fc8e41c15ea7111ba2b5926bf5d78e9fcca64de976a0f3680f8fadf70339708f

Sharing

Copy URL Twitter E-mail

General

Target
399ab4f156f9e4e01b81214162874bbe.zip
Size 76.5MB
Sample260714-d589msdv9k
SHA256 fc8e41c15ea7111ba2b5926bf5d78e9fcca64de976a0f3680f8fadf70339708f
MD5 893555915696c5a79be18a485541398c
SHA1 f9fe89960e1a0b9566de9b75c9c6f70806eaf759
SHA512 5cf05b25a9a9718d726c49be6b6e03fec5bcbb21c6a9999ba8c470e9cb9177606b671f9346138411dd9f64101fa2472a4d7ccdb8de4aa3020372acdb8a276140
SSDEEP 1572864:GRhNB4G8LAoLYN1MlmogisjiIjicAvRw6+8BLOj5jUWT/U3c3jiE3GTDU3cEmoAJ:GRhNBHexmaPsWIWcCZJOj5jUQ/XWEQDt
TLSH
T1F108338BD4F0F9AADE10057D22FF1B35F393149B7629C0A69F5276E0A49F39B714A048
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/libcrypto-3-x64.dll
- Size 4.0MB
- SHA256 6df28ba6eacdf7f4edef341f60a150d336e2407a56e60dad25c819710f00af25
- MD5 c3ccfd47251ebd81be13c284d211a36a
- SHA1 5198106cd030133eca33481757e9d41b64ca319b
- SHA512 691868cb5b0b2a59ecfbf33ac67fc150998025ab8837d325e40adae78ee3669bb5427c58e89651ae1dd4fc4a0cdabf5beb91cc2caa3670e225cef53a74a78bea
- SSDEEP 98304:GbzUi+LxmQLkmq5hejlvQFH5tnkneOf1Cev1CPwDvt3uFMDCw3M6dR:wtqfkTce8b1CPwDvt3uFMDCc
- TLSH
  T1FD16492BE2A720ACCA6BD130962BAF737931FC141370BD7F2654EB342E61D50571EA64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/libusb-1.0.dll
- Size 209KB
- SHA256 76055314e4e69641fb889e88b858bcc14b50aff06f197e5f8d5a112ba2e13ed7
- MD5 31a5d095aac8b96bb00b7436459f98b3
- SHA1 332b76859e9418a54aa90577835f2a6e41e678a4
- SHA512 83f1b1ad34f59ded60b8d873e846e46da1d9607c15a3c6c77274c73f8a07a6fb565366f22e500a00b4992af5fcc54df8cf4fbf0a332767f3fb48b4ca681e5fab
- SSDEEP 3072:lwhaakECr5GrXKm5UcC8KXvnw8seD5cAECoOJhEg2ptfXd3ZkZPO+e3NRwP3HVw:lViKkKm5Xa3snM2bl3ZkZU9iP3G
- TLSH
  T1A0246C2B92D79CBCD593C0305ADBC633F532F8284221EEBF1758DA381E52E91A75DA05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/libwinpthread-1.dll
- Size 58KB
- SHA256 0ce15909fdf6691750616463a90b662e3694efb507e67f71e566d21a07531dbc
- MD5 1c9d264aca6407a9ff8fe4cd83c82ea3
- SHA1 83145982ba73162930665aab0b916a27eac2a1d0
- SHA512 3e8ff62c93cb1f60ea783c9643c1e69430b1d6a6cd6e04c4e922ce4f91a1b72d6bc3c8d1806f5bba5f6fb0467834f3ef38b48b64f8727bed509038e4468609d8
- SSDEEP 1536:ENr8BOnXLnPD8LMEY9nI1hkT4oPm3Yi6D1FZo:SRn5EYgaT5Pm3Yi6D1FZo
- TLSH
  T1FA433B2A72A614FEC556C23495EA5372B533F8302271FF2FA724D3752E24D219F2D988
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/usbaapl64.sys
- Size 53KB
- SHA256 4dec2fc20329f248135da24cb6694fd972dcce8b1bbea8d872fde41939e96aaf
- MD5 f957092c63cd71d85903ca0d8370f473
- SHA1 9d76d3df84ca8b3b384577cb87b7aba0ee33f08d
- SHA512 a43ca7f24281f67c63c54037fa9c02220cd0fa34a10b1658bae7e544236b939f26a1972513f392a5555dd97077bba91bbe920d41b19737f9960ef427599622bc
- SSDEEP 768:vU8/1lVWV8XDym0ZuDUh6H3PVE+Wy5VRieY+xCpSAy0/5uSnjQVQCMKHUlFMHS8t:NJWV2+ege7xqMqaHUFMR+RN
- TLSH
  T125334B95F3BE6A68F1B7C478CB944A2BEBB57854232057EF059087911F03FE19A38325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/usbaaplrc.dll
- Size 5.8MB
- SHA256 5ed0d8f2066dd19d5aec42c5498fdd1db9cefab4d024a1015c707dfd0cfd5b20
- MD5 1428a8b3dbf4f73b257c4a461df9b996
- SHA1 0fe85ab508bd44dfb2fa9830f98de4714dfce4fa
- SHA512 916a61feb9a36872a7c1adece8933599e55b46f7d113966ec4ad2af0e2568f1a339629ec48eca10bd1e071c88171fe88292dab27ce509ceea42afbd049599cc7
- SSDEEP 98304:ScVhR7NYYT1HxqakUakSocVKM7e2P5oQw1WcATUx+NPGlK/CPGQVbrLdDsS:ScVhR711xqG2NJkfyUx+ElKaPP9RDsS
- TLSH
  T11856D0206B50C856D3584678DCB1DAF481B8AE68DE620147FDFBBEAFB7357633902106
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/DFU_Mode.vbs
- Size 118B
- SHA256 02dad92672ce34d0a83647e6ace232633ad939a10fcc8c63822e9f3315301e0e
- MD5 69bd01f24943aa6cc8e636a68fb87719
- SHA1 f9250c8b3bce5b3b7033231a62334df6e5c977f4
- SHA512 03ee8dc571e06fcfc7a5cf3c6ea25ac407cae8d80be6601d967faed2ba493fc6be41bcf08bf3326274c24093a9d3843b8dcf188f5e9278b4100a84fd05f140d1
- TLSH
  T12FB01208DC7DC460958DC1B81BF09408DB4EEB074017FC78030194840711098231D373
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
behavioral6
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/WdfCoInstaller01011.dll
- Size 1.7MB
- SHA256 f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2
- MD5 d10864c1730172780c2d4be633b9220a
- SHA1 b85d02ba0e8de4aeded1a2f5679505cd403bd201
- SHA512 c161bfa9118e04eb60a885bf99758843c4b1349ac58d2e501dabbd7efc0480ec902ac9a2be16f850b218e97b022a90fcc44925d7b6e5113766621f7ade38b040
- SSDEEP 49152:jRUp077GQSph1DxQOzAFXEfEacq1XT7HM:jSoe1GEf5j7HM
- TLSH
  T1AE85235187FC4099F5B2BF7193BAC9436A3ABD861A30C29E1780D89E19B2780DD65733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/libusb0.dll
- Size 93KB
- SHA256 4b9bd625db0c027f8b5fda8178836ca6920f144562118e9c64277e1b4591efdb
- MD5 4082e1f676499bcdaada87345097d464
- SHA1 ab1ff000298d3c78752f2d690c32a94a8019a3f1
- SHA512 89e4dd652f0cae05474953b42d639a3da2d58ea05fe024c9be22a08f627b33498df9acc96317f0304277ec0b5ea69493aaad1b759b54b10c97a5b0622f766046
- SSDEEP 1536:vd4+fPYI0Or3KYTVPLVsYwUEZWH071Jthfl4pePU6tVs+PeMc+HeMTt:vdnfPYI0aaYpP8b71JtNl4peM6Q+PeM/
- TLSH
  T1B2937D5787A4106FD6ABC839C6E69523EDF0F441076D06CF4221CB581E0B7E6963EB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/libusb0.sys
- Size 70KB
- SHA256 f5b6360ecc9cb4c3f7cfecee0a989c67a6db85866b5735e86854ba13470c792b
- MD5 64cb8e0423184cc68a52bf0dc5489dc9
- SHA1 93ea3f31bf19828c12bc424d656789d74de514a4
- SHA512 c644820a69bcc6b72596d8f385b8b0f00dec231b77215f31dcb640d3fdb7bd735459b54812a1ff3f1347aa4196c71bd350008698736559372aae62e26eace57d
- SSDEEP 768:F36lt1Z74a2U9+BHPYfBoZ4Y5Q/38wbomj/EG7t3UMK2kPlsRtKjKj9MPgkZ12kD:qlD4Z45PxHj/EG7tkA+67eM0s+QeMi
- TLSH
  T110637C4797A5408ACE478C74E6E4C623DEF4F8C65BD406EF02108669AF077E4A73DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/libusb0_x86.dll
- Size 45KB
- SHA256 a706653edddb4837b798b1f6f44fcd4cc4e75827a08f0336cbc713e468a4a5a4
- MD5 7adf671e367a345905efb078985e18ab
- SHA1 ec18e4253e8d283b5605061777a867d0d9d622ac
- SHA512 e6b1c4b65264e2653bf5ddca350b5c523cff0ee57e2550170f718f817b08dcef074aa6a5dee7167abcf089ecd6a717fa1dc4a9fac8d20035c8b9f5a24991e8bc
- SSDEEP 768:Bmy99lJ9K/nWYCc9psd8SkMC+hCNX5KsRpQgx:Bmy99EOnc9qgMCaCDd
- TLSH
  T1DD234B17A6C0903BC8D3017575AD37218AFCA874471937CBF39E4690BBA46C9A53BB4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/libusbK.dll
- Size 98KB
- SHA256 0690cd87d0069edac3a867e0b51f379afa77159eda3b45cd02740fc6afb546d8
- MD5 1604ddcdaed9e447f6729ad1689e5630
- SHA1 a9ff1af89dc327fa7da5cf949610fe5fb4893320
- SHA512 e12d695e672d05e706e6d8a12aa75b4aba0325ea01a47679553317c27e8dabaa643ef866ecf165c504d5855310afc479c1c4f587ba126ab1337b74d27fd1a279
- SSDEEP 1536:xDSAp/Po23FtPlwmcpEUHG6RywZxei6iVy0Wfx3BbAa9aqAe6iPr:xDSQPlkVrThVofFBHAe6iD
- TLSH
  T149A34B47F1A910E5E56BD039DA524ACBEBF1708107A543CF12206B5B2F17BE4AE3E316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/libusbK.sys
- Size 46KB
- SHA256 1df66ff22e2eaec27180756d90926ca5b07e8bcf6b0e4e3c56471e63a3a05fa6
- MD5 a814ff2972f55909aaffd943ebb0e866
- SHA1 b966ad29d209c64b3f0d879703086df1f6121e6b
- SHA512 37f2fe6ae0160d67709b125ff3edcc894effffd377e0086072aa96e53a5191fd67988f2a5465d24c87b41e9ed20f8ae30da18c216a568c7bcac6328ca2ec01b8
- SSDEEP 768:DpFlaIuC05+IPxXgoVer+E93hmk8P3vOUgDhw38nq3lsKgAn:D09jyNRG/3lsO
- TLSH
  T14A235A6DC3D21490FC6AC274DAF25627EB327482AF7087DF0256CA515F27BE16A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/libusbK_x86.dll
- Size 82KB
- SHA256 e908fb5501d74f810948cacbe476658479f19f4d2aff14f9044f18981be9c6fc
- MD5 bd03c4792f08f0c889441f49df9deb98
- SHA1 157c8395159678a02fe55c1f60683b7d0f8e2a38
- SHA512 d8683012112ff9486eef436080f31469ef37be97ba12785d5b23c8f3190800645357436777b8b14da5af5c2342ec0aea6b47ba108d85f0fe3f2719e69d2fe90b
- SSDEEP 1536:hiQXmKxOE4TrpFRsDrrywqNUNnzKJmtRwg4Ka9aqAe6MY4m:hiQWLdsDrrywqNUNncjg0Ae6MY4
- TLSH
  T183834A15B28063BCC8D631B0626D73B3247D90A29FD929CF6B6B0BF885753E1973524B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/amd64/winusbcoinstaller2.dll
- Size 979KB
- SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
- MD5 246900ce6474718730ecd4f873234cf5
- SHA1 0c84b56c82e4624824154d27926ded1c45f4b331
- SHA512 6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
- SSDEEP 24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
- TLSH
  T16225124117A48478E4F2AB74A5FB8A11D770BC111735C3CF8285AAAC2E727D9DE38727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/bcdedit.exe
- Size 480KB
- SHA256 bdd22eb9ccd52f0de20cb14fc0f4797177147328d3d512634d9713c33efd2069
- MD5 3b648a32ed546f44f3e411aa201338d1
- SHA1 20c7ce66553de4d218548bb64f3b26c29bc6d009
- SHA512 2b5006913ea04c0671ff17a52535596fb9a64b6720bcd64f13cdb93f514e37e440bad30f6afb25c7e672bf65aa39df64a8e319c8e34268ec38c0615b96d02ea4
- SSDEEP 6144:kkPtehv0WRcODZ7/S/OfD/HF+3V9gLZxG79AME:kutehMq7d7L/kF9gL675E
- TLSH
  T16DA46306A3F90144F1F77B749AB585609A3B7C916A39C68F229D412E0FE3E809D74B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/dpinst64.exe
- Size 1.0MB
- SHA256 181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab
- MD5 be3c79033fa8302002d9d3a6752f2263
- SHA1 a01147731f2e500282eca5ece149bcc5423b59d6
- SHA512 77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea
- SSDEEP 12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
- TLSH
  T1FE258104E7FA4225F9F3AB7DA9B152528A32BC815B34CA8F4240569D1DF3AD0D971B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/dpscat.exe
- Size 28KB
- SHA256 41cd5d96b0f27ffb85913ac2dd01cee5af973c6c906db49a413f7d77a3d727b7
- MD5 8fa727859b06d57a3173e4f8e5e7ec7d
- SHA1 be24eae1b6d148fa462696d53994f337db912c5c
- SHA512 9e7a6c15c45f530b6c13d2b755e2a90dab0c36abe16ce19d861cf34bc0073250ceeb2e4c593768923c3afbb76fc76be4aefa04eb81c303163d0a504b7c56a5e0
- SSDEEP 384:83BhUZXaQ64KwMKYI2CTAMOzLIjZ5Yu+/Bv6ZlFVDAtyoEsHcU06sOu3RF:zrKwOi0dzM061VDuyEE6ZkRF
- TLSH
  T14DD2C61157E45539F0F72A7076B92A210E397D309E31D3CF968189AE28B5BE0CD70723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
behavioral17
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/libcrypto-1_1-x64.dll
- Size 2.7MB
- SHA256 c246b0eac5994f7726689202de782b9f7c88678cf9d19250d481bb437c88fe64
- MD5 dcf3de145792e70012a4a5df58ad03d9
- SHA1 fc433ba10170c5a22fedaaafbeb0dbd379cfd22e
- SHA512 3bfb2cbe4fc5b7df782ada6cdf5a40aa1d3c528b06f154559d7de5804d8cebac376699af6489f78d024bbdb26140092b3fce103d857bd7e98d5e0d4b60320184
- SSDEEP 49152:zVwAsO8nXHeus0vM6zu/IU6iFveYXpBJLKAmE7sRGtlqb5TNC3h3PDuKPftSw/Fl:0+usisQ+FvTXpBJLK9/5Ter79Sw/F31j
- TLSH
  T1B6D57B17F6A710EDCE6BC170CAEB9772B571B85802B0BEBB2254DA302E13D50571EB58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/libcrypto-3-x64.dll
- Size 4.0MB
- SHA256 6df28ba6eacdf7f4edef341f60a150d336e2407a56e60dad25c819710f00af25
- MD5 c3ccfd47251ebd81be13c284d211a36a
- SHA1 5198106cd030133eca33481757e9d41b64ca319b
- SHA512 691868cb5b0b2a59ecfbf33ac67fc150998025ab8837d325e40adae78ee3669bb5427c58e89651ae1dd4fc4a0cdabf5beb91cc2caa3670e225cef53a74a78bea
- SSDEEP 98304:GbzUi+LxmQLkmq5hejlvQFH5tnkneOf1Cev1CPwDvt3uFMDCw3M6dR:wtqfkTce8b1CPwDvt3uFMDCc
- TLSH
  T1FD16492BE2A720ACCA6BD130962BAF737931FC141370BD7F2654EB342E61D50571EA64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/libusb-1.0.dll
- Size 209KB
- SHA256 76055314e4e69641fb889e88b858bcc14b50aff06f197e5f8d5a112ba2e13ed7
- MD5 31a5d095aac8b96bb00b7436459f98b3
- SHA1 332b76859e9418a54aa90577835f2a6e41e678a4
- SHA512 83f1b1ad34f59ded60b8d873e846e46da1d9607c15a3c6c77274c73f8a07a6fb565366f22e500a00b4992af5fcc54df8cf4fbf0a332767f3fb48b4ca681e5fab
- SSDEEP 3072:lwhaakECr5GrXKm5UcC8KXvnw8seD5cAECoOJhEg2ptfXd3ZkZPO+e3NRwP3HVw:lViKkKm5Xa3snM2bl3ZkZU9iP3G
- TLSH
  T1A0246C2B92D79CBCD593C0305ADBC633F532F8284221EEBF1758DA381E52E91A75DA05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/libwinpthread-1.dll
- Size 58KB
- SHA256 0ce15909fdf6691750616463a90b662e3694efb507e67f71e566d21a07531dbc
- MD5 1c9d264aca6407a9ff8fe4cd83c82ea3
- SHA1 83145982ba73162930665aab0b916a27eac2a1d0
- SHA512 3e8ff62c93cb1f60ea783c9643c1e69430b1d6a6cd6e04c4e922ce4f91a1b72d6bc3c8d1806f5bba5f6fb0467834f3ef38b48b64f8727bed509038e4468609d8
- SSDEEP 1536:ENr8BOnXLnPD8LMEY9nI1hkT4oPm3Yi6D1FZo:SRn5EYgaT5Pm3Yi6D1FZo
- TLSH
  T1FA433B2A72A614FEC556C23495EA5372B533F8302271FF2FA724D3752E24D219F2D988
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/lsusb.exe
- Size 36KB
- SHA256 97c41cc304c4a04c38ff7b40d0e7313e659a7107c05314c29c88526ca1a33e1a
- MD5 aadc8eee78ef3db5b7e53075b3fc94d3
- SHA1 b50a681c447ab41dd307b90c9dd801d524602927
- SHA512 34860d5564321a02da1812be69732487f8f2fa48eccfa5e49d0768881d8c967ec9b1be35b8d3a0b1d61c41c523c0b6c138788e5301f306b106d2a9f1d39d15c8
- SSDEEP 768:J96uXZkL6RxmYGfIZLjUSucuSaUp4ZmnIicNc8RLm3kQ:n6uXZkLvYTZXUSuOaUp4ZmIl763r
- TLSH
  T106F27C326311A07CC0D305B453EEA379AA7BA5B1474503CF63601FA55AA8FE16B34A8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/x86/WdfCoInstaller01011.dll
- Size 1.6MB
- SHA256 c7649879a10c9332fc0f9744c7e3224647aee9e7e62c7e21cf9e987462e3dd06
- MD5 3d2a2d921135801835073451f002480f
- SHA1 dee0ddc820cd0da546dff8bcf2bc490326da90a2
- SHA512 addbe5095430cee8f2a4c25440a9e924520a8eaacc09dcf42b0b2fe7b4930d1f5333bce585c58e7d14ff82c7f9a0dd204b74fef508b96063c181f78382b98aac
- SSDEEP 49152:ZYedhr1GtpoBkCX5onn5BIFpumu5Oo0hSx8fokJV:xPrMoCCXG5+M5O7hbL7
- TLSH
  T19D75229097FC4011F4F3AB3972BD8A665E3BB9D30B31D18C4159D2AD64B2B80DAB5732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/x86/libusb0.dll
- Size 45KB
- SHA256 5e84d13636fbce7869cddc8b20c7d83fa0063e98c319e8e5ab751edc9ee1da76
- MD5 1a534450750eca1f3d951def8d9965bf
- SHA1 7dd82b6d52a840c4979a7515fc7a9ca3725363c4
- SHA512 3acdfff24a4d9ebb4e9647afccf95f33b4580980fb35a91eff65a01ce470b0bbc1a3a27c476653911f1fa431757ca64c945da89da54bffa599744f29123ef715
- SSDEEP 768:Necy9908dqax/5FdC72/WkFkwUEihlLBHCnp+KCI:Ucy9Pn/LdnFFlUEulEl
- TLSH
  T160234B076AC09037D4D34176656E33228AFCA470472977CBF39E5A90ABA42D9F537B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/x86/libusb0.sys
- Size 41KB
- SHA256 aa7d75a4d01b405aab7c848674bbed392b64c6e374e20fd72adc3c96294e2f00
- MD5 c8c9800179af00c90629514e30873d80
- SHA1 9438573aee178c68f49bfa5ad71132d06c4dfa9b
- SHA512 1db533b4ed8e4ae2ff55ef8b93b9186e30f8711e91bf07051c70423bac76d8ef29ebe578483029f83dcb619f94fd8abf453aab78328a876fc88188671be522c2
- SSDEEP 768:Wlqi7sKYNXhDedEP4ofzGTdJ0q7KC+ziB9Kds:yZQlem4Qemq+C+ziBkds
- TLSH
  T110136A41A9819825C9C318F0438D6F328DFBD5D247A792DB876205EDA889BD0FB3D64F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/x86/libusb0_x86.dll
- Size 84KB
- SHA256 241f333c701b47589cd376c2caef102ed2df3fb0b36e480041953fd7959391b3
- MD5 95802285471509255886fb9677328828
- SHA1 7a025d587e056f9fcf5fb7d3ea6c0a7d2f6b533e
- SHA512 c18cbcc89d9887b3c661e78165055c35300ca572791baa47838ad600bcfd2dfd18eaa6caeb6fd010a4cf4f1104ddfb88ac65009592341011539077f60135a98d
- SSDEEP 1536:4y9S2QDC/FerBiDzcmsgkdPxBmbd/VGt3+beM2+MeMr:4puFeBiXgxBmbd/QF+beM2+MeMr
- TLSH
  T192835B976650A033DAD258B8B28CB2335DBCDAB51BD890C7C72797D0A8583D1F63970E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/x86/libusbK.dll
- Size 82KB
- SHA256 e908fb5501d74f810948cacbe476658479f19f4d2aff14f9044f18981be9c6fc
- MD5 bd03c4792f08f0c889441f49df9deb98
- SHA1 157c8395159678a02fe55c1f60683b7d0f8e2a38
- SHA512 d8683012112ff9486eef436080f31469ef37be97ba12785d5b23c8f3190800645357436777b8b14da5af5c2342ec0aea6b47ba108d85f0fe3f2719e69d2fe90b
- SSDEEP 1536:hiQXmKxOE4TrpFRsDrrywqNUNnzKJmtRwg4Ka9aqAe6MY4m:hiQWLdsDrrywqNUNncjg0Ae6MY4
- TLSH
  T183834A15B28063BCC8D631B0626D73B3247D90A29FD929CF6B6B0BF885753E1973524B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/x86/libusbK.sys
- Size 41KB
- SHA256 6265ae9ae5c49f515613f0b749ad8390a1b34ca326203318bffeb6c2c281d2d0
- MD5 1f17dfe26285cf9971e55ddff915877b
- SHA1 4ca41a2dc9cb5679c917035b64616333f09e1be4
- SHA512 e1e6c186307917a6d2fa641bce96e71d15a79b80ce48a74b241bb020e6b1cdcd94c9e65a32283ee86dce3fd3bbf9161a50e6b8445859a368be848e71686a6377
- SSDEEP 384:ZHWvOrIuIlUc5lxC2SwbckkmFsTHczYjmxgUSI27EO0A0BoUmROX1GuOLRJ5MdJI:xMl5lUc5lxrtzqUSppOEhLRJ5kkAKgXC
- TLSH
  T1A2130620E1A10425EFF19BF729F56517967BB9502B20C5E7C22762C84A3F2D07F2626F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/ref/x/x86/winusbcoinstaller2.dll
- Size 831KB
- SHA256 ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
- MD5 8e7b9f81e8823fee2d82f7de3a44300b
- SHA1 1633b3715014c90d1c552cd757ef5de33c161dee
- SHA512 9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
- SSDEEP 12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT
- TLSH
  T1DA051211B7A48271E4E326B486BCA1B1597DB9B10B30D4EF6782A2DD0DB53C0DA7831F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/bin/usbmuxd.dll
- Size 39KB
- SHA256 349a3d0c855aa6592a581d3161ada03a67527738a38e6c5805f5492bec81ff75
- MD5 211c3f6df1290b508891202e994d9b44
- SHA1 12595b371103d7201d5a3961fae50ce7985e47a2
- SHA512 57692b8ca04abad7b988add794c38733dc8d4800072b50c2f26e60873085f822b2223b710795e2289885ee7d4739283b9e8d8bec605d18693bcc490828bac728
- SSDEEP 768:xBhcih+dxO7T6+77KygORWL1sOdVmoZVr:Xhcih+Tg6+I1/Vmkr
- TLSH
  T14F032A03538E80F6C56300BBDA224B2FF27172A2276566CF1360D56C5FB2BE66535F86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/LOLToolRa1nV5.6中文版(win越狱工具)/iMobileDevice-net.dll
- Size 169KB
- SHA256 f3bcf42b55a8f6ea12c7591abc4b4dc0d5060ae6060bfcd817d50343bc395414
- MD5 71059a8e996c7b308de1ac88c88c9436
- SHA1 a628c1e4d7389c5f05d14112ec87addd21ab03f8
- SHA512 25df79ab8eb8123760d762e5b22040cd6579f461d262349eb99f51faf5f6b09dccada8a99f9d6ff5625723531627dbbd1ea1ea8956d124f133a362b2d12295c0
- SSDEEP 3072:Y8PMsddItiwh0tg4BmcycAhUTG812Fr0Fe:Y8pqlH4BmBcAh61x
- TLSH
  T1AA04290497B8C366D79E6732BCB52A158BB0F2853373876713D09FF26963BC45A81392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  LOLToolRa1nV5.6中文版(越狱工具支持ios15-ios18)/UsbDk_1.0.22_x64.msi
- Size 6.1MB
- SHA256 91f6f695e1e13c656024e6d3b55620bf08d8835ef05ee0496935ba6bb62466a5
- MD5 163a9d11b9fdec29027abc090059c08d
- SHA1 5df419114f2697c053b3cff414950eb5166ecbf2
- SHA512 9e80cad0be81e13827f7cba3d44ef23847bca0d2c8c1663c75a833e8f26dacb626d69b7ee9b8191111847996a034daf181756ca07b5956058a07856bbcaedaf0
- SSDEEP 196608:A3yzLWzWg+LC2dVZyL0MU6diS+fWe7/00la:sHz/2dKL7jdiPOe7/00
- TLSH
  T1EA5633DAF9F0BAB9C16678B783D76D02017A0C1D53F7B10A6780FEDF86B2DA56086144
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence privilege_escalation ransomware
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Manipulates Digital Signatures

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Manipulates Digital Signatures

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32