b0330068952f9a4687a9aaa7cfdbc7668378ee5833e78f52fb4d0c154d5086ba

Sharing

Copy URL Twitter E-mail

General

Target
CyberRT-RCA.zip
Size 139.7MB
Sample260723-pcxwpawtd1
SHA256 b0330068952f9a4687a9aaa7cfdbc7668378ee5833e78f52fb4d0c154d5086ba
MD5 4e330de93d189385d64b8ee96fe0687a
SHA1 b2fb004492c0a288102b0f081c0a62ce36a9660b
SHA512 4da91d321f0ef35727d71e172578cb10eb49a4b47dab5ee492a008b2f9cf302d69310eb69d3218a9b63cfa53c0b59db22c912077335f2970c8070eb7e9c930e8
SSDEEP 3145728:FgEqIMka6NpA+LozN3USWwMTfOWrF4XOclYE4YN+43hEDwMs:ivkbMy1wMiWeeyYvA+imcT
TLSH
T1A86833B16F7DEE41ED701FF9BC9D1222A965F27862B18B006AF2715DBC005E84647B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CyberRT/CYPHERRAT V3.5.EXE
- Size 9.9MB
- SHA256 3e72a2103c302ade5c7c08ce1d98f058aa8125adaf412c83fcc4131a4e5335d7
- MD5 623f98f4bb2ca5b2259840ed23955b85
- SHA1 3cf1431dec424c836921a546b448cc359604bc0b
- SHA512 1fc2a23dac57197544903df3466fc95861e0dadc2536450bb968aca5de53a631c8a3b920b6a7eb0c3374c90e7722f1b98599e00c7b97124c6909619f7326bf40
- SSDEEP 98304:AipDNPSmCzw/K1b5Zhqkm4UgUTS24Ug0TZ92S:p9vCzw2b5m4B24C
- TLSH
  T1EFA65B342AFA1029F373AF794BE4759E9DAEBB633703945D1061138A4B33A41CDD163A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral1
- Target
  CyberRT/MetroSet UI.dll
- Size 444KB
- SHA256 6288e559b0f34d56ab4601ffb2ba2289001c77cf7351d135dd93915034c56bba
- MD5 d99a97de55b2561e57135433b44bb786
- SHA1 ab588b8d36683b52adcb32c03a9859b884838f29
- SHA512 7ef95cb161265fcf110ba843fe3af5e6cf6d47465e17a10c742256bebd91c128df2cfa7d21696d716bfa861c952d6fad445912f8cca9da9cb03d780211b0545c
- SSDEEP 6144:PTJ1DwrSfCmrB0O1SIai39IkRetlJT4ihPrsAgbP2UiuE2Bnw7M:rJSpmaxIephPrYDK
- TLSH
  T1B7A46B06A3EA571EF1AF4779C4BD01B143B1FC037A3AC35A2CD9B59E59B17448A82393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  CyberRT/NAudio.dll
- Size 498KB
- SHA256 3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c
- MD5 6ca17abccae3050f391401b2955f9333
- SHA1 0975b039a793accb58130d6639262cd291d80d5d
- SHA512 c08f366aae9baf0e7762f47a2f79d0dee5187a1d7631e5838590b7c12911bdeb6247e0ff860ade36e04f1d6717f919ad98df6d3a1a556bff4b8994db9616ccec
- SSDEEP 12288:MnXnae2TPlr3zvzar5oRDaw92wP6mai9gs6C:K8lrT+r5ADakP4i9gs
- TLSH
  T1B7B45C5637E4552BD4AF2374E4F0090A47B2F48B36A7EF8B5594A7AD2D837824D00BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  CyberRT/System.IO.Compression.ZipFile.dll
- Size 24KB
- SHA256 b5c12e9099643e2eda9b49edd0d98bdaed153c72a7e8e6235d8e78714402d16a
- MD5 dcda916372128f13ada8b07026c1b3e7
- SHA1 99d6c187de8510206a93d2eed9c65e65e0c86e72
- SHA512 d66de5d61cf7090ce2e11ca8064723a44c2fdbd7ed937f1cf4198ebe13083037941b816ad9022d332bbb853666785600fa8b1faca94c498d2f82de73fe1e42f9
- SSDEEP 384:dK8Y54xRiW3mWeW+mWE3rq0GftpBj52ERHRN7dldBopPI:dKfemqiuEBHoa
- TLSH
  T15BB23A60D7BC4213ECF35D3066B8D6837D3CA7D69C20966A449AF1992CD33D1DB20E29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  CyberRT/WINMM.NET.DLL
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  CyberRT/res/Plugins/Android/gen-2.pl
- Size 4KB
- SHA256 f0326ad672ec2278750232cc920769710972da0594f45641441a4327a555cb8e
- MD5 0037f9d6a388db91c980351af4c03b2f
- SHA1 9384a65d636944e42c0e93310dacf68dfe016782
- SHA512 6ae67ad4d61ffd437c7b5b6044c6cc2c99b47619e0a7d3338322e3df1181dc66bed393a2466953e5b4eafb8d4b2fd7864e61b04479e74e0ffe1fd8d1cdc6d57e
- SSDEEP 96:2Pm57RfU5dE1Yn8RA9O6vUfXDmzWyPVEjCjpHY0e3/:2O5lw8RAU0UfXalNK0xYD
- TLSH
  T140A16CC3BEF65FF7521009AF8AA63D445DA0C87A70E410C7BB212FEC20D13518972D60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  CyberRT/res/Plugins/Android/gen-3.pl
- Size 5KB
- SHA256 42c8d417fcc509864d08d42ef61a4926a17010abce6c1f06187acd931a9eeaab
- MD5 a03b010aaedc90001f105b4858a4e8d1
- SHA1 44191d7dfea55cf37b6b14193801c90741ebb8cf
- SHA512 8769d8329172a6d95b99056bd0b05ccab41c9b4b9b7efe16f2fb22a3f8acbab98d273a3c6bf2e845934ed58e95a08229f0fe27f78f057ca2c3f2ad547f863145
- SSDEEP 96:2Pm571ukquJN67N72vNx+y/NeFyocWiBhpWKvgnJyC5a4h7Ybt:2OauuhI9/8/X+pRvgnJR5a4h0p
- TLSH
  T1E3B18E72536D6E02492C5E3642993D6D49355BA7D33726DC28C78B0393E7FE084B42B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  CyberRT/res/Plugins/Android/gen-6.pl
- Size 7KB
- SHA256 69572ff59d2f8b428fa2e5fad4c6abfaa78813b889740a0b17c3bf4ff522f2c7
- MD5 d324afb827bc0410b7387f2f22d14242
- SHA1 bc8e494e86e41bee2ce2add6d0fe8919656a7102
- SHA512 c337ade6028a734922d91e96abf87f889d57ebe825ab0a4c0d927cffb26e38558fc1c3f61ee042f423e639e60637b4b41cd436aebc054df2196868d58bcf428b
- SSDEEP 192:2OkFCNbNbSdOYT7Ax0xrUhmE7OH7Vgpet+gfLTkRQi33o+:2pFCNIdO24gr9EiH7V03gfnkq+
- TLSH
  T1C9F1A028B153E19313499E7420F34E00AA0B9507FC27AFD17B172C48975A373983576F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  CyberRT/res/Plugins/Android/gen-7.pl
- Size 5KB
- SHA256 3a36e9b32c7bee100d590a31b8e622a229c6168e2fcd95dbd9fa934025e6787b
- MD5 a9f48543cf1571322f575724a0e8de35
- SHA1 edaaf35c07045f0d0376202700d1d3213e42c246
- SHA512 0b7f72c4b68e78f2c73485387a3d6e0d2dc92a2298bf0f737ccf1d4bf508db1e96a164550ed7a3a0a74f99cc89d989e1d28ecd986c4f164a0b22e9760dadadc1
- SSDEEP 96:2Pm57cUV8+pZmIjZ9gZdXarsspyqU0H16DN1kvZFgfqYTfTvPNLMrnSkCXeYH/:2OduEmIj8ZdKrQ0HkzkvZFO31YdCuI/
- TLSH
  T1ECB19FAF3F29611213B466729972341A561F2A2BB509FCB06EB45EA101E4B35C4296E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  CyberRT/res/Plugins/Android/gen-8.pl
- Size 4KB
- SHA256 ed866f146cc3cec59e01c9ec18aa62d25590c9f789ec127c4c8d29350970edeb
- MD5 767a048eec9220ff6d1434f8a6e6bcff
- SHA1 c328487ea7944dd413e6675065a4f22a8b0835eb
- SHA512 4bc516c28b4d701153fec415c666f466f21aa095f6ab396cc98f84dadfb20fc60c47a6d6fe52ec43e964bc38fd1ac779e512171c6435f261710f53bdd3e7aa3a
- SSDEEP 96:JK+BK+W8yWwp+sT+YEIjxVuakCSq2z50gcBXfj8dPaQnmeCwKGS4AE9Wq:YAK+DrOfOIV7kx/cd8U5e0rZlq
- TLSH
  T169B16E4B97D7F7804B8C158C63829990D1C5D268B9E0E893DC0D5EA8E59772182EF4B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10