7351cef8962873af2e0cc0696f69dc664824a5f2dac2e74a5bd575c38dc55b1c

Sharing

Copy URL Twitter E-mail

General

Target
csbot_51.rar
Size 466KB
Sample260718-pgssjaew4z
SHA256 7351cef8962873af2e0cc0696f69dc664824a5f2dac2e74a5bd575c38dc55b1c
MD5 bf58644e2486c6440fe61beeb5ed0983
SHA1 c6d1e4228726671a05d268f096bb81fbe7a8d8b5
SHA512 c6a9ce2e0376f1134fdbf3e8faa36f49c3eb1eea29ba428a4a5ab9b06e2f4fa6aa8d200d14469b44fca53318756891d69fbcb97608bb159526f0234e51ce0f3b
SSDEEP 12288:gI/Heo0bvDzkvtFeG9X4TbPrRf2KrqBkMbEi:g4Heo0bLz0tQGCTLrdVOBk65
TLSH
T187A423F36557A728D2127FF8D0DFB2D022715D059F7B3EA29D4CAE232CAA2B44067512
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  csxbot.py
- Size 7KB
- SHA256 62d68a48aa0f0ba080148e8e1f01ae739eba87ce199471214b86c13402cca2ea
- MD5 551023053270afbd02e51e2d0a19e476
- SHA1 6d04b47f18baa5e798d43c1c2dcc8dc76a28e309
- SHA512 319daf8241c09698beed693cd44d17bcf4ab8df1c23fe2910298fdc09bb705e23b40148dc0ffadb45d870885e48179e743a3ada260a504ffe4a3669a925497b4
- SSDEEP 192:6OPYTGsP+uyEiymDgR+D48Bjoca9TjJK15S0KJ+on1N7j4SP8:rPYTP+uxqgR+BBjoca9Tj415sn1N7j4r
- TLSH
  T16AF1ED129C0E245662721F9FA9035988F20F65D7293B7C20BB4DE174EF74A3EA3747A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  protector.asi
- Size 3KB
- SHA256 a0f7671970f4fbac0e29e142e217c80e13ed4a50f1a4ed20dfd5176d279d3a12
- MD5 561cd87084d643a4791dcfe1e5a13af5
- SHA1 ece309fbd924e31ad36e53a694c7351304bbf8ce
- SHA512 c0cbcdbc56e5e8ce5d6e66f1a904b3113fa4ee7c05bb958321e5f2aa63c8e11f9879c8e8d3d204eccbd3fe0a6d5c000d43617a2eb38e79eb627be0e8720e5696
- TLSH
  T174519E2B93B08EFBC44D0374EC59B81D73A851258AD28057AE4D143A7952DC85B31E02
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery themida
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral3 behavioral4
- Target
  protector.dll
- Size 439KB
- SHA256 99305a76ce403b2d50052a349ac6a3c5e43e980786ce3005e1f8ffe4c194d529
- MD5 62625c7fc8bd610b1d848bcdf02830e3
- SHA1 519c0d92864e04b08b5129c2b97f899653697eed
- SHA512 e87ea9f49bb66b7c98d8776eb3f06f0ec99b91de03ed0b059bc2801890006ec1e99e0c8bfadbce95378e2c642b88a564ea97d9ad30e6d605e7e00b8ad5360b2c
- SSDEEP 12288:CGoShVg5QjJnMBf07u/uEyRrXoUvXabONBJrGcX9UTJH:0wgqjJMBf0KX+rXomabOL9Gma
- TLSH
  T158A4230EB61F8D01DD553FB15A3A37AA12BE6C4D59F0FE3860F0F446B60085E251A8DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery themida
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral5 behavioral6
- Target
  start_csxbot.bat
- Size 16B
- SHA256 2c1f0dabe381e82541917513c276e84309824710b3cd2213e548ab9a9804a135
- MD5 8ac9e98237a883631f82fe9e63547056
- SHA1 5c0a46faf4a235207e71a5ce0a92f2f831d0cbd4
- SHA512 806de6be76954d05f34b286773e229f415be4346011adc7846786b61069fd88044ac62f83f87571f137d27204f299f0d0680e2fc7c287a6107bd62f79f27da9f
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies Wine through registry keys

Themida packer

Identifies Wine through registry keys

Themida packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8