dae36a2e3c95407b969e7fe0b2212bd0a668c41907ca53e64f9154a64a9684a8

Sharing

Copy URL Twitter E-mail

General

Target
Themida Developer License v3.2.2.22 Full Activated - Advanced Windows Software Protection - WwW.Dr-FarFar.CoM.zip
Size 63.9MB
Sample260624-txmnnsdv6w
SHA256 dae36a2e3c95407b969e7fe0b2212bd0a668c41907ca53e64f9154a64a9684a8
MD5 f3e28f1f4aac7d936dad0b265c945c6b
SHA1 13f5fb589945e3cd4b9dfd6215ad38226a305458
SHA512 56a9152a84039738e6230a62fd4cf32f35d0762b18a660c426509cafc8057db9f73c29cf53009c338966adc83f07c27cc1723f8049b7b2ec70a4604e1b76613e
SSDEEP 1572864:SB0wVo9T0g/uWQPphsvc5LcVKIBWa3GCwMRC1abGXDU:Sd+bosvc5Lcd2DDU
TLSH
T142E733FF3F1B93DFE53AD56E656478AC94A525A3F7001C6BCA00BF65DA48480B12E072
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer

Malware Config

Targets

- Target
  For More Cracked Software.url
- Size 52B
- SHA256 8e124a3b43c2f662805c1ef3502ac0ac052b7a616add1327827c56c521342139
- MD5 e050b7240d330f8b25d0cee8c99475a2
- SHA1 bb930b01c5a04e26ba62fc5171fb6321c54e692a
- SHA512 fc21ba25bb351b79d8510448ad9383466ea62e5e7a7bd52cb9906b4be22be58cf6d88ec5093948a9900cfdcc7faa4ec6473054f51a95dec85cfed24fe9b6cb8f
- TLSH
  T1209002D28159C0558506444C5068E528E90324948463C4D495889E081C4B0515584208
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1
- Target
  More Hacking Softwares/Acunetix Premium Full Activated.url
- Size 74B
- SHA256 9a82e4c68ff883170fa929caf131096d352fa9cff02575bec831dbe37d609ce6
- MD5 7a900f2df610628dc105917697fe08e9
- SHA1 142165279f40b5c4910dc8ab6f06dc6ce793488c
- SHA512 03445c288f22a702affe4c1581bf05ec845be2b1a8b92d10f0c8de396d98644fbdc42d57e4031b06b7f56cd10dac462d06e3c910e9aa154ebaeee57181c203a1
- TLSH
  T150A011AE8208C0A0C082008C00A8A228A8032A8080B2C0C08088AE080C0A0208A80208
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral2
- Target
  More Hacking Softwares/Binalyze IREC Dongle Tactical Edition Full Activated.url
- Size 90B
- SHA256 9c6cc9c9eae1394af4ff571c1afbe0e8671c7dae93554c5cb81330b026cb03cb
- MD5 39d003d70195fb8b39a44d80266c037a
- SHA1 c5dfd2d824d2c7477c6efde2abc2d8b4a1c6d2d5
- SHA512 9fad163742a9bb37ce4a6746af4bb8ccfcf5ad609ecf6ac3a51df49324e156adef75ec8127b10c57dc68511b086ed040029e783d076f34c2bb3713febd49d63c
- TLSH
  T1E1B012C3E0448029C90740384054B1A4FA0710418C92C5D450454E0A0C07151148490C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  More Hacking Softwares/Burp Bounty Pro.url
- Size 68B
- SHA256 a33531e8d343a6710f7cac735eba9bc28a7524fa5ae74eda405053dcfacb9d7f
- MD5 7b76adbcfd30495fcac2dd5a121aa112
- SHA1 59367ceb553caccb87a587fa3457357248ff569d
- SHA512 5cdc27fcf581402c96752a89acb78d9199ec87e19eaa3f6d753b1a2871904399ff6a4e3c01dbd4b778961264219d0231e4c2f61c3b4889a828a994c8878a913a
- TLSH
  T14EA002D2C569D06AC60AC49D607CF63EFA4325D48CA3C8D4D2C8DE091C4B1515A94648
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4
- Target
  More Hacking Softwares/Burp Suite Professional Edition x64 Full Activated.url
- Size 81B
- SHA256 56d2cd7efb2dd56ed123ec499342fae7d6ae56be553b94d0d9c4a7365bbed31b
- MD5 73b1c602455220a1a87090d3bb55fc15
- SHA1 a90da109b75bf02085dadc063477f764dca0ef1d
- SHA512 9a1da9acf6b086ea6ac7c6d645f965af27a759b3f30df2c9946d479a6b0b617c0d27c4f647933e0a874b8d86b458c083eceb79d1b9030498ddd22227810e78b0
- TLSH
  T1C9A01285C018C052C606489C0075D53AAA032140EAA3C0945244D9080C061001141185
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5
- Target
  More Hacking Softwares/HCL AppScan Standard Full Activated.url
- Size 177B
- SHA256 d815eef74603b3cdbe7d496409d26a3a9d67d9286a083b560f9175e33582bae5
- MD5 ff5dbe5d64fc711c8de9f0bf12cac313
- SHA1 2e443e25e825e4a2379311fb234d555971d5b182
- SHA512 ffe2cc98db69c0c500d68876d73d593b09b8d61cbb4e7bf631a9a2f298902fae25ab22c3f29f9aca34455d6cc168fb1f3e7a22dff25eba89ae774bea1c1e836a
- TLSH
  T1DDC08083CA19C455D26F240DD171B63DC4475552E8D6E76445A4ED0C4C3FD45AAD8104
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral6
- Target
  More Hacking Softwares/Invicti Professional Edition Full Activated.url
- Size 78B
- SHA256 220ff193f2b2eda0024f019841a896f4d8edfebe3ed7ece9bd89f73cccec3304
- MD5 e51206f2549fba8d20d95568d7b89014
- SHA1 18a3dec89a41171798d80d05917714dceb21b999
- SHA512 047d88998e3f3cea0b8b9c92fc72ec56eea32e1d030b2cc00d8e7e905d3ddb7e30cd7f69927844794ccc1949b61b08823b08792fc97f82000f5b72d8e3d17448
- TLSH
  T1B3A0118A80ACC0AA8A0288080022E02AAA032080E0E3C0A08288EA080C0B200028828E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7
- Target
  More Hacking Softwares/Magnet AXIOM Forensics Full Activated.url
- Size 83B
- SHA256 8d46317f8e81394b18045539599f21701324b504ad52281845156b24e25e7f03
- MD5 89c320b55e2cbb807913677a5aff4028
- SHA1 f095717983621582e98709f5e6f8f4dcfa500d98
- SHA512 c6832345d7e517acf7aa10735b8582f7fdfa29170577d38d4c0c643f52881af038651aed1a0116a105621d142d5cb80dc15f367bd790dffff2421337ab816deb
- TLSH
  T182A012D38408C01C9511444C545494198D0328C47072C0C0C485CD4C0C4E0310180308
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  More Hacking Softwares/Maltego XL Full Activated.url
- Size 68B
- SHA256 1b43c9adbf2904bd5597e243fa482695a95f0b32d87bc4a4162547bd2867033f
- MD5 869e9ea0f31d08d12cd76fd40b7f727a
- SHA1 6e2b19ed50592599dcb443fe2503a2c86e9371d4
- SHA512 28d09003ad362179d80539712b78307ac3314fcd15d60e0a4e85ac05ee318334d034d1fbd024a330c8e71a37f1f938dab7d7de18d5709294560f5553800a5780
- TLSH
  T127A002DA895DE0D5D727548C60A5E62DED072598E9B3C4D491989E091C4B0625584248
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral9
- Target
  More Hacking Softwares/Metasploit Pro 2022 Full Activated.url
- Size 64B
- SHA256 5e789e9783d20bf639776be9147baf216f431bd17c5cabe8d0765b95a26a6a53
- MD5 93d9f92bbff7d8c9e7047ba0b52000b4
- SHA1 cb857f108a526bade38596e2259c32211ef6ec39
- SHA512 ab7f4fd3c0f235e308e25af43044f39216c0fa2accece1c905b3f997c3ee2c00c18c2d6d3237050fa7c7c2d0df9ea6c0a32bbe802d73e969a48745de674db99d
- TLSH
  T180A002E3D4AD84D09516844854B8E71AD9032C94C4A7C4D4E19CDE1D1C5F0935190249
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10
- Target
  More Hacking Softwares/MobaXterm Professional Edition Full Activated.url
- Size 83B
- SHA256 48ced926e5bf277af023522f36d671c5c192355b0503d7e015fd9b8b7f4e2f12
- MD5 a1d6038c32b6c12a7acca44cd886800a
- SHA1 efb8721599374f15e4542f036b119f09a07b54f9
- SHA512 4372025d6a504eada177039274284166b39d6d6e39b90586be66279f0e5c39b9a28c45387f031e264bf10424c015664138bf861473015a6d80c4b0933afcf624
- TLSH
  T10DA024D3C00DC450D707C04C5077D51DFF1331407453C4D05344CD140C0F10014C4D05
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  More Hacking Softwares/SQLBOX Ultimate Injection Tool Full Activated.url
- Size 328B
- SHA256 372e6342c67dac70fcc5c4d17d064f580f2554662111e4215815b76b8ddfbc68
- MD5 8c41f16bd33bfff3ddf9bbfd77d3f255
- SHA1 c088b63f574814704575980a4ec2bb7ffb40ed5e
- SHA512 3ac07c54481822d7e4f2bf9cef3fbc889c77afa5e53d4cccb7c035bf42de4bcd10eeb62d0db851c4d1feb6e5a1b5f84c4a9c366f08a3b436989b068c7979c975
- TLSH
  T176E02DEBA8C2CC53E2B3010120A1B988D51BB82804E968FA120CD8C81CC80A3C106F36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral12
- Target
  More Hacking Softwares/Splunk Enterprise Unlimited Full Activated.url
- Size 70B
- SHA256 a16f0ed54bfbf3261f736046f2b8c84bed086660e9c3e980985c12acce3900f7
- MD5 1d75adf09df04a5308170d76c421c93d
- SHA1 52baa74e00d3b4858151f72f181cac2f52982aeb
- SHA512 c3ca6cdead3de63c7cc32f29376fbd44a452d18905443fd869302a8be79defee15118441716369125446eb477948576000188fe342e5b83d23216ed8e51893dc
- TLSH
  T184A002D381AEC0668507845CD164FF28DD0334949477E8D496C8FE895C9F0D99A84708
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  More Hacking Softwares/xRay Web Vulnerability Scanner Advanced x64.url
- Size 92B
- SHA256 9759bf71dfe70ea55386c6aca92d9ccd9f7d4d3f44978202feb5e5829ad87b1a
- MD5 248b26e9f039458be7a188b46f632c92
- SHA1 2f453ee0f1941e9a8ab09d9b7b1616c37f5db175
- SHA512 7e327b540247801a1f571b3b74187aaa437a58653c92a802333c63bd3d64aca14cecf8cddbd88d279d62846943eac9fd25d378fd3480d650e9dc6b3677abcd55
- TLSH
  T1FEB012A2D25880358409044D4624F03485033840C532C8D0C1884B1CAC0707300C0208
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14
- Target
  Setup/For More Cracked Software.url
- Size 52B
- SHA256 8e124a3b43c2f662805c1ef3502ac0ac052b7a616add1327827c56c521342139
- MD5 e050b7240d330f8b25d0cee8c99475a2
- SHA1 bb930b01c5a04e26ba62fc5171fb6321c54e692a
- SHA512 fc21ba25bb351b79d8510448ad9383466ea62e5e7a7bd52cb9906b4be22be58cf6d88ec5093948a9900cfdcc7faa4ec6473054f51a95dec85cfed24fe9b6cb8f
- TLSH
  T1209002D28159C0558506444C5068E528E90324948463C4D495889E081C4B0515584208
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  Setup/Themida Developer License Full Activated.exe
- Size 64.5MB
- SHA256 cc6df0b982634942f3602fd35f2744b3b5dbc40936b733191fda3c080375e593
- MD5 4034b6a954655b4d806edfa4602a47e4
- SHA1 423c5b770598a3bfe5598264b14b2451bc6858f0
- SHA512 d3f5f5783a1f9d2233c68e6e24e881767badb9467ca4ca41a98dfa7795f0b6b6101a2b7a128351336d2233b47e5d01bb53c169ec57f15a15e368e599e09bb79d
- SSDEEP 1572864:83wbgYnISRTLrwYXEHzoJMoV+8dAMa65QUhcXknXT:Ps219XEHkbOYRXT
- TLSH
  T15FE733177B8B613FF03A863A49B6E169443B7E62B6124C67DBE0496CCF150D02D3F266
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
behavioral16
- Target
  iNFo/Dr.FarFar - Facebook.url
- Size 134B
- SHA256 a89b9f4684617280c8bbf7574f0ae44ca3c52ecb7b33b2b0266ee5b169fe27ac
- MD5 c0244bec9dd8d623f0508d09f8004349
- SHA1 08a68ecd39802b754ecd8afdb9f967f6804e84a6
- SHA512 3a4c75d0ab45192e2ba9686b8dbd613a568ff747d465f1d500661ce324b25edf59e6a81662754ce28626d5b4cbdd7f626bf14bfb19b5f0d22365710f750e7072
- TLSH
  T17CC02B5D00058185D220541550B0F544844F38540CC2C1DC2104DE961D440C1C44C63A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17
- Target
  iNFo/Dr.FarFar - Twitter.url
- Size 128B
- SHA256 26b06c326a968aa5546eacf8b0269027234a439a4e321b79c4cb8199de18eeb4
- MD5 ddfa6f021ac7e0756c02ea182e8fc8ca
- SHA1 495802e4ef162b8e251437581c03b29d5f9a1303
- SHA512 c8ef3bad4e5d226dc0bfa0ce89fcb1e68bbcf658c2d12489b64b99a38e9feb86eaafa0c0bf8267fbdb2fe61da07850195f1219d967908b92aadaf16c1dd06e99
- TLSH
  T15BB014FD4105C155D75155075070F5444C4F75554DD3D4DD534CDDC74C450D1C555737
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18
- Target
  iNFo/Dr.FarFar - WebSite.url
- Size 51B
- SHA256 4eed151d3585128533fcbb75800345713723dea77797106387305e01899d8e6c
- MD5 7ad190beb0fb993470789038786cb669
- SHA1 8cac00290b8385ca77346339ed654f4256182132
- SHA512 d00068cb2b6257564e4fe55b1ba11f84333ab0562147db61b07c65625ef335bef753ce62fc3fa10135967a891ec535b5f680ebf3fa6e94d05517158f4951642d
- TLSH
  T1089002C88159C0558406880C60B8D524E90324D08063C4D495889E081C4B0416584308
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19
- Target
  iNFo/Dr.FarFar - الصفحة الرسمية علي الفيسبوك.url
- Size 134B
- SHA256 a89b9f4684617280c8bbf7574f0ae44ca3c52ecb7b33b2b0266ee5b169fe27ac
- MD5 c0244bec9dd8d623f0508d09f8004349
- SHA1 08a68ecd39802b754ecd8afdb9f967f6804e84a6
- SHA512 3a4c75d0ab45192e2ba9686b8dbd613a568ff747d465f1d500661ce324b25edf59e6a81662754ce28626d5b4cbdd7f626bf14bfb19b5f0d22365710f750e7072
- TLSH
  T17CC02B5D00058185D220541550B0F544844F38540CC2C1DC2104DE961D440C1C44C63A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral20
- Target
  iNFo/Dr.FarFar - الموقع الرسمي دكتور فرفر.url
- Size 51B
- SHA256 4eed151d3585128533fcbb75800345713723dea77797106387305e01899d8e6c
- MD5 7ad190beb0fb993470789038786cb669
- SHA1 8cac00290b8385ca77346339ed654f4256182132
- SHA512 d00068cb2b6257564e4fe55b1ba11f84333ab0562147db61b07c65625ef335bef753ce62fc3fa10135967a891ec535b5f680ebf3fa6e94d05517158f4951642d
- TLSH
  T1089002C88159C0558406880C60B8D524E90324D08063C4D495889E081C4B0416584308
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21
- Target
  iNFo/Dr.FarFar - تويتر دكتور فرفر.url
- Size 128B
- SHA256 26b06c326a968aa5546eacf8b0269027234a439a4e321b79c4cb8199de18eeb4
- MD5 ddfa6f021ac7e0756c02ea182e8fc8ca
- SHA1 495802e4ef162b8e251437581c03b29d5f9a1303
- SHA512 c8ef3bad4e5d226dc0bfa0ce89fcb1e68bbcf658c2d12489b64b99a38e9feb86eaafa0c0bf8267fbdb2fe61da07850195f1219d967908b92aadaf16c1dd06e99
- TLSH
  T15BB014FD4105C155D75155075070F5444C4F75554DD3D4DD534CDDC74C450D1C555737
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral22
- Target
  iNFo/For More Cracked Software.url
- Size 52B
- SHA256 8e124a3b43c2f662805c1ef3502ac0ac052b7a616add1327827c56c521342139
- MD5 e050b7240d330f8b25d0cee8c99475a2
- SHA1 bb930b01c5a04e26ba62fc5171fb6321c54e692a
- SHA512 fc21ba25bb351b79d8510448ad9383466ea62e5e7a7bd52cb9906b4be22be58cf6d88ec5093948a9900cfdcc7faa4ec6473054f51a95dec85cfed24fe9b6cb8f
- TLSH
  T1209002D28159C0558506444C5068E528E90324948463C4D495889E081C4B0515584208
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23