cbbcd6b957944442b4c010c1b9e6bd95ab4c4529ae573eff69b4e5f7dd303810

Sharing

Copy URL Twitter E-mail

General

Target
test.zip
Size 67.1MB
Sample260713-krtelaev9r
SHA256 cbbcd6b957944442b4c010c1b9e6bd95ab4c4529ae573eff69b4e5f7dd303810
MD5 a43bf56d570f3d595eac0e1424dce04e
SHA1 5d3791e4e8a3f87e68cd9694b9b8468891f720a7
SHA512 e5c810281a9d01edf06000ab7d2f30da108aeeafac53075bb1977909989d1a6223b143dad57cc5d6a1595b837fe615d7191ef25a51d61d39dcdb5b413bf1c8d7
SSDEEP 1572864:XXYa6GxYSn8zPgSGlemDEoss5j6JUTXWymP2/0:HJ3bllemDLss5j6J8myme/0
TLSH
T112F733A11EF58662E7BA3A336175C927EA170129C174C24CAFF613D731378EB0529E4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  ToolControlli/2930.bat
- Size 23KB
- SHA256 1de0c149e0a3f0abd605951c2fe99e7e70fbb3bbceefb40381f65befd3ce6866
- MD5 d892e39ebff6ab6f8e0e6f209d665756
- SHA1 1e1570e58d8154ce7ca59cad4b6e22a1acef866b
- SHA512 1ee717483359b4458d266159992197d5beba6ee80e827657a211e954c508b4b15c115942a78373405075840fd2d8de45b25ac2fb0d53ffe14ea811509d08110c
- SSDEEP 384:LabVW2JtJ142BIHtKM44nIHHCw4PHhdHuNl+LtAX9X+Gp6Rp4B3cBVUGp6Rl4Bzj:Labg2JtJ142mHtJ44IHHCw4PHrU7X9X8
- TLSH
  T1E5B2B5543039311B7470763A9F899055FF2E90D3026AAB8475ED91E46F7F1A9C0B8BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion
behavioral1
- Target
  ToolControlli/Battle.net-Setup.exe
- Size 21.0MB
- SHA256 c6a3f39bf5c4f7e9283ca8b57d8f6e3fcbf59dff8f78e115bfef4362c0389abf
- MD5 901741cd3163b93bbb41c3af55e64451
- SHA1 139959f4a266b24eddf4cf8fc80ae1db599bb914
- SHA512 2fc6904a0674cf6e54e1fa1b8e598bc4df91cc9f1f9af0d08eef174b70919eb1ce3b7afaba9e62ea87f1c5d142c2ad9bf44834e91a13ce94ebffa896204ea420
- SSDEEP 393216:5FkXp5Zks0Fh9IUX1zdhUjeFMvdPGDgWhA5RtSu1KOuKSZJ0Qvy5avSbrP9:TkX6tIyZUjrBHEA5H+RkQvgavurF
- TLSH
  T1CA2733FAA1843758C059CC71A233FD45B7B2112E0BB991ADB1E776C07BAB861D913F06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  ToolControlli/ErAnyDesk.exe
- Size 21.7MB
- SHA256 ca5e5c7b7c39c3a3028f2044f3d5121d3c36176489f3206eba76340a4259bbb1
- MD5 28bed52a3b810982d626df378075d2d8
- SHA1 24b382cafe25af89aa60fc278bafe92f5b24a111
- SHA512 7bd3627f91c36f306db8a06faf8d3a1a6092906c6453187e2addb19d7ed864fe887fa4b8750f78d742927562578a8fb7fcbf7d488da242b31c87ab514b31a361
- SSDEEP 393216:boDrXmavXJh6kgR03bwFw9JTfbTjaD0EfoSaHDQYgqCdw8jX:0DrX9a10LwF0bTjabaHgqCtjX
- TLSH
  T15D373375634533ACC43ADD725833A906E1B1F20D06B4A6AC73D77BC07BAA412DF46B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3
- Target
  ToolControlli/ErAnyDeskFiga.exe
- Size 10.3MB
- SHA256 26dbb4d0cf0a5459e0d0d699c4737ce520cb7cfa890d23ccbd13e4e8fde478de
- MD5 fcdced68a0ba4865cf0559c3c7ca0ee4
- SHA1 dd3161a348510b15d2595135c2597a9870c54283
- SHA512 c33ca0ab5a49373394bf5a39c3a4de315d1cf0eaf115adef5bd8a41cf728fa9e8f21f79f8f235506dce91b824b0709ee59ba9f85c01427ea56b55c857ab8d967
- SSDEEP 196608:JqJIllusEPh7/cDkWcSuvl6ecHYFG4OT3h8XR35p1Xag8pZACJ0RueZa:zCiwMecHY44wwJ5TXa9AC9eZa
- TLSH
  T134B633C07FE33233CBF4CC731A991F9C6644D2A2486BA5DEA425592C39179E88F77186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  ToolControlli/ErAnyDeskSS.exe
- Size 10.5MB
- SHA256 fc62d81d744da9d1db6517511e0077ff8d30e41503e21a37f4b2dd72d2d69a5e
- MD5 014f42d1807f48f15df9558df75a2e48
- SHA1 12987152123a60907e363d905ce3968dc30c360d
- SHA512 4bc2e81994a3c026a1d72cf5cf6c30dca557467137ccaebf611d1e0405e1de1f2bb7e4dea9be606d692f6d1299de54c71ac24a440307bfa8f509a85c379b39f4
- SSDEEP 196608:iiLMB6F9WzYdlLPfxVG8BbKsnOlF3qoSGUK3uJmgoWbECMEo0KFlnwE7:iiLMB6FcSLPGcKsnOaATzpWb5MEmLwq
- TLSH
  T1BAB6E007AA7510E2C5BAD0399193722FF97170A753749BC7A6524A1B0F63BE0BE3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5
- Target
  ToolControlli/Moon.dll
- Size 1.0MB
- SHA256 4fb4982780df37d56c5b928677353e946b5698f44f04dfd8d3d77f0f2c80dd02
- MD5 d518c78701f618dc38539cf302c9b5d5
- SHA1 79ddb439baae2c10fbcf08e2bc4699fe8a676b89
- SHA512 a282d02a7f44c99facb22fcaaece18bb6ce73ed22b138df3b3db53ffb8c7607008fa6b170dbbb5191f1943df10933002d5d0c4ef54c198cf14c7fefed48ef499
- SSDEEP 6144:kGfVY73C5sqRNeXob4rhtGN3KfPrbqJWA0O0K7ErBQKcH1esOX3yd:xfVY73yooErrf/2lFOXCd
- TLSH
  T1D535B78F9D58A72ACC3801BACDFA51B07371A8CE5A4B4F8A1AC9F17038C75B4BD5516C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  ToolControlli/NullCoolDick.dll
- Size 18KB
- SHA256 19c3201c687e238658185b715170afaccb847467e49a3f64228913bb131f1f09
- MD5 428500132e0dcb8b386ef9c5782ac64f
- SHA1 653a8dcc0afaa2db3b36c4561130d3380dc5540f
- SHA512 2b02db63f833b6259be3125fd4ca511e75d06a89d94da63525d478ee3083e26d8be8aff3994169df0a54fe1340bf5f44299d2cd1b240a12e864f92b5cdaa1c25
- SSDEEP 384:vhwn9xhXKNF7s+NhbSDS2SXHSMATb271DFiGEuyx84695eG/ltipI6vTaqAHYKp1:vin9xZcxsAZSDS2SXSDTb271DFiDuyxL
- TLSH
  T114821B29FA9948B2C55712B0C573270AE2B63D4907626BCFB35DCB9D5F263C0782DE02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  ToolControlli/Vape lite.exe
- Size 9.8MB
- SHA256 94de1b2bf6d94bca7a82f7065a45923f33c7d5fe51f4c67d742ec89d0001e763
- MD5 5c99cda7dac3105111a3132fd24c1f95
- SHA1 de46bad7d018fda3a7abc46a9e823850bc174484
- SHA512 d2d03a93ffedee0ffd3af85504d7f5a7a2ed4e438f8152518ffb3d1cc6a6858e77544ad1b731917e0c5af27e2eacb4c284a8dd7c3d40433de09cd0fbd09114f3
- SSDEEP 196608:8+0bSlXpAek0aPYQ6nkte7ixQF2809CL1CnBcaCE4tZrzw3j1Nn92pTH52:MWD2Yyt2ryCLwnlRTzYpTHw
- TLSH
  T1ABA633428785AEEBD47072F45DF3105A98F277328E42457FBA2F03DA8931654C7B622E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral8
- Target
  ToolControlli/Void Clicker SRC.bat
- Size 22KB
- SHA256 b9e367dc21df1533e5f1c4e065853643eec82a383680774e04a26bc8fa043214
- MD5 cdc274e35e727a8d031a42417c7d5e32
- SHA1 0f59bf3dcc921ed45afc4790a29222bb83b47dcf
- SHA512 1eb01378cf271dc11081959cccf8aa39db07210023a6d141de7c9f0bb7aabbb6e3197015e16718377ed42eb939a71b6fd678e4916980943baad078f9a3b6a51e
- SSDEEP 384:WNxelEO2JtJ142BIHtKM44nIHHCw4PHhdyolyzFkdIeYEwG+4xIYGHhcE7nbG7u3:W22JtJ142mHtJ44IHHCw4PHJ9nE1
- TLSH
  T1B4A28664302626879830337A5E83D05FF61A50C342EE6E74B5BE11B4AF3F79751A8A7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  ToolControlli/epoch.py
- Size 3KB
- SHA256 ec4033fcdac2ea65b2c258c654f0cc479816de5299b9bbdbda6391534502a685
- MD5 b87f781cda12ff344fca4b896aa1c52c
- SHA1 6c54ca2f383330ef4b45ef897530a2dfb4c5b8c3
- SHA512 a8028820b520f2fb4644ccb2622af8733ef76e74ff61592a509772e48fdbc400a09e776389c7bb56a6ecb8296b0a2d424c046cb573d76012605417aaf8ec861f
- TLSH
  T1C071E01E7C5B955E81B7C95D59C2D012E32623138EAD0413B9BCD7A0AFB4810E3E9EBD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10
- Target
  ToolControlli/epochNew.py
- Size 6KB
- SHA256 7b845b89cb8f9cddec70a9941942ef6b2a5702a0efe966d4095535e3c2ae45ae
- MD5 953bd2c070d28ada69c2d29147ba9f75
- SHA1 b9acc9d92ae4b5292ec35a71e2a4f4a7a3ab9ff8
- SHA512 82d6f1888faeccd6d9fbb069522a73e7a49882d41f257fdfe6eb75d088d09a44de150b5fa5b39caeda4134e429b62efe4a98cb5b6d182ba59a310e52c888733b
- SSDEEP 192:vA2GS8804R0mqHqjg9gugIg2z+Fzy/4byk3/eiwVpjj:vA2R88HR/qHqEijp2z+Fzy/ye/Vpjj
- TLSH
  T159D18B393DCA63698673885F5DC2D10AD36A13A38A780552F9FC83945F70820A3E5EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  ToolControlli/temp.exe
- Size 256KB
- SHA256 f31a85b586bcf85206d4282dd95015d7bb3caa1b0b6ff7b42c5492bbb7846a45
- MD5 f22da03e4969229b24e385ff2af75932
- SHA1 ad1dbe7f4e2a0d2a3c0cb988ddccdaa1132882ee
- SHA512 84806b3a7359534e06e70e55eef22469db7da3a92fce0585b03497deec85d7fc18832f985130c228055b7e67980789b37822b9ce65854dfe7439c8f2d1abd783
- SSDEEP 3072:s2thIkI2ax/1W228MRVVeqFv1ldN0bUm25ylLQMhua/zRLq4XJ3hEK7EkDl9l9lg:fIyaS2OhPtXP0bUm25uhhu6Lq61
- TLSH
  T12D441CA3F5448A11CC1E0F7A4823BFA143767D26BF0BD3163588779A6E737C25B25682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  ToolControlli/ж‏‏‎‎.exe
- Size 1.0MB
- SHA256 f8d707866bcc841fd8b9dfd096c08d7466f0cb8d3afbabcfe8d2059df39294e4
- MD5 f09ed374744feb08976a9f7e6306b1f7
- SHA1 49e06228b176f34ed31d831a2a171ae86ec71e95
- SHA512 712d40e3b9fed8b020cfa1ebd2de6c25e8c20faec869a2a0dd55947756287b5422db00abbd17d9bb8e42423037540c0aa0e1f69b027f286727d4b92b5b05a886
- SSDEEP 3072:E95QeTuIkThHIrKkSpMmXLC+SbY6G3sydlkquGrjq:EohFksSb7G3suzrj
- TLSH
  T11335E08292ACE7B9D27E6BFD6811148027F2A917C725DFAF7DC834E45953B080B41B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13