Overview

overview

10

Static

static

10

BtMob 4.5....ob.exe

windows11-21h2-x64

7

BtMob 4.5....rk.dll

windows11-21h2-x64

1

BtMob 4.5....ox.dll

windows11-21h2-x64

1

BtMob 4.5....PU.dll

windows11-21h2-x64

1

BtMob 4.5....es.dll

windows11-21h2-x64

1

BtMob 4.5....re.dll

windows11-21h2-x64

1

BtMob 4.5....ms.dll

windows11-21h2-x64

1

BtMob 4.5....pf.dll

windows11-21h2-x64

1

BtMob 4.5....on.dll

windows11-21h2-x64

1

BtMob 4.5....IO.dll

windows11-21h2-x64

1

BtMob 4.5....ew.dll

windows11-21h2-x64

1

BtMob 4.5....pi.dll

windows11-21h2-x64

3

BtMob 4.5....pi.dll

windows11-21h2-x64

3

BtMob 4.5....pt.exe

windows11-21h2-x64

3

BtMob 4.5....t2.exe

windows11-21h2-x64

3

BtMob 4.5....db.exe

windows11-21h2-x64

3

BtMob 4.5....ni.dll

windows11-21h2-x64

3

BtMob 4.5....-1.dll

windows11-21h2-x64

3

BtMob 4.5....ne.dll

windows11-21h2-x64

1

BtMob 4.5....rs.dll

windows11-21h2-x64

1

BtMob 4.5....es.dll

windows11-21h2-x64

1

BtMob 4.5....ry.dll

windows11-21h2-x64

1

BtMob 4.5....rs.dll

windows11-21h2-x64

1

BtMob 4.5....fe.dll

windows11-21h2-x64

1

BtMob 4.5....US.msi

windows11-21h2-x64

6

BtMob 4.5....de.pdf

windows11-21h2-x64

3

BtMob 4.5....er.bat

windows11-21h2-x64

1

BtMob 4.5....gen.py

windows11-21h2-x64

3

BtMob 4.5....min.js

windows11-21h2-x64

3

BtMob 4.5....on.svg

windows11-21h2-x64

4

BtMob 4.5....nt.svg

windows11-21h2-x64

4

BtMob 4.5....ck.svg

windows11-21h2-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    BtMob 4.5.5.rar
  • Size 891.7MB
  • Sample260605-pcb9zsf14m
  • SHA256 6dcdbf9ba3cddddee36cb13dbb4e32026ff05d176824eb31a778f26f384bddf5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xmrigadwareagilenetdefense_evasiondiscoveryexecutionminerspywaretrojan

Malware Config

Targets

    • Target
      BtMob 4.5.5/BTMOB v4.5.5/BTMob.exe
    • Size 8.0MB
    • SHA256 a453e7478f7a170dd35f82540fd153775c4d83bdb25ef1ecfcebe10719778caf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    agilenetdefense_evasiondiscoverytrojan

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/DrakeUI.Framework.dll
    • Size 1.6MB
    • SHA256 70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/FastColoredTextBox.dll
    • Size 323KB
    • SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Magick.NET-Q8-AnyCPU.dll
    • Size 12.2MB
    • SHA256 1edfaa0f15c8dd928f3925dddd72c1572f8025b75c34305e128b001e1daf9cb1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Microsoft.Bcl.AsyncInterfaces.dll
    • Size 25KB
    • SHA256 8fdf7184ef57acf0ecb94841dcf7ff2efe482022d394748452c84a3f2ff2ea43
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Microsoft.Web.WebView2.Core.dll
    • Size 616KB
    • SHA256 642c61c8058209cc33bb79eac3fd112eafb7c1fc65145ab5e359cdc89236a08c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Microsoft.Web.WebView2.WinForms.dll
    • Size 38KB
    • SHA256 f27dcef62182f02049c47a2560ac800a3eb6b9fae2ce95fc074c596251b960db
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Microsoft.Web.WebView2.Wpf.dll
    • Size 80KB
    • SHA256 022fa59d15a167188c4ec58b2e9926b3fab0b55944d89e1d783459dc060bddf0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Newtonsoft.Json.dll
    • Size 695KB
    • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/ObjectListView.IO.dll
    • Size 11.5MB
    • SHA256 53cb92203fbe414fec428c06d46875c6c4ff7c4ac8b54428fd3a61318e9783c1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/ObjectListView.dll
    • Size 434KB
    • SHA256 0b94b3824761723400dc0357e7d490085a5ccf3415e332155c5b8d6c7bfb8788
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Resources/tools/AdbWinApi.dll
    • Size 95KB
    • SHA256 d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral12
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Resources/tools/AdbWinUsbApi.dll
    • Size 61KB
    • SHA256 25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Resources/tools/aapt.exe
    • Size 1.6MB
    • SHA256 aa18b5646881ff3b8ca9879045a1b4a44e2d5b24fbe14486fc8236789de8237a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral14
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Resources/tools/aapt2.exe
    • Size 3.7MB
    • SHA256 fb89f3b5406a5fa3a0849b057063c4205d0774c7f363d055048e35313e070b79
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Resources/tools/adb.exe
    • Size 5.7MB
    • SHA256 348179b6593cf255bed4f79df4f298a8d449230f596ae033e29f5d28647803b7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral16
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Resources/tools/libaapt2_jni.dll
    • Size 4.5MB
    • SHA256 a439a9bc2981c5f11a2bb75578f66f2b5b6afa328af05f8139321ddfe8322fad
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/Resources/tools/libwinpthread-1.dll
    • Size 76KB
    • SHA256 3f41452eb1e3aac78fd29e83a530154ff8ae66f2e70a9d54b92ed49b57cdf2fe
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral18
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/SuperSocket.ClientEngine.dll
    • Size 41KB
    • SHA256 9863a8ca0fd55fdf1de8d64cb89d034fc009a58220d45c5f4f83c6cdd0c5cbfd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/System.Buffers.dll
    • Size 20KB
    • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/System.IO.Pipelines.dll
    • Size 82KB
    • SHA256 f19d78c5cffddeae66a79d772fa0ebb30c101912fe7cf7541913308b54cf79cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/System.Memory.dll
    • Size 138KB
    • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/System.Numerics.Vectors.dll
    • Size 113KB
    • SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      BtMob 4.5.5/BTMOB v4.5.5/System.Runtime.CompilerServices.Unsafe.dll
    • Size 17KB
    • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      BtMob 4.5.5/Requirements/rewrite_amd64_en-US.msi
    • Size 5.8MB
    • SHA256 37342ff2f585f263f34f48e9de59eb1051d61015a8e967dbde4075716230a32a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral25
    • Target
      BtMob 4.5.5/Server Installation Guide (OLD)/BTMOB Server Installation Guide.pdf
    • Size 60KB
    • SHA256 08ace129827c3a7a0355715d415cd4bc7db18cab9ec222017f864100083ce8f4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral26
    • Target
      BtMob 4.5.5/Server Pre Configured/Database/importer.bat
    • Size 687B
    • SHA256 91d3b65d08b824f2a53f46a24fc72d7a8aa044b8c92cc91a4e0c7cd3426c092e
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral27
    • Target
      BtMob 4.5.5/Server Pre Configured/pas gen.py
    • Size 1KB
    • SHA256 113ff8960a3f672c539ba7b82d28e1872537f699480882dba8315dd30d2121cf
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral28
    • Target
      BtMob 4.5.5/Server Pre Configured/yaarsa/yaarsa/assets/dist/js/dd.min.js
    • Size 45KB
    • SHA256 cabe8a67a5e1dac12c2e99dc3765fbf1b980a880e3c948dbc726502c6b3271a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral29
    • Target
      BtMob 4.5.5/Server Pre Configured/yaarsa/yaarsa/assets/fonts/flexslider-icon.svg
    • Size 2KB
    • SHA256 fe05d413d5f66598c23b6713d372382e107f03d2e5523434dc32a19568798ef2
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral30
    • Target
      BtMob 4.5.5/Server Pre Configured/yaarsa/yaarsa/assets/fonts/fontawesome-webfont.svg
    • Size 306KB
    • SHA256 beed91f60f61e115d1ef490241811ff6b12f595c7f1301509479aab8041bd3cb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral31
    • Target
      BtMob 4.5.5/Server Pre Configured/yaarsa/yaarsa/assets/fonts/slick.svg
    • Size 2KB
    • SHA256 8ca11b5fcbff92ee6378017cf6832dddfa745253202d7c8d01f42d5d17c4cb5c
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

agilenetminerxmrig
Score
10/10

behavioral1

agilenetdefense_evasiondiscoverytrojan
Score
7/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
6/10

behavioral26

adwarediscoveryspyware
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
3/10

behavioral29

execution
Score
3/10

behavioral30

adwarediscoveryspyware
Score
4/10

behavioral31

adwarediscoveryspyware
Score
4/10

behavioral32

adwarediscoveryspyware
Score
4/10