441d77f874f09f45f7341d47a14d9bfc132b08dfbd1a146636e5dbe3c084d50b

Sharing

Copy URL Twitter E-mail

General

Target
nbtool-0.05alpha2-win32.zip
Size 287KB
Sample260703-g63d9scv3t
SHA256 441d77f874f09f45f7341d47a14d9bfc132b08dfbd1a146636e5dbe3c084d50b
MD5 be6045538e63be4262bcf4bd0bd11221
SHA1 9be0431fd0e2298a9cac3d8803c1185914942454
SHA512 6214de55a6e09fd9124f43a50792f70fba86750c828b55a0a1b208c9760dc158e156e06e395894bcdb43aad5799adc9ea079ac3a2f7854875e969a7e97bf6a24
SSDEEP 6144:ozbN/JtW3ZGrFAuIeB+LPCgs/rZmobd8pWKP3lIXNUWLzaZMk/RZA:ozbNR8tEAejDZmobd8p/4qAqDvA
TLSH
T10054234F0962392F1C333EA830993CC5CBD64791E9F6D9792D7217042A7E624621F797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nbtool-0.05alpha2-win32/dnscat.exe
- Size 126KB
- SHA256 af0fd5dad3c705a2da5f0d3c7a5edfad7e856920f0b33c51e6e708b9576f0354
- MD5 a6661f4f850f568e66482c0e457e8363
- SHA1 bbc81e143fecdbced9acc9910de7fcf9e0fbeb47
- SHA512 82cb3eddd0020d3ce2c818099d2feb2506c4ba62723361512726ad2e57c4c2e913ed86a7c846163176b3193799f9715d7c09f75ec3375325ccb3641a1d8f935a
- SSDEEP 3072:/lpK2a0sNxHKVu5UVMg5nkh4qWVsJ4VHzPqpd5:/W2yNVJ6Mg5kOqPOVH+p
- TLSH
  T1E3C38D323281C0B1E45650727626E7F2EB7EA135273895D3F7640BB66F311E1EA3A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  nbtool-0.05alpha2-win32/dnslogger.exe
- Size 84KB
- SHA256 156722c3594cdc0520ad15afd97bb77cc783df1907486a61285c4288e5275967
- MD5 007e1b6f9a27580dd13706be548698b9
- SHA1 eb025356bf14072c241b7c68322495b5a479adae
- SHA512 efe145cde9ba747c000232073f0e3af359d4948b1284694ef3b53c26434450cdeaa0eaed03f9aa9c60c34ba8f0fc026dbd823edc62ef62a4826fff26bb660f84
- SSDEEP 1536:wdSJWqr7Mwjeqao4XHrCPXWQflo4CAM5W/:wdSJWaqtQflo4XM5W
- TLSH
  T153838C613A80C0B2D04554B6256AD7B2EF3AA1354B75A6C3F7B40B7A5F302D19E3B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  nbtool-0.05alpha2-win32/dnstest.exe
- Size 83KB
- SHA256 56f129268298b1c99ee13f5863c6e9e592ebd96014b8877b5cf38f63386ba2e0
- MD5 f7d008dd701f7387e3d3419e34bb9801
- SHA1 9acca005f5a3d338fdd0ccfba2c42e076d4b2fa4
- SHA512 337e8585de7c4c4196a7ce363fa10b3f982711505bbd914bdaf1746101661574b36e9b1851b8e92effcf5c50d7812af9b9f9cc10975c7c0f91136e13858c1669
- SSDEEP 768:Ux04qK2+0pM0wSynFZyEgpqKsqt1tztWmVLzV/GHotoGsuvaLpfniCd4PuoXltpi:Qee0YGEgpPTd72ys9niU4Pu8q3CQ5N7
- TLSH
  T125838D217A80D0F1D155147A296FDBF29B3EA1311B7595C3F7640BBA2F302E1DA7B20A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  nbtool-0.05alpha2-win32/dnsxss.exe
- Size 88KB
- SHA256 7398c51c49afa92ed88db174fd353787c4b44a96e5714e3e6662f0442c5e8c2a
- MD5 a3342e8005c5f706be58992010f5e059
- SHA1 27878053cb4341ab475b06e2a051b251c17485b7
- SHA512 5cb95785429035d6862f63f465ee038a3c486c3c78b6da6634a280c62835bf27cf9d3cd68f36bcc94d7c4919083784a8de618b51fc9a6ad76e3496d8307cfe3e
- SSDEEP 1536:sCwBoK6CGOlSR9dpFgDCQ0LmrqzP9jfuWXye5:snBoK6CGOQZWQfuWXT5
- TLSH
  T1B3937C313581C0B2E051147A2566DBF2CB3EB5716B3595C3FBA407A69F311E19A3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  nbtool-0.05alpha2-win32/nbquery.exe
- Size 88KB
- SHA256 2f328bb67af18f4e519c3bd388522258124224bfa64184a2dbbf50a41b4df55f
- MD5 a90f7b2a2a17e53996349325cbc13d3a
- SHA1 e888614a2c3485ab5f49b1e93f72b2c9fd2fade3
- SHA512 a2957b06c2fc80d6240a604786f593dbe53b895bcc7f58205b0f6468ca341ab65cb04d7dcb586ac7d825ff1dce0dbe24e29dd546cc60b7a19ea40000115e68a5
- SSDEEP 1536:96k0Xw+38P1YrJAcnYuPoFij4lnwNN35JdP7JCS55F4f4:9Ly38PqrHnx+2V7JCw5F4w
- TLSH
  T1EC938DA23151D072F055607725A6DBF1DB3EE1711B2199C3F7A80BB92F321E19A3A24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  nbtool-0.05alpha2-win32/nbsniff.exe
- Size 84KB
- SHA256 6a55c6ab60df3579d11e3c57619e0ce4b39aeaedb145e147f6c8bbabd7aaca39
- MD5 248376d87d29e325a33b19224abb45b4
- SHA1 29c3a29b65cd4de70fafa503fd41d0e6d689bf8c
- SHA512 0fe42c622917752967f4cda89993271d7e395135ef77f1bb73f2651e514f1dd6b1a87598cb5fc0a4c2e332753e209fa18a334ab41ee793c16ee96e1356d2362f
- SSDEEP 1536:/Jz60PR4qS3mxeR59ahiH1IoXWGyHp68PzuMjiwJDn6a15u7O:Rz6c+xhmeIuLOiwJD6a15t
- TLSH
  T13D836B213982D072D05690762567EBF19B3FA1780B64A9D3F7540BBA5F312E19A3B10F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12