0600fa07b6c78349e604c8511db4a324b6fa34668c4254cfc5bfbf6866089206

Sharing

Copy URL Twitter E-mail

General

Target
Cyb3rtech-Tool-main.zip
Size 31KB
Sample260722-rxlehafg65
SHA256 0600fa07b6c78349e604c8511db4a324b6fa34668c4254cfc5bfbf6866089206
MD5 fdadf7e9bde5aa05fb68f2d289f8871f
SHA1 60c87ff2d72b17fc02150d6af9956462a092ef4f
SHA512 bc1e64305ed1f9a3ab9cf92129e84a57458c683648932fef5c2bc61461939e3bede3defb995ef05cc15460b9c99402c5e3ec874d85847111f8c8c3b0e03d7d49
SSDEEP 768:b0LwbWBUbAs25y5sVOF9a3s1A/qh2oXb2xJ:bWQWBUw5LOFQ3sCeb2L
TLSH
T1A0E28D4EE2352C61D88924F676A60193F2A5CD2174386BA28C97F7F60C2F569FF0671C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Cyb3rtech-Tool-main.zip
- Size 31KB
- SHA256 0600fa07b6c78349e604c8511db4a324b6fa34668c4254cfc5bfbf6866089206
- MD5 fdadf7e9bde5aa05fb68f2d289f8871f
- SHA1 60c87ff2d72b17fc02150d6af9956462a092ef4f
- SHA512 bc1e64305ed1f9a3ab9cf92129e84a57458c683648932fef5c2bc61461939e3bede3defb995ef05cc15460b9c99402c5e3ec874d85847111f8c8c3b0e03d7d49
- SSDEEP 768:b0LwbWBUbAs25y5sVOF9a3s1A/qh2oXb2xJ:bWQWBUw5LOFQ3sCeb2L
- TLSH
  T1A0E28D4EE2352C61D88924F676A60193F2A5CD2174386BA28C97F7F60C2F569FF0671C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution installer persistence privilege_escalation ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Cyb3rtech-Tool-main/.gitignore
- Size 197B
- SHA256 4f207cf43fe9740832085752dc0a6f7d02f066bca55cc18c61b94c3a92fb3449
- MD5 f4835ed1ac50c4b3f25444af89718923
- SHA1 def69160fd0aeaac2504629bf4371f3ec7d348f5
- SHA512 b9ea8d0cbec7b9ed7ab69da0ea850043ae153cfe6105773fe1f7c6fbb79bc56a4672c6355d1721f05375c5f64875cd5d2e886a9d93da845addd0b6237ade4c60
- TLSH
  T1D1D0225E829C256F228211A8520BD1C0C47C2581F2515EB0B0BD02BCA08C7E3C8BAE81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Cyb3rtech-Tool-main/LICENSE
- Size 1KB
- SHA256 5497b4b2fd49b774f3e5bca0c80d0e5d8225eb791b8a45e6b55dcc50d9397b7e
- MD5 7c19856d98a6dbca5bcb41465fe4ccbb
- SHA1 e0572fd709ee64493074cfb24f0e990c2cbb5e28
- SHA512 34c872bd6cc1ba009582f8c891026ef0329a28b399deffbcf385ab1b2ed82fa97e197054f8b9df3a2ca491bfd24cda44cc09cdbe7e5b76c1ebe1f366568e0503
- TLSH
  T19E21961F72510B72189A1360567968D5F23B725F7A5F2A84246DF244233A06CC1FB840
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Cyb3rtech-Tool-main/README.md
- Size 2KB
- SHA256 98a2018700ff6328675fec42f7ee4aa7bfc26901a14134b9e8531ca10a50711d
- MD5 d7f7dd0ff3adaced7e3fe3270dcbbb3e
- SHA1 3a8d1f4dbc51b59221f4733ac5433dd3a6fea47b
- SHA512 63fac19e02d196a028791f47560a87e69812559d005d77c359e9149808760cbef9e42c351341925737a5b9c0ea7e4efffecc675d89039e3bbf24f6d742435b44
- TLSH
  T1C551A7BF686930F62F4330947AE75117E539903D7AC3F308CCB76465B16CEB54649A84
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Cyb3rtech-Tool-main/config.txt
- Size 173B
- SHA256 cc4788e6a33b5a0cda78d185f080642fe084314a75e1e4d70013d2c8f4aa6751
- MD5 e5449b658a9726111482ec8579bf0ccd
- SHA1 32dc6edfaef535bd9411e93d854f91b344d9ca26
- SHA512 7844234c7b954af3278135234600c43ccd663ec536a20a8e7b618cc86b3f4fdf07c2dadf63a54307d92a0ded001de02d64cff1c9108a6e6bf5e3c59af9fd62c4
- TLSH
  T1B9C08C7FEC2AA0E78B1521AA509C0103037C04D2F8873F81486AF4489A2DF1B7AA2F01
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Cyb3rtech-Tool-main/cyb3rtech.py
- Size 9KB
- SHA256 cbe0168bf746ced6862044072ff6ccfc1a9aaf49b40b6d2ec0efd0b6a35e3c42
- MD5 3e42d5dfb51a07c8915110a85fb9b06e
- SHA1 8d80dadc16a95b634705143e8c66b71e5c7264b9
- SHA512 bd20447d6cc6b7d5c45a8fb39c42bd98c4a2833e2383406387de81105cb3871c87e3ff070ec5cd8add447ebdea8a3b6f7cf30ab2ef661a8a4f4e3dfe91b281ed
- SSDEEP 192:+ITYynTtuk02/MccllqzbvCYXICNrjz/y0N06jSviauFi:pTdnTtb0EbvCYXICNrjz/y0N06jSviaZ
- TLSH
  T198229A2914903A50C282BE5A417DDD89964520CFF9F02623F0ED75D4AF3F9A0EDD3EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Cyb3rtech-Tool-main/nextpage.py
- Size 9KB
- SHA256 0fd0723c4eca7e330f9f2196e2b6b32563ccc7bf552a6be787ef04687e3db987
- MD5 7c2cef4b80ade412944007c32cb6f786
- SHA1 031f97acbea69f0f0cb04af7c43cda38836fd165
- SHA512 6ec5fdd35c33c03643e8319d8601da6d3211202837651f30fd664d98cfefa455650ee40e1dc70fa319993b50ed8f38a1a65f80c674ad09c737064a49376d6819
- SSDEEP 192:+ITYynTtuf0wN/ATVucS1nq/3vC6XICNrPz/y0N06jSvP7r9CNFi:pTdnTtw0hTX3vC6XICNrPz/y0N06jSv7
- TLSH
  T1DA22792518A07A61C282BD56117D8D8D960550DFF9F02A23F0ED35D0AF7F8A0ECD3EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Cyb3rtech-Tool-main/requirements.txt
- Size 69B
- SHA256 a62a647c59ddbd7d5018302e01f98c4b96026b1a63cf69a8c02770d8d0c87166
- MD5 59b5b8eda8d007247f4265a3f80e36a0
- SHA1 5a14322f2c57eea1269b7b17ffe56b10faba5290
- SHA512 6a09167cf69231632f97a3475cfd89becb164d574e55569ab0478f97933a0465835e69e6efcb2d896d34858dab0aa8e572763e079a0f1686a3ae6c64bf841304
- TLSH
  T199A022228880A80000F8CE388230030003002E888800002EE83C00C30E03F3830B2200
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Cyb3rtech-Tool-main/setup.bat
- Size 1KB
- SHA256 316eac5bf83554b452a9eef84b414cb95f9756076e4ad517ddfe6e5432220b5b
- MD5 dccf210496160a37672c015033ee51dc
- SHA1 9e6ed5e8caa2abcf7486b4a77bb9cc06a2a0ed63
- SHA512 56686117f30a6a2b8db6857be14a7136f2f14e617c536ff474518941237d6eece572323547bf4df2804fd61f254520d1e709118b9d40eb117a3ec4c2485d596f
- TLSH
  T1CF31F18723A453FA549E454F9D02208335C6C59B30DC5EECF89FE4480F46A6597F63B2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Cyb3rtech-Tool-main/setup.py
- Size 754B
- SHA256 1b900069c1f592b879cfe6c5bfe469abe3b4eb8acd6480137b849944f600333e
- MD5 314e96afd376141796cd5a5f9b9b1b3b
- SHA1 346154d5bf54a2a3b0b398938bd72c5e366eaed2
- SHA512 53e2f1a732aa045530079ace8f5f1d3f077ab5370679cc24c7cc85ba26795a57392d70063c7a4071e7ab38b09f71bb3f17802a9b26b66bf72f7211fb77dc6c22
- TLSH
  T17801244A3372B570E78622DF51D300821572A1931B61922DF2FD11D8CFA1C249326B34
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Cyb3rtech-Tool-main/start.bat
- Size 25B
- SHA256 c08b532101cc17454dfb4b789a33ba239f64e3b74aa2ab200279804d85ed4e9b
- MD5 50ac436b714922d9fee9f7f612cc7289
- SHA1 669a0c2786445c7006587a9a1d8fd02b81d6b7ff
- SHA512 5db16a6aca12b69e3ebfbaa8c364a10b1598efb7da27ae95eadf7006f874995c24f27ec7326463a2aaa43d272992f4be16e00110a1f4bcfd47714f28a9043f9b
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Cyb3rtech-Tool-main/tools/bot_raid.py
- Size 8KB
- SHA256 8ffb2445f4db63f078d7520571150fa765f1957f93d9f765ca89697eba583e68
- MD5 d6ec0628145cf71e90939da45b110543
- SHA1 f34010679c35cbeeec35d37b4b0649c3ab7cd306
- SHA512 6545589ab26fe03ab3ede378b242bb87275a716b5ae9ace31ef2965e4a4b4d790adc6b7e2e92074baaf0afdacecc3f7c2387a31d1c49450db98254a5ea539aa6
- SSDEEP 192:XZV1PtqEvYv1cmxx4UoY+ftwSKf0UKzVYKl16UCwLwqwfwbwdw6i:XT1PtqEvYv1hGA6vBYKl1xF0d4EWP
- TLSH
  T1290235FE64C03900870E74AE94CB90179EC6315F56B4202AB5FCD1A8EF6AD71F252A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Cyb3rtech-Tool-main/tools/discord.py
- Size 1KB
- SHA256 5a5c296d807c32ca20e62ad1bd8044d09bdf0937d9f85768732286c80acd027b
- MD5 840b5d96691c8321f3484eadbb64d74e
- SHA1 8eddde9febbf4eb41c62ed097665ee06eaa58f02
- SHA512 b0831f317aab376b0776f9502b882aef9d9ec18d0f7e5df6a8b325179d83c7a5004bcde8f0c106a166a2d78c43b6586aec9596667c4ba36da5cc53dbc973794f
- TLSH
  T1BE41BA3938D13B028B45445B6446C5BEEB9A26EB9DF02026F0DD4200FF99DB27250AFB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Cyb3rtech-Tool-main/tools/discord_nitro_generator.py
- Size 3KB
- SHA256 605933aea7f44b350cd0b2d71d9574f893065450ef9c08300bf47884bb7d0386
- MD5 9d40a62e8a99ecbb474c630f34c0f6bb
- SHA1 031d00b95481ff0c209ecec38e8643a65f840720
- SHA512 7234029aa4e046ed43b8d4f2862d7615d071943b864d9d42b5a3fed5686fe8ac1fd0f409e3de7fa808e545ccc5fc3b8d2f5324b1f4301d09dcd1de053c877965
- TLSH
  T19E81993A34D53B128B49849A5986C0AECBDA26D79EF42435F5DC8360BF9CC7032402E6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Cyb3rtech-Tool-main/tools/discord_raid.py
- Size 1KB
- SHA256 9842775e8d7d2c22e595625a44e9bde51586ed18b04ab6739f6ff11c9666474b
- MD5 9880ec73b03824094f6438517c08298c
- SHA1 814914e5b46ee3d30e2b277d6fefd03752551c39
- SHA512 f35b9503243ae73427673bc07cc82b3c6501c275f8f6ac22a9afdfb98a0594ca6f598c41a5debd1c1e31b60ab3cb4f2e86b0dc0d4e21d02a8266ef6f669e2430
- TLSH
  T18531057834D12B014B4A505FA586C0EDCBD566C76EF02035F0ED1610FFAAD71B690AF6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Cyb3rtech-Tool-main/tools/discord_token_bruteforce.py
- Size 5KB
- SHA256 9f1344975ea1069346b0d2b784405d4900edf9ae185529fccd879d26a9d7269f
- MD5 fa33d07562d36454a84ed89fd0c4b3f8
- SHA1 4d61c3cfe2009973f160521150960f311f4ee5fe
- SHA512 cc4e52ee093c5c33197c0df8305c270f8bacf074acc75a5ad4d21438d75b83e7c840f904d3a4665f3ad87cd1c6b664ff2f0da3ae00e124f6032dfde03442814d
- SSDEEP 96:GiMeQibC7nAIpI2lvgyYSBzCTbovoPtFbkHDzCe5gGf/lt9dvnY5HaNC1fY4:1MeQibC7nAIpI2lvgyYSBzCTbova/AHm
- TLSH
  T1C9C1CC7834E12B11CB09C89F84CAC06DDBEA39D75DF02420F4DD8260BF99976B2516F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32