8660afa2ba712b67b58f101933191986629f42edd1772d907fa654a94ab4270b

Sharing

Copy URL Twitter E-mail

General

Target
Internal Roblox.zip
Size 62.8MB
Sample260712-c52n5aet5z
SHA256 8660afa2ba712b67b58f101933191986629f42edd1772d907fa654a94ab4270b
MD5 638713dd5a38fc7f3f7b856fc44defa6
SHA1 faded5da52eb54891a5c62d9cb9ced6b3dbcf10b
SHA512 5c34e3d8ac5d75157fb70cb6d18634767f63803b7a6cc59673b5cf0e481319d8d54b397fb90c48c84686d6e4f55b90de807ec8de918feb765c8c3f042052257d
SSDEEP 1572864:GHY5cRJRS8zXbnjid8tW4CkUbZfDo/x82NCEvz5m8JngfUb:eY5cRrfqydU9fF2IEvN5gfUb
TLSH
T121E73359AF91FCDD6B2CE56A89258B09FD72B81F305D1F422E92083D3D4E7CF2AA5140
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  net8.0-windows/000Repent.dll
- Size 86KB
- SHA256 d9d66f236f688bf6cf87b026b3c603e6a309fbf65e8e6675a73ece224d70a80c
- MD5 12b723880a3546a2bd30b1d99276efa2
- SHA1 d506ad96560ff5278f9c6da666973495f50d6df1
- SHA512 c8fda28836a92a95f0a1b250b41baa02010bee9cd25c5202f009918255838f8498c525329232a8962da975d71e8c3cc022f782d252ad58995c8b7705cb81abfe
- SSDEEP 1536:iCvr76f2iRKa67a2/2/W9m5JlyG38kufgkMlK7rjKm0:iCvv6f2B7aIbdkuo1lK7rjM
- TLSH
  T14E83191073ECCE46F6BF2F7DE830596746B3B622643AF68D05CC54D809A3BA18452B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  net8.0-windows/000Repent.exe
- Size 148KB
- SHA256 86d0b78ae30364769eb92f0744c3c1333bf6c5bd6438531a7b18ea407a2ced18
- MD5 582ed8af80a1754dddd730167fcab624
- SHA1 128f68899e3b4573fb0b17c0f9d18fa20fd66cc9
- SHA512 10edf25d0400d27079b4418b09c805a42037a2f111bcc872e1644857e684359a250e2bcdd59abc038f9a5153d6b37823462c34340079f80f7d5fcaed6a2795ff
- SSDEEP 3072:MqeXA/4yIg9vkNPNu6H6xCYOiVUE265GJQ:MvgvkNFNaxmNEmJ
- TLSH
  T17AE33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  net8.0-windows/Discord.Net.Commands.dll
- Size 134KB
- SHA256 728ab86a6e9f7befa0ce6384ab43d648da8334fd9e9cdfe0d925c2a613edd78d
- MD5 6baf34077fef3de49b50091a0ff89413
- SHA1 4a799585b7b01096f3677769108dca74b98c99ea
- SHA512 669a9895a721a436759bc3bd4652745d0631397f77ba324b61fe3d83d49d3ef448914a1876d0fd73f43f294c5f15bf20cc42bc6c36b7f0c9ad098f9909eaf122
- SSDEEP 3072:qxcSmD0N34KMrGwLxgGS9C3fBrY2VvrAoYFc9zrPHAM6S:qfzjMK6BS9CvC2VvJ9zrPHAD
- TLSH
  T12DD33D3493BC5B13DEEFABBAF460412447F2F606E559FB9A5E8CA8F929537101810363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  net8.0-windows/Discord.Net.Core.dll
- Size 829KB
- SHA256 ed20e7caea45c86df6d6f60d1932c05644a0f4651af04f12982204347fc552e9
- MD5 875503902a909e5293923bdb86ee95ea
- SHA1 0730f7baebc17a9659620f37f5ebd9e11e3f8c6b
- SHA512 798ff4462882d232cfbf2262edb77ce512aaa9529fe8e1fd686feeb979b3f5750932e7278d0fcbe17c5e29299eff75e326e1e264e8775e20c7cc34ed05b36d84
- SSDEEP 12288:1vPWwbH12YKIMrttOQ/hOmLexgp58aO0cscwiYyAvgvu1znGOWWi4iYyJ6hsTwh:1vPWwbHAyQhOsex
- TLSH
  T1B505F24122F85979FAFFBFB3567AA4112639BCEA1410D55E1C44344D09BEB818AE0F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  net8.0-windows/Discord.Net.Interactions.dll
- Size 232KB
- SHA256 fcf20280dabb3cc8eb1e2d37ae353a0b4c49bfd3c45ce7bc79778b823c45f952
- MD5 f32b58d799a3b07b57a4f77ccc6aaec1
- SHA1 07bb2554d1654442cb117566fb1856aed0aa82b1
- SHA512 ae629ab8af7a53031e92817e9ad5871e265de3f92e603c5667fd58ad07b213d392b9cb7901f21346904b54ca4d5d3296e5818d01080031ce217e2c9f5351de38
- SSDEEP 6144:+sZqYGHsv4UHr3uFQqfZxHVyMgeV9xuaCbRm:+aWFQqfD
- TLSH
  T1F1344B6123FC0725EEEF5B79F4A010298BF6EA06E46AF35D1D4CA8E81D9BB4054507B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  net8.0-windows/Discord.Net.Rest.dll
- Size 1.3MB
- SHA256 5612d69ffa1c7dc1e37478f710ba184b271063b9509449499f785e739471d89d
- MD5 23b5d856fcd0edca9faf58ccfede39c9
- SHA1 6789846c8eb19929083f0f639db89604d08ec775
- SHA512 446087bdd010dca120d483ae118fc48acd5127a0271551fc42081236dee3c8bf2d4f3af21899261afc8fbb0acdd3d85f776910a55defc593761257e88d2242d6
- SSDEEP 12288:wdZMViV1XHJzWqMBMNGQrpEgDmYB5HQRvE1EBnv7XAHqJ8ysiXt+ZaAwwCMhv:3C1XHdtbVEexBGsKpkXyjX0Za+h
- TLSH
  T1BD55196577D4EA39D19F2238E271C22993B1D350F755E3ABD788AFF92C023412D052AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  net8.0-windows/Discord.Net.WebSocket.dll
- Size 896KB
- SHA256 499eabd0a76e36cad4377fc2f9cd0b3ce63036adc14f1cf03dce697471b5c132
- MD5 b8eb4bfe111b53e884ec38bb812ba859
- SHA1 49b87cabad86831c637c456b8f31e5cad1f6b74a
- SHA512 1bc5c9ea5daeaad1836a5c81be47f4d080d52e1b1eef3ec3564e9f0e399d38b82ab5f7e0c5370269ec4d6064f0d01e6896364671195a46d9a1c4d3a26fd6d07d
- SSDEEP 12288:JkqQLbPwRADZfZW3KtShpUWiY22yNkkQ4h8X7FW:eq+I+hW33LPn4+7FW
- TLSH
  T1EF155D6A77688A35C6EFA37AE110C33787A2C508E566F77D235CE9C63C833105E44A97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  net8.0-windows/Discord.Net.Webhook.dll
- Size 31KB
- SHA256 55b9be10970b41bb185c58b69c566722f234afcb2e6e1999510e8ec652885a34
- MD5 d3aec612afa8e1923fa4b831ba1ae04c
- SHA1 9cee09726bb9732eff5c00ed81de15ea1673e2ea
- SHA512 8be838f29908d581c030961e00ee11a367e55b7dd5f63fa9242776bb203b7522df9b9692964582e158a52b57616adbe7fa2ee8a6436bec3ac58127d6615fa1aa
- SSDEEP 768:tAN7QQPGjkKpdOWBMWP8t2A+pUQ0Y9IKXJZ4:qNpPPKp8w1Pj5pp0YzJZ4
- TLSH
  T163E2E80D53AC8726E9EE7BBDF4B0624917B5BF416826FB854C4CA6F819433816600BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  net8.0-windows/Microsoft.Bcl.AsyncInterfaces.dll
- Size 15KB
- SHA256 5705d245072d3eb78400547b32147dbb6e2c8b02ba8bda76729798f5efdeaecb
- MD5 8074b0eeb2d4cf9b1a6b26865bf91aa5
- SHA1 2e438aef830795b2d240cf3160a3353bc6cb0232
- SHA512 05f7d9003427e611f011018844fb8180403cd6ca807e4c5a8beeed03e4cd7fd8babd89dec51a14510eef7c266ba4505b731eb065606d066b061751c89a1d772a
- SSDEEP 192:mzuPwZ40ytyqjaWeb/WIWOL8/pCuPHnhWgN7aAWDr/MqFCfvXqnajJ72h/j:7G40ywqjaWeb/Wg/uPHRN7yM9Xl172hb
- TLSH
  T10C722A91C7A84203EDB57FB05679D5463C3CB6D26C31922D1189E29A1CE7BC1EB31B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  net8.0-windows/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 62KB
- SHA256 a0106a638facae621f870eda720cb6c980c1d5d49c2f4351134e3fe043b9291b
- MD5 38236f9c2408bda46c13efef364326fe
- SHA1 03178026c200fd723bb75d08b9a4b70e93f6a45c
- SHA512 4abadae40a459be932359d6964c30e1e5fbef300736943bab42c1d66b5fa56c45ed10910acf6b36c302c8a40bc364df444220e2af8ff5854460c6a9542ff88b7
- SSDEEP 1536:KCYbKF0XEQqb72cfdGWQAE389HD6dDCN6rzf:MUbQAKuj6dGNAj
- TLSH
  T1C7534A54B3FC6727CBFF5A70327250219738BE4B2041F70A796BC0B509A27D855A1AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  net8.0-windows/Microsoft.Extensions.DependencyInjection.dll
- Size 90KB
- SHA256 8d6e7b64cce554f0a0fbdb2ba80745895fa0b4e6cc378b9fedfe8ce86f0d8ae4
- MD5 7d40b6217fc409171015d905a22f8e85
- SHA1 27a31ec52498d9db2b09707ef603860a80fdb2cc
- SHA512 e998ab21e2a7f4df84f33c5d7bcb6d04c11481633362f4988f3a22820aa1f84744f51503947492217668b9db39e651d13cab0ef09d804b961aea2434314a3d66
- SSDEEP 1536:6sS1Tz5tF1bQWVsdJCKTvZEmwbyQMUiEVzz:3QH5tsWUvZEmNQMAVn
- TLSH
  T16C936B2467EC4B33EBEF19B8A87440044BB9E55B3102E74D5DD4A4B91AE7FC20B712B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  net8.0-windows/NAudio.Asio.dll
- Size 33KB
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH
  T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  net8.0-windows/NAudio.Core.dll
- Size 183KB
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH
  T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  net8.0-windows/NAudio.Midi.dll
- Size 45KB
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH
  T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  net8.0-windows/NAudio.Wasapi.dll
- Size 175KB
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH
  T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  net8.0-windows/NAudio.WinForms.dll
- Size 33KB
- SHA256 b313f530227fd31fc2b6fa74547f4c8a964cde7696c07624dfc19b693fe9c468
- MD5 2da1307837dc63aaab828470701a2761
- SHA1 3d862f84328d8fba810da31fffcdfc53a8cf786c
- SHA512 503fa2ff0ccea1d51aa59c4f38a2d552626556b0cc692a699f15714b9af901d9e664642adf5e25d6cf5ce77a6ded59427dd1bd23e030aedb3891ae943629d2b4
- SSDEEP 768:+GRcd/kDtaVL9ugB/0p6oCPREb4DmHBRrne5:zaVL9ugQLMOb4Dm/2
- TLSH
  T166F21919239CC36BC67F0FBA50A611430336E681F552EBED6DC831A99EA37510761BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32