27e3e3350715b83a2a3059c008517e1e97b2531557aaefd3b4cee38f62039b1c

Sharing

Copy URL Twitter E-mail

General

Target
888_RAT.exe
Size 22.0MB
Sample260713-rs2wpacy4y
SHA256 27e3e3350715b83a2a3059c008517e1e97b2531557aaefd3b4cee38f62039b1c
MD5 54c6dc01ba6c748106085665ff8ad61b
SHA1 f75d970df21d277d39656aeff50752d415b47c6e
SHA512 9b5498b40de25dc788a728979518e3b6edcc1f0a0444f96bb19c68f91036b552b248d78b5f783ee5247eb7f7bb1272b4e4edf3f2c6650674c16b72593eec7f8d
SSDEEP 393216:AP1PWZEdKBGwPLApMDvm9YL8mp3YsxXUSqqEDPqwTOfxUbEe2pjEgSl7ltlx:qUAKZLEym923Ysx2qeoS1mjr4Pf
TLSH
T1E937338283B95CB4CDC6377B028ADFB799749C925C626DE686C32E172F9EE411D187C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  888_RAT.exe
- Size 22.0MB
- SHA256 27e3e3350715b83a2a3059c008517e1e97b2531557aaefd3b4cee38f62039b1c
- MD5 54c6dc01ba6c748106085665ff8ad61b
- SHA1 f75d970df21d277d39656aeff50752d415b47c6e
- SHA512 9b5498b40de25dc788a728979518e3b6edcc1f0a0444f96bb19c68f91036b552b248d78b5f783ee5247eb7f7bb1272b4e4edf3f2c6650674c16b72593eec7f8d
- SSDEEP 393216:AP1PWZEdKBGwPLApMDvm9YL8mp3YsxXUSqqEDPqwTOfxUbEe2pjEgSl7ltlx:qUAKZLEym923Ysx2qeoS1mjr4Pf
- TLSH
  T1E937338283B95CB4CDC6377B028ADFB799749C925C626DE686C32E172F9EE411D187C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution installer persistence privilege_escalation trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  888_RAT_1.0.9 Cracked by Shark M!nd.exe
- Size 22.0MB
- SHA256 beb837e8832f27dacfd3719cf617310f1b9e74badbfca8705ecafce3ed5e6a33
- MD5 32004e656640aad1672f0ee98434bc3c
- SHA1 d665b4e03e9d75f87079d65cff791147b7ee6e4f
- SHA512 1cd55008d6352469a937f168d6d72cfd202d81c24a6be4c6256a4c73c576577aefe8da912c5cb09e12f12a58e46f99381fa9834b58bc356e0c530908b236785f
- SSDEEP 393216:TufwMCigvYFChWbRT5OV7lAUl+9o0okMLeDuq3+QAk5ubWWBwBvJ5wV:aXZgvYYhQDOVPl+9l2+OZuhQwR/
- TLSH
  T149373302A3A9D031FFDBA3336B69FB155A7C7C210823896F13891D3A7D755611A3C7A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  majid z hacker website.exe
- Size 417KB
- SHA256 34ddd8dafe9e6fabe4cac3428ce0f9b1d51183ecd3d70aa4d483086ee64a514f
- MD5 24995d61ddcd09aca3877ee88552d57c
- SHA1 cf3bba8be96058daff0eba22c3e17510fabd458d
- SHA512 3de2434f9c75634921165daec270ffc6c4d9c14ff89328213f245d1b042ed4329b1817001c3eb27cd586bd86c2513585b9b516d2322c92e7b6f74a40e3b3d7c7
- SSDEEP 12288:6b81qE0efXk6XLUwx7YfR43dZtW8U7oxH:6L5yU6XIGYqdDW8z
- TLSH
  T1689402497F018EA3CAC201B91396EBB2E1A7DC0443B3527743E53E677E3EA8725256C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  microsoft corporation.exe
- Size 33KB
- SHA256 58c8e3599d16762dfc51decf16c3d014cd8c8dd1aab59a0acff5372c5182bda7
- MD5 23fb3146d1455b890afdbd9511b48351
- SHA1 9e0118366167c76de2d88fb354606d5e58677eb7
- SHA512 92a816b16f854cb19a28a9bd186223dd3f7961800b6486b32be1f270b26a0240c0f68ebe0f6c555b72f0e3388f3aa1a061fad50c0b09aaec1af9de1185fc8cf4
- SSDEEP 768:AZpwhb5dwhZTRBwdVwI8PBw3ccrfLAkr:A8uzNiwtBw3cafUkr
- TLSH
  T199E2184C73648923C6BE47B89D70864647F1D14B5512EFAF8EC460EA1EA7BE41E00EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral7 behavioral8
- Target
  program startup.exe
- Size 356KB
- SHA256 ddfaaf02cbb33b9bbc9117dcdea0da555f4a6bf1d852e7e121bf9930cc2e4404
- MD5 4caacd7358ca6be0197a8d7dd73f1347
- SHA1 b0a0c0f64cfb9db363e423f1f2a72312c7d551fb
- SHA512 84b19e735896baa67d996e91a7144092944147eb6949d887308519699ceec481f0ed16c766103ba62e90a679c397bb0f0e0ec7f45fab554d89cc54f373fd801f
- SSDEEP 6144:nuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLTqCum9Y3BPK7z:u6Wq4aaE6KwyF5L0Y2D1PqL29XU7z
- TLSH
  T12C7423EBB7617700F8F803B6E2C70152C1A0B5A197BD8F7DB5082667B4AF1017DAAB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence upx
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  out.upx
- Size 649KB
- SHA256 6395291234a8356df763e3935755dd488240d6fc8b6cc64e186815e7aab062db
- MD5 efd38217c50563b58128bfe94a57f177
- SHA1 d6d19a48388621e1940a9959d3c1ef96c2e7e1d1
- SHA512 59db0a3375fd785c8dd855ee5a311cc5ce7a0c83639e49f9008d73126cae63af7178b8aad30904cf018f2c4dcea17bcc2cdf22fe301992214556b7ca382d0c48
- SSDEEP 12288:0hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc+9:MRmJkcoQricOIQxiZY1
- TLSH
  T1AEE49F21F5C69036C2F327B19E7EF76A963D69360326D2DB27C82C315EA05416A39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  script.vbs
- Size 1KB
- SHA256 ecd586281fc4655e40108fcf118beeae3411c1c1176951a763e47fb66d2e421f
- MD5 77a4da4863ffcaba51ce05d3c632158d
- SHA1 253f9a594a6ca3a7a23acb90f8dc81939215ba4b
- SHA512 ba215fa65a011f5841f5e92b4053895c13368e894817551a982ca3e821726b8bbb13616bca8781fed08f4c83528d0d3ac233fa1f3e14ad4253fdefd9a22253cf
- TLSH
  T14C41F201E6695D561777A29232A37F4F13BE081672AB4C31E00D8CAD4793F9F077B951
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion evasion execution trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contains code to disable Windows Defender

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Disables one or more Microsoft Defender components

Modifies Windows Firewall

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Disables automatic submission of suspicious files to Microsoft by Windows Defender

Drops startup file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

AutoIT Executable

UPX packed file

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

AutoIT Executable

UPX packed file

Contains code to disable Windows Defender

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Disables one or more Microsoft Defender components

Modifies Windows Firewall

Checks computer location settings

Disables automatic submission of suspicious files to Microsoft by Windows Defender

Drops startup file

Executes dropped EXE

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

AutoIT Executable

UPX packed file

Modifies Windows Firewall

Checks computer location settings

Drops startup file

Executes dropped EXE

Adds Run key to start application

Drops startup file

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

AutoIT Executable

UPX packed file

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Disables one or more Microsoft Defender components

Checks computer location settings

Disables automatic submission of suspicious files to Microsoft by Windows Defender

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14