ef82c6322bd36f60e3d20009d7ea59910e6234b6c4c4937b40a443b49adf2114

Sharing

Copy URL Twitter E-mail

General

Target
Raid-Toolbox-master (1).zip
Size 652KB
Sample260628-252rkagz6q
SHA256 ef82c6322bd36f60e3d20009d7ea59910e6234b6c4c4937b40a443b49adf2114
MD5 5f4be97996f38232fd9b289146d8c3ea
SHA1 73e06701eab66f369feba9d29c8c6b14f3fcf738
SHA512 73d6f37b6ac6f5ee5ebd73943f0f2c9da6bf4f573a6f4a681fabcf2ddb32d2b45ed18032fdae0dac0f2efd12cf10b31ed524ad5830d07efbf85fede6485c9a47
SSDEEP 12288:e59vHPWZ5DxkrIML2xkru51NiQ1bdz7rafpBdH1FetnVaQ1cPvf:enuTDarIML2xkkb93ahBdHAVarP
TLSH
T176E4230997C219E0F28AE17FF2D5B3D2BFA1CD301D61410789C6A6B92C8B11DF4D66E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Raid-Toolbox-master/RTBFiles/ServerSmasher/smconfig.py
- Size 2KB
- SHA256 95c0f1b4814bbc0af7a52c8eda813254c45bfe4501daac3fded7f1aeb60f473e
- MD5 ab572cf7593d2fedb543280fda3b6d6b
- SHA1 2817a4d3d7c7699629ead7c5a42753c64298abf6
- SHA512 8597ce44725fcd618652870877a2b62fef71397f368930cfdfac5b9c55d45cccc237caf19ac5d13a8ac30264d3e6d3baa95ae8fee824488a326fea8e6c6f91b6
- TLSH
  T1D651970DAED4123315B056A7568D32C66FBDE0BCD241A111D29FC81CF660A290CFED4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  Raid-Toolbox-master/RTBFiles/attack_dict.py
- Size 20B
- SHA256 ceb44a7edf88eb3b31cf90bdb76f47cfa436a710acf0d5c1c769164e3677ffd1
- MD5 36c02632d6bc6b6ad5c31001c6f26c54
- SHA1 450d6f23ce00c2f89c89d5784c6788826dfb68d3
- SHA512 711ef59a9254e5d7a466e5d7bd214f5f87e388c1a9ba9e12a455b3a4eb74eff7e36700b4727f959108ecbd27fdef5d447642a681b07d8a671f87d516362e3857
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  Raid-Toolbox-master/RTBFiles/cleanup.py
- Size 780B
- SHA256 19a27ff6e31ca68c8e472439cb67958a4f3ba46d0d61d560b0a63fad25cd26ac
- MD5 fd4d59459e5f10803e2ff55a28e56015
- SHA1 18427d92f163df9149f295718fb036f705a2798b
- SHA512 ae8ce87dd2403298df2e26f8ec04e76f882d3bb18dc81cb88badbdf131d2e99869353ce21e4631b136d356a26468f3488c3d3122f7f55fbc8a24511b1f1ba80a
- TLSH
  T1B3019005D41F2C3696534A86E4B2E043773A756A580B3034B6ECA19D5FAC061D34EF11
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Raid-Toolbox-master/RTBFiles/extras/diagnose.py
- Size 1KB
- SHA256 b7388341fa1dacded3145db73745115e8d09b8c774abde393dda244ae7bc9fae
- MD5 86ffd5f6302c0c9124ef8a61ce020b2d
- SHA1 71124618fc3f0f3c0ec16cd15f05c05540c18943
- SHA512 fcc2297d8de5659fa18d46ad49f9f7dc67529e1bc22c8acac7e20901a05059bdbd036e8ba6723c3dbebeb69d97171e7f764f5e5061bdf5607ae0e6fb363d2536
- TLSH
  T18D313312CD1108A2C327812C8CB1C014623B3E275ABDB539F4DD41A88FA13BBC2758B9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Raid-Toolbox-master/RTBFiles/play.py
- Size 1KB
- SHA256 017f902941e7fe4e0196b2f800c184948e92cbf7acf14104f5e625c9d14a9869
- MD5 d9033d4fda1de0e92e2c14da7300a6d2
- SHA1 51bd5a634107165baa0f742afb5209933330feb3
- SHA512 a1d907e67820cd6cdd364b30925f3fc523825f567be2ff3bd86cb226b178fb603015b240c5a23dce998d7821e5525d9830d4a7edea904e49cba0d3b58aeea7e5
- TLSH
  T172213D03983C2CB2872B4D544D644212173268675F49A668B69CF356DF48227D32BFBC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Raid-Toolbox-master/RTBFiles/player.py
- Size 1KB
- SHA256 8f24cea57511504f0f563a28070eb60e5a675f89a6538f0a768c7fe214d3d81e
- MD5 b435245c52431aec6f6574a8760fa9ba
- SHA1 dc05f39beeeeb31e0b50c112d143fd193f6172f0
- SHA512 a5a4bfd9847b363872cfd60a43b1104127d255a6410621e7cfe7c6cc940776d9ef53b5148a2da5a3393093ccaa7b69ea55aaaac7cd6adc5a644b721a35701b45
- TLSH
  T1333161E6CCB2A455A39851D61DDA68D2FB00A4078F4525317FCDC2280F6CB66D1A0F35
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery persistence ransomware spyware
behavioral11 behavioral12
- Target
  Raid-Toolbox-master/RTBFiles/vcspam.py
- Size 1KB
- SHA256 9cefba19fd46624ed528fddce0cbce5d37e32202622dad25a3218c0d057037a6
- MD5 bc7ece4db198171ccc42c7e49c3b035e
- SHA1 c13a0cdc83ee6d4166cce12d4138e9bfb5ae8d8a
- SHA512 edd301fec21aa7f67663a73d0b96cdd364284becb5e95245b1b6708547a6904f16c69df8aa8d1522dec40183298bdcd6b6bf04b94fb92522964064d44b956c21
- TLSH
  T1DC21A249C52B2CB28357254444B2D0162B71A69A0B07203CB5FEC38D5F981F7DE5CE93
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Raid-Toolbox-master/legacyplugins/Copypasta Spammer (Example Plugin)/copypastaspam.py
- Size 499B
- SHA256 013e87209be2b47acd6538334fdfaa9048e6bdbd820715278ad700ea2c8de5fd
- MD5 7c66ec96f299280331de959ebb56c1f1
- SHA1 aa1871f742920c290ef7665b683b4450c2fd4fca
- SHA512 a5ae058488518e16705b195966e5b8399d52f0ceed5e2c280362f9f93293d6415e6fd4dc73d767b03f5babce839f4fc1d07ede899a5f76678be9da9f196c0dfc
- TLSH
  T1E9F09EACD0022F3281430655C921F082737524BA560B703835EC834B9F85077638EC21
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Raid-Toolbox-master/legacyplugins/Copypasta Spammer (Example Plugin)/main_copypasta.py
- Size 2KB
- SHA256 20a46452db5b0b47d95b88cce4cdb1609ea96260f50b7aeb4c5408289a8d332a
- MD5 eee15c5f5e783036ba407b7fcfc44f96
- SHA1 c04db9904e0ea3f99c29a3b51984837321603ba8
- SHA512 daa6190cd62c78a39bbdf7c388ca41cabff27f58f5df8091d02d5480a822ff5bf2c32d0397227fed227b1dc5d206c7a30576485ee82d3015cbae12520ca15e32
- TLSH
  T13841446BD188233644B01423BE98E2F29B04A51F6366C4A47C7D81E97F931B36773AD1
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Raid-Toolbox-master/plugins/Additional/ghostpingmenu.py
- Size 4KB
- SHA256 ad26e8144fa3fc633efc0aa513e2a7a54976b27064adc4f30b3b3a773fc12e69
- MD5 e9c5fb1822345d08ec13b1faa0db9650
- SHA1 11a2363aa3b4f0010e091835c2399b1d30d3566e
- SHA512 71f69ed6576c1d515e24a897cf97e6e2a54e6dad64c5179a259d1aceeddb25f6b8f4a3ca9dd983828b81d62de4eb0291867c8acf84c480e67e1b6277c3139082
- SSDEEP 96:k55EV/UMg/s8n0nEFukA8N3TNZdkDY/D0paeO3SmaeO3Szd+lJaeO3SGaeO3ST08:k55Q60EFukA8N3Tfd2YroaeZmaeZzQDg
- TLSH
  T17EA15462E41B403766BB908DC48AA12227977E5B4C58B37032CDC698DFA9625D9B33DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Raid-Toolbox-master/plugins/Ghost Ping By DeadBread (Example)_rtbplugin.py
- Size 668B
- SHA256 2f9de7bf9eddde230cfc5a05d6d2d9a53a8d4f830d75a73d660d092565b94520
- MD5 2852ba92898d7453aa1e0433ef581458
- SHA1 5d8ab038cfd1d1bc6d5a77a2018e6745459a14ab
- SHA512 836a751995a824591eb7b65913b3653f705ea270b2aeeff9ee43e1687d5d85f5c4c12204000ad69ae7ad4e9cc955b684ad641eceb99b2afa1c124b81d455e607
- TLSH
  T1B701DD538319244282F1427108E218B13BEC75071B09843235BD1B706F23E3D8537E9A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Raid-Toolbox-master/themes/DeadRed.py
- Size 205KB
- SHA256 ed4e957ee51bf1b9f4f5758a0f21a4605005c5e956c4138b51d6dc687606b3c1
- MD5 12c7368bc930dd59c29a2dbfe6b4b2fe
- SHA1 2ed362e36fda44ed2d1ce4125ce048faf16c64ab
- SHA512 2f112481f7bd0c6afe4d95577ad5b2bcf3f7130919506b9b6880f7fee9afb7280f554398fbc92a42ebc89514b9407080f168b5bc71344e01539e37cec8307b6e
- SSDEEP 3072:2f1B2S3RjI5vlAidwP2cD0+tSBfEYJ+LqZ5ZpZe5dPmDxp0ZI4nwKQwQg+Zfa8:ExBi6P25x+OZ4yz54wzhZfa8
- TLSH
  T1A324233185682D4B0F9803F3B5EF24A1BD129E9FC1486F197F6D2A9267CBE4BB14D610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Raid-Toolbox-master/themes/Future Bloo.py
- Size 349KB
- SHA256 0345f7c773d04040801b4ae2843b3bf40343a5abfb7336a2b7e7770e7434d2c1
- MD5 312a37febf50fecf20d81ba89056c12c
- SHA1 7ba4bd88f3954a9be4a896c6c4639fc94bce259d
- SHA512 6e470fd3e644121fb1188897c4c3dac9bca0afc6ca049072ad56f2453e3e802c3a8a8b48b67c000149b015c56a142ad15882196458f6bb9616d6b03d8548fe13
- SSDEEP 6144:YxC7ltLYvtvlWZqczZC/HdCe2/CBzOay6zxUlgW69X66RB8UAO8j+zE:YxK3ktvUEcVaHCqBKavGK9Fn8tObw
- TLSH
  T1D4742371EE497C28076A876C32765B55BC325AEE674CBBF0725AB4D7038CFC07862249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Raid-Toolbox-master/themes/Template.py
- Size 2KB
- SHA256 8f3b896866bad748122b687ef2589c4a0535c990371e3df169817605f8b4f421
- MD5 a1e5cdbf290a08ac7b99712166656811
- SHA1 bf296bf74638541c4b629012c07ce9d7206771d8
- SHA512 15e8b1e501c1bce847323ab1c051d1215c7a6b6ad8027518ba0170d1486fbd6bbf32936a423e7f3e36aa8c0f61a51a75d93bb705062c642fbcf6d4c18d6bd25b
- TLSH
  T1EF41DAD0C98F0A577B6B303C28CFF18CA40D70059ECC6725B8AD94D62BF110A78AB61A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28