General
- Target mttgovno.zip
- Size 74.8MB
- Sample260705-qnls8scx2w
- SHA256 5643222585a0b2052793bc573b59673fdc9ef1879edc704a7084505dddac3235
Malware Config
Targets
-
- Target mttnet/DDNet-Server.exe
- Size 20.4MB
- SHA256 a78257cb7979f7efd037b0630e3a7cf642dbaf7fecad6403f2986453753a8a01
Score1/10 -
- Target mttnet/DDNet-Starter.exe
- Size 29.8MB
- SHA256 afa1c5005cfc24c85f51fef5cac930e475a0783cccf80d49f3405a70c6b7590e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mttnet/DDNet.bat
- Size 565B
- SHA256 a63fbced206e97922224d1cb771346b9ceafcef421039b1c7e84c4cd93c956fc
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target mttnet/SDL2.dll
- Size 2.2MB
- SHA256 d0ac4e209a78ad56d53af2df40a51ae9e4043704efbed5b46bf75a57ec92ab1b
Score1/10 -
- Target mttnet/avcodec-61.dll
- Size 2.7MB
- SHA256 58c71baa592da746c9c5e30fdd41814a2736454b2b7168da4ab88585758d4786
Score1/10 -
- Target mttnet/avformat-61.dll
- Size 502KB
- SHA256 b72292ed8140957752e45880b597b6e1a673fb66e740379d29614dee1454d3a2
Score1/10 -
- Target mttnet/avutil-59.dll
- Size 1000KB
- SHA256 cd256113d455d362d769a859d2214b9f672be8d2692eebd7539675d31620ca6b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mttnet/data/mttnet/themes/ZXC/mttnet.svg
- Size 1KB
- SHA256 25065d5fe26f0adf3997155b834016e500a78f90631d159674a3a2f560f43026
Score7/10-
Loads dropped DLL
-
- Target mttnet/data/mttnet/themes/night/mttnet.svg
- Size 1KB
- SHA256 25065d5fe26f0adf3997155b834016e500a78f90631d159674a3a2f560f43026
Score4/10 -
- Target mttnet/data/tclient/builtinscripts/sayemoticon.chai
- Size 181B
- SHA256 b246d074c3940951cf8574f6c1ea666933d89d6fe593f0fc4bc8c0d2b4195a9c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mttnet/install_auth.bat
- Size 240B
- SHA256 c9311af3b8780b99a3b3055bf7bcf4249b88ec3402cb472f19db69fdafd70d16
Score1/10 -
- Target mttnet/launch.bat
- Size 1KB
- SHA256 d22a005b16f8fcf5f8af38db7426da3123c5b9bf02d4e89da1190e1abae11283
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target mttnet/libcurl.dll
- Size 586KB
- SHA256 8d361a28685bdca7f0264f94dca8a8a2d3174465ee1ad5fed69c80120f607035
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mttnet/libfreetype.dll
- Size 665KB
- SHA256 5da185332bcf920ff8f3d649b536e44105b914118b33f90a631350e6e813277b
Score1/10 -
- Target mttnet/libgcc_s_seh-1.dll
- Size 144KB
- SHA256 aa206610566528c7779d07ceef49f8e153ee1600b743fbd73388297de10711a1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target mttnet/libogg.dll
- Size 33KB
- SHA256 5187cbb032ccba2ec40f460572576e964d6e089f0b9ec75d975f4a24c7f45ef9
Score1/10