH
  T17BA24B1673E8C733CAFD1BB95862675402B1CE435117FB2F4C98356E2E773418E8269A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14