Overview

overview

9

Static

static

7

Nol_crack/...13.pyc

windows10-2004-x64

3

Nol_crack/...13.pyc

windows11-ltsc_2024-x64

3

Nol_crack/...13.pyc

windows10-2004-x64

3

Nol_crack/...13.pyc

windows11-ltsc_2024-x64

3

Nol_crack/...13.pyc

windows10-2004-x64

3

Nol_crack/...13.pyc

windows11-ltsc_2024-x64

3

Nol_crack/...le.dll

windows10-2004-x64

9

Nol_crack/...le.dll

windows11-ltsc_2024-x64

9

Nol_crack/qfb_gui.py

windows10-2004-x64

3

Nol_crack/qfb_gui.py

windows11-ltsc_2024-x64

3

Nol_crack/...tor.py

windows10-2004-x64

3

Nol_crack/...tor.py

windows11-ltsc_2024-x64

3

Nol_crack/...off.py

windows10-2004-x64

3

Nol_crack/...off.py

windows11-ltsc_2024-x64

3

Nol_crack/...UI.bat

windows10-2004-x64

5

Nol_crack/...UI.bat

windows11-ltsc_2024-x64

5

Nol_crack/...��.exe

windows10-2004-x64

1

Nol_crack/...��.exe

windows11-ltsc_2024-x64

1

Nol_crack/必看.ps1

windows10-2004-x64

3

Nol_crack/必看.ps1

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    ac1ce32257194eca649bcb93d1ea8c99aec7bb0852a25a16b398528857478d17
  • Size 9.5MB
  • Sample260724-psbndsek41
  • SHA256 ac1ce32257194eca649bcb93d1ea8c99aec7bb0852a25a16b398528857478d17
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionthemidatrojan

Malware Config

Targets

    • Target
      Nol_crack/__pycache__/qfb_gui.cpython-313.pyc
    • Size 11KB
    • SHA256 34e4d3e0f47f78ded65218a004026f49d42d9544fa40946fa41c251042fa057d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral1behavioral2
    • Target
      Nol_crack/__pycache__/qfb_injector.cpython-313.pyc
    • Size 12KB
    • SHA256 a55705441d57f8a1892a6a549715f7b50239d35e2a52a28eb597a246b84d82b7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral3behavioral4
    • Target
      Nol_crack/__pycache__/qfb_injector_irc_off.cpython-313.pyc
    • Size 19KB
    • SHA256 d60178920cfb57fac54ba8c032bcff5b8d62b1fad29fb525f952b2a9cdbd1d83
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      Nol_crack/halloManbo64.loadable.dll
    • Size 7.3MB
    • SHA256 c1a26f27858398592ba075698a24b823d4a210e3242ddbb859ce754cc5c86578
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7behavioral8
    • Target
      Nol_crack/qfb_gui.py
    • Size 6KB
    • SHA256 0225b3e39672919f6da28d62aba82c15db37c73ad93efc24a945edbc50f7ea95
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      Nol_crack/qfb_injector.py
    • Size 7KB
    • SHA256 d106b1217d833665b9d09b439a2a58e958a310cf4ec501319748fce598ddf434
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      Nol_crack/qfb_injector_irc_off.py
    • Size 13KB
    • SHA256 34ada85bcc13c536333db4c8a52ab69277859b3d9d7aeecdaf50dfc61b4402bd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      Nol_crack/启动GUI.bat
    • Size 219B
    • SHA256 7f870e0d17755fb6ac3600a04fc6fd1b8cb7337d123e8532f67d04221e358143
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution
    behavioral15behavioral16
    • Target
      Nol_crack/如果没买过nol就去下载python,别用这个.exe
    • Size 3.7MB
    • SHA256 77a84c4ed29551d8968a9bc5de796d6f8463fa54df8554b3cff91ca83d8ff70d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      Nol_crack/必看.txt
    • Size 609B
    • SHA256 6ec992dbcf648c781c58d03677ac5d243660f06412236f178564cada725115e5
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral19behavioral20

MITRE ATT&CK Enterprise v16

Tasks