General
- Target Unreal.Logger.v8.zip
- Size 3.7MB
- Sample260705-tlbr2adx5x
- SHA256 367b90523fb3b41264a8fd4b7dbb14f84d5c4ae32e69ddd0d4f670ef9c2fe0c0
Malware Config
Targets
-
- Target Unreal.Logger.v8.zip
- Size 3.7MB
- SHA256 367b90523fb3b41264a8fd4b7dbb14f84d5c4ae32e69ddd0d4f670ef9c2fe0c0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Keystone.Net.dll
- Size 14KB
- SHA256 409e77c96de54f2fc2149710b153eb6dec9429d88646bdda8eb46455596be91a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Win32.TaskScheduler.dll
- Size 325KB
- SHA256 5e64f2b0912f3fd60d62c4907229033ef22a349791843c0a0e748b3260e3fcae
Score1/10 -
- Target SharpDisasm.dll
- Size 215KB
- SHA256 6d3ce990cdf58da228697d25416d16d15994135c5f66571fe1e00e9c975bc2cf
Score1/10 -
- Target Unreal Logger.exe
- Size 1.9MB
- SHA256 e0935cce357647387620d0cc18dc051972a3edaab620be00c94af2fc0c404915
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target de/Microsoft.Win32.TaskScheduler.resources.dll
- Size 9KB
- SHA256 f54e8a38be8e27f178ac519e7eafa613d0341037bd0f723bf128fcdb94b7b540
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target es/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 b417b6a5b5dc7349122a00c43c06897aedf414046af83ba14ba28838f243ca42
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target fr/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 4b282ddf1f09e09242ca11a22fd7dfdd069ede751961bdf8d771258071823b51
Score1/10 -
- Target it/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 24a3040b55de26ce6c8f36f60e1d728ead14416875c01d160d9ffcfbeaa8dcd5
Score1/10 -
- Target ja/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 e282404035693502882bca0b88e988fe0bff8ace799ce67582bbb1485751b5dd
Score1/10 -
- Target pl/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 2ddd5ed4d84e8732334b5f6e08b3d61190da58762d33db72f7e229eb7e4791f0
Score1/10 -
- Target ru/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 b15e736a0e3c1051becdefaadfeaab68163c2203381e1e782316372a58fcb0c6
Score1/10 -
- Target sv/Microsoft.Win32.TaskScheduler.resources.dll
- Size 9KB
- SHA256 84ede4a0234ee6cd52329939e696b8bc2758b313dd7225d7a46828ed626d5e36
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target tr/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 1429cd58467aea880302b369eb802a55411aba008895bd0023376526538fb462
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x64/keystone.dll
- Size 5.1MB
- SHA256 144508decba543d3a1d0ba5036d3205eb32f9d9ae738ba27ef3dd5fc501723db
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x86/keystone.dll
- Size 4.6MB
- SHA256 6ba0a438ba80d9353db0baa7ff55cd595a02223db3f7a365a815ccbf3620537b
Score3/10