da6b7e7711108cc9b4e2f79945d040a1988252cfefa13f05f19a47bb7b6f2701

Sharing

General

Target
Пароль MultiHack.rar
Size 73.4MB
Sample260723-xcf7yacf73
SHA256 da6b7e7711108cc9b4e2f79945d040a1988252cfefa13f05f19a47bb7b6f2701
MD5 ac4eb245c613ce2f60abe1fb5b42cabe
SHA1 aad44e96dd0ca02c396ab04923a7c87c2a981369
SHA512 812b83746208a4d13f697fbd0a6f232de53dce7ce74037412b567a741f7e325896e34652e510b7669ea636d8a9f4444f8e14ab8536ecaba5956146a1a807ba93
SSDEEP 1572864:urbxFYn8fzKbECzjjRC9jotK+2k3HVxV9j059s/Q1cGEVe:urbnr8H49sw+73fw5Ma
TLSH
T1D3F733DB19C68C32889109EBF12BD2772A3B72ED45353E45ABDB57259F40F0A860F14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Пароль MultiHack.rar
- Size 73.4MB
- SHA256 da6b7e7711108cc9b4e2f79945d040a1988252cfefa13f05f19a47bb7b6f2701
- MD5 ac4eb245c613ce2f60abe1fb5b42cabe
- SHA1 aad44e96dd0ca02c396ab04923a7c87c2a981369
- SHA512 812b83746208a4d13f697fbd0a6f232de53dce7ce74037412b567a741f7e325896e34652e510b7669ea636d8a9f4444f8e14ab8536ecaba5956146a1a807ba93
- SSDEEP 1572864:urbxFYn8fzKbECzjjRC9jotK+2k3HVxV9j059s/Q1cGEVe:urbnr8H49sw+73fw5Ma
- TLSH
  T1D3F733DB19C68C32889109EBF12BD2772A3B72ED45353E45ABDB57259F40F0A860F14B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  MultiHack/Data/Playerdata.dll
- Size 81KB
- SHA256 4597db9e09292ff3ac80d9e4dc29bfbc3b37db9e730ed4542d04ee299aedeb3f
- MD5 9a517c47f10dd513309a03ed268b6cd6
- SHA1 8505bc886aecfb54870d335737772b557f1bd419
- SHA512 be0ea979dcb66835c8ef8b9b14f7dc5c21785d8271ee2f85ac9221f23bcc252ef1440c8372ab37cd20ff39c9031fd166cef8ed43527a8d3c5680282c7712e04a
- SSDEEP 3:HxBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBL:r
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  MultiHack/Data/Versionshelper.dll
- Size 151KB
- SHA256 6048a3a158239e9c433ece9fb2fcfffac9c74e562bf0df2e764f5f5576963e93
- MD5 4a75f1ad5ff63763126c8c3128b3387e
- SHA1 e9e5c1e8c6f5d39eb9c350ee3643dcbf4f7bbaae
- SHA512 bbac4405a106d887b161aad1255f7d7dae42d566971ae054711e90f91be9cc2e1f1ada27efc05ff4d3cc98d5c3decd9a40588c88cc28f01f5c5f0b08e3fa3d23
- SSDEEP 3:HxBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBj:D
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  MultiHack/Installer.bat
- Size 365B
- SHA256 db72fffbdf0b00f014a5b4c783bb0e384242832a034f4d50317fee6399dd9248
- MD5 ef26fd835abdd47338322cfe67b3eea2
- SHA1 1b25396f851f8a37bc153d3a5722f11776110f4c
- SHA512 528bbea5ae643a4ca193262fe5e61fbf7d87cd272b236a669588d836c11ab556c8647bd5886026185fde956a730c1d11e1cdc291ac82eb25824d591143e98764
- TLSH
  T163E0C043978CD1FC8B1744E5C4AC6B8EF20F908186C79203237AC426DE45EEDE29C5C1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  MultiHack/MultiHack.exe
- Size 73.9MB
- SHA256 5f1375f37e0b6ade7f3da82b40dc163aedd78ec9e138c88273f4e15fff988a1d
- MD5 917c87b0f04440b6e4ced8c7ef3b0947
- SHA1 362c4ec3e78e8c3784df5953059b05441cc4cf65
- SHA512 3de0d0e9663c555e48a19c76173e308aee9436f1ea1f3f9d5253a3074456511764dd5641637da23f09cb6b987ffeb69ca8f7ae2278dd102ff008d9136a2b5ca7
- SSDEEP 1572864:+s9zHvUMOtzWS6+dy2J0f0/rBdsG7bpip0WWPiIWK4cNhZ7yc//q:+s9bUXxYI5BB7tE0Wmj4cbZycnq
- TLSH
  T1F80833558911165FE24D9336E2D2C93F3BD6198F8A1AC0C92BC04E47BBAB1DDCD39D22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral17 behavioral18 behavioral19 behavioral20