4fd12da8fe94dc72d008179fdfe63265a4b2282cb38857e1720b1fc3809445d2

Sharing

Copy URL Twitter E-mail

General

Target
BCrib Spoofer.rar
Size 7.6MB
Sample260727-zmsd3a1fjd
SHA256 4fd12da8fe94dc72d008179fdfe63265a4b2282cb38857e1720b1fc3809445d2
MD5 a48475db76da8d3f261b244e99b122c7
SHA1 6f987feefbbf067f77a3b2e9c200aaca2546b734
SHA512 89a1cf0f3e068de60b1afc7fe04a8b9e535e37f175e7646382d2f29e50ba0e1952ae5142cb7a27eee11c82f3f09190c5141a9e7d4b6b1d8226a168533ab09e1b
SSDEEP 196608:vE0I2RXjBjMp5qtK53Tg5zm1ga8G+4IBl8sEZy56td:vE0fVjBjq5qwOmK/haC6
TLSH
T1A586330C04756ADA4EA91E8927B6B6F202775FA34EB5B5EF82CCE6B017081F547073C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BCrib Spoofer.rar
- Size 7.6MB
- SHA256 4fd12da8fe94dc72d008179fdfe63265a4b2282cb38857e1720b1fc3809445d2
- MD5 a48475db76da8d3f261b244e99b122c7
- SHA1 6f987feefbbf067f77a3b2e9c200aaca2546b734
- SHA512 89a1cf0f3e068de60b1afc7fe04a8b9e535e37f175e7646382d2f29e50ba0e1952ae5142cb7a27eee11c82f3f09190c5141a9e7d4b6b1d8226a168533ab09e1b
- SSDEEP 196608:vE0I2RXjBjMp5qtK53Tg5zm1ga8G+4IBl8sEZy56td:vE0fVjBjq5qwOmK/haC6
- TLSH
  T1A586330C04756ADA4EA91E8927B6B6F202775FA34EB5B5EF82CCE6B017081F547073C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
behavioral1
- Target
  BCrib Spoofer/BCrib Spoofer.exe
- Size 146KB
- SHA256 03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547
- MD5 d19a23517f43e45508a441d58f7c63b1
- SHA1 a4a07748a51a0e0aaa15c7b23ab98a45691b185e
- SHA512 cc8ad848199af3e3fe2a45bed81f0e75bd21d85b62e88c56563969d90bf4f0e804b30f3745cf17f0dc4c6f8d85f707fbf903d8d45b47e980bf5616a0126429ae
- SSDEEP 3072:HhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuPCRL:HhK4XycqgpfCup5sVxuZ04uhAE
- TLSH
  T17AE34A03B2AC00FDE1BBA37889A25906F77678594B7197CF0390C56A1F67BD09E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

costura discovery execution packer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
behavioral2
- Target
  BCrib Spoofer/Instructions.txt
- Size 322B
- SHA256 2d934180978e693050c66d9a766f48d7461a201156ade9efeaabd80415f523f0
- MD5 132afd72c58fb51f2808de0b0bf40c46
- SHA1 24a632dfb5a1b609e3e35f174fbdd7682180510d
- SHA512 57f910e7c04002e9dca95a0e94a3eef2e39add2646242fd24010a7d213fc38cdc02f76ae3b38ab5bad58f4bfc90c9a44aa01a326b6e2097fc12e2580b8dc2b58
- TLSH
  T121E026A4637FB33814B4C615203F52536E13D826011F15685498502CABBAF83933EDB9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  BCrib Spoofer/Microsoft.Spark.Worker.dll
- Size 16KB
- SHA256 31f3712698664514a3350bbb9e180c9c904ee14e56e99f479bff724c05dfb78e
- MD5 b42ab06dcd91b11cef1ad26d3ecfff7a
- SHA1 e7acfb7d84484830efc5f7c297259d5637c4a74b
- SHA512 6ce37648354a9debb4639f40c5e1a3dc02b3b7b87b5a4ab4d3bee30d47b2e98876747c850e2449427b876d1ea2ee864bf053f64743ca98fd2fe26e34887137bd
- SSDEEP 384:eM2CVB9lYpqTGt/2RwtKb7YUYSeflO3oVqvWVwx:eM2Cf9qcm2RwrUYSew6qxx
- TLSH
  T119728E11E7944736E9722B7678F72B11173CF6298A638F6F5950801F0D767C88722B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  BCrib Spoofer/Serial Checker.bat
- Size 1KB
- SHA256 dbd8966e5a30d6e7aaa18235257532131f43d8978e980349654cb83544788af2
- MD5 725a8b187cff5caa6e4461f9cba238cd
- SHA1 4d9459a89e6422548916dc855c854aadcd810136
- SHA512 8815363e98d673bbca6c5e6fea88868f1abcba727115461b625d4f498edc39f7e93fa1a6f7a3babc7fd75fb04a1f94ed30bd6e7e7a6b71c4510fb6cbd17ab43d
- TLSH
  T1F141E311B84408E836CAEB690E3246B330A2489BC5751D8D3A9F82384F413ED7A9BF5D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  BCrib Spoofer/System.Console.dll
- Size 170KB
- SHA256 8469deb8c7d532e8857f5c68deb291035103dee3698bf5005f4e08c5bd05775a
- MD5 e58a5726978b1dfd94b6b4cb38102340
- SHA1 d1a561662830fd01351341ca862bb93191095338
- SHA512 2d7b698720d7ab2e8535a68afa3aba41d39a888d05e59454cb7e35ee04e9e3caef52ea9be46bcd8e28c7ef4e4098f168d7d0580347a9f980893198995301a388
- SSDEEP 3072:zqPlmXCzdfd6+Vfz5mDVV9evshARZvgL4OUgZjZXR1BB1GlKi7:uPoXifd6qwV9eEh2ZvgmQ9bB2KG
- TLSH
  T1EF047D2AAFE8252BE77F857444930301D637A9C70302D6EB61C585892F43BC6FB726E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  BCrib Spoofer/System.Private.CoreLib.dll
- Size 12.6MB
- SHA256 4cd6810b4ebe8d6e1f5928f2026d257c112380d33b557a60bcfa9c7f2bb012e8
- MD5 8b5ee62abdb7b72f418d797fe73f2521
- SHA1 77582007964cbb215278267691a255b63abe5ffd
- SHA512 870ef275e1e8d1607e2b22eb25f1f05f99346b54651bc119d809bf21f1a6f041eff801b3b5e1ffbb1897975feb2c3aa47b3699cc4c63eca8e3e6a60387ab4bd9
- SSDEEP 98304:FdVXzmQ6u2Pf1F1HpwajX4p92QKxV36FChEqiPVGK5+k+uiCi:9WuuT1HSajXgJgV36FDqM5+tuxi
- TLSH
  T15BD6AE21A3C45F16E56EC739C6638292E2B0F492535295CBC05DEFDA3F13BC15A3B262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  BCrib Spoofer/System.Runtime.InteropServices.dll
- Size 94KB
- SHA256 127ea3f2ff47cea14c082b2ed22066554d22c9d8f97dc0d403b17042fac62a5b
- MD5 1df866f691def4290407f5cf01b996ad
- SHA1 b2ba5af3f80aab63ef2fecf6341b44deae201ac1
- SHA512 6f96aec2abf7f6e96b7699f67cc8547334277c8e502e6ed357713c54b68faf264b1843ea42e6ab0f7c6ad7dcc1098b9042e1d5f15e93db6f8d346f613d1f6a1d
- SSDEEP 1536:4o6MupEelCtJfKS6+67NspnSPM+l5+CkmVhKWHOiOyzUizB:4o6R3lCto+dSPM+rJkm7NOxMUil
- TLSH
  T1D2935A2037C84666CA2A473C9C775D50C9B2F6C613A2E6DF5781895E1D9B7C0C3B23E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  BCrib Spoofer/System.Runtime.dll
- Size 42KB
- SHA256 9c506c9347f872c3375255f744dcf83b71a96ff71cbf4a19b39873fa22f73c22
- MD5 dac7d72763e59a64c0d706325b747d92
- SHA1 5890f0ee30b86e01ab55d6017261554d16f6c916
- SHA512 4218ca96d6d2d4e24e3b6a70a87890a9035156d522d217f48999870f644548a7bc5c09b78b23de41c5974c375f9d03ed49054a173b4230ae835ff808469ce50a
- SSDEEP 768:2+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLu:KB/LuYdy50b4b7RSHTSkingzIh
- TLSH
  T16D13D5A0AE485333CD8B6B72DC73AC810DF233C4047A597ED88EE51A13867748236B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  BCrib Spoofer/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 a875d0785cae18ee30db531303c166ba1a1d30c0ca4ab8edd38fe04056f91eaa
- MD5 7b3bded48604bacf38173a19cb38f269
- SHA1 9d15d2ad99f7437c9ae1775898c739712f8e5f93
- SHA512 a34cad7dc195b6c5b8a5c89e3a93083b1d401b5f772807524cede69210b04bf8fe746d9925c2fdb18b8d0f7636cfdfe48cf26fb0095500739cdc48e141bf344a
- SSDEEP 192:h7mXhp/SxgZW6sJWDWWxNzx95jmHnhWgN7agWP3zzccADB6ZX01k9z3AqRrimR:h6xiUW6sJWDdX6HRN7azzccTR9zlRrT
- TLSH
  T160724A918BA84207EDB75EB0A6FDEA823C3C67C25C11A66B16C9F6541C633C1DB3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  BCrib Spoofer/System.Threading.dll
- Size 82KB
- SHA256 15cc9db291b87042f1ab4319f8d04f4cd226f15bf88bf0810b31dcd50fb0bb7e
- MD5 932a0c2978b649703c40b260b1955d26
- SHA1 e9a4c055bc14b3a2db5bc5d0cf838e79838ce8e0
- SHA512 51d6d767425fa1afa0acd5a149b99d4c62bab174ecd7485211e9b9635eb876319e8ad2a96d9a7cef26beb855da3661b26912f05014f6dc22cffe33306d9988e4
- SSDEEP 1536:AWgoICPLdImrmODZcUBeZ8j0GEH9wd633GRm3LGgLWz9zu:AWgo9PL6FtZ8j0GEH9wd6GR4GgLaS
- TLSH
  T1FB836B197BE80416FA3B47F9EAB69906C472FCD20710C6DF5049910C2E67BC1DAB227B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  BCrib Spoofer/cache.txt
- Size 32B
- SHA256 a9f1bc171c4eaf42337a6a5d3f195f1994fdc6cdb1592bc7835105bf56faf406
- MD5 422ce5708c704637a26a5bcbc68cd0b0
- SHA1 41241d5c4f55e88c256cea9030cec1fca981a8aa
- SHA512 ecd1e10e45978cac20e97c52966e8c1bb96ba6112a517b60e3856ff3038c1b3ea029b927450a633c2fe15d4e1681ff25650cc200b8c2b72672d2787fa7edfc62
- MD5 SHA1 SHA512
Score

1^/10
behavioral12
- Target
  BCrib Spoofer/clrjit.dll
- Size 1.7MB
- SHA256 0dfe34be78144cad7db5b66a7fca3d86178ec0f353aafba6c81eb72e797e383b
- MD5 cafab1ff05ff429bd46cb78b2ff8e9e8
- SHA1 e02b3b243b6993c0add46cab15bbb6549c602700
- SHA512 f19b60d26d784b2000e67a8698f8915ef623eee074dab9b853ba927a20ff11ab267c4ba385971620470987240263f917199e1424f3d23d263382163d66435639
- SSDEEP 49152:OkM51Lv2FQJioLYRa19wEvKugOQY5iW4WGGzgdZO3Ebz8d:OBioLQi9w/5ONiVGzgdZO3P
- TLSH
  T1AB85AE46A6F805FCD0AF9534C6574A1FEBB2B81A13209BCF43F409A56F237E2261E355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  BCrib Spoofer/coreclr.dll
- Size 4.8MB
- SHA256 b4375494bb10be11db6134d361df2f39a7a2c7f6696ca8d239a3ed424ce66de7
- MD5 389f964635cb95c6696744f56cbc092d
- SHA1 f133da56b7ad65d162656e052c358328877db1b1
- SHA512 49dbab9c3d1e9fe506ea7e0942d431559dcaf406c8e8233afdd234bd8337f735e1d9510861c1de00b7295d5956ee166d0ad55afce2142fd75a876f506f4dc661
- SSDEEP 49152:jh3nYAkdW1bIowGlFCJvETHWzaK6YL/XPSpRdUWPfeSk5GjyuQS7bPdB15i9FqeV:jkdW1bIowcrW6p0qnWHn+2OSn
- TLSH
  T14C368D56B2BD01E8D4BAC078C9D70A17FBB1B8590738DBEF02654A651F23BE16A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  BCrib Spoofer/hostfxr.dll
- Size 342KB
- SHA256 130a3656b07a317f859d542c0f11339f3d0ba4198169853781a3fc04ed64c907
- MD5 00f6fc45937b885439cc6c1a34dc96c1
- SHA1 5df3efd8a49b91e5af676d35c02e75a640f4755f
- SHA512 75f088c244271142c58a7ca8f42ee68b910332ac2a23c44f7e6f6c38ff2334f96b8f28ef312a79461f5c631b07110403523b67245be8d3c7b6d0368913438085
- SSDEEP 3072:zoo0qOJezezqrPeYvCuV10J3keQRJysmFTHABK/o3BCLNzWNxEvf5NCnFeotrcRw:0o0qOqqYvCuV1jyFTuKA2zGxuIeotdt
- TLSH
  T1E3741906A2F801BCF1F7A7789AA64901E77B78454B70D6CF0390846A2F67BD0DE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  BCrib Spoofer/hostpolicy.dll
- Size 384KB
- SHA256 65d61078b6b97884ad09aa12da97d96f50f7d98e6d163c926ae199f9bb58a3ce
- MD5 25fd4181ab8b572a1bbfba2f4a9ec239
- SHA1 b834dfc4c908b3cb8d3fc40771e6d0e900c7de64
- SHA512 38b708595e5a91194fdb089ae56e4051841c27406f8e770bb720ee9a5d66e6fb1ce8599f224071c2c23d30d832315c2a51a532677f121b383547f149385d1246
- SSDEEP 6144:Ux0Ke3VmzsnHpYHkGWqTRDERqBwT5eQC0+1Bs2u7FksfEXk0Pzfw:k0KWVmzsnKHkgTWkBDQq1K2vk+4
- TLSH
  T19D843956E2EC01ACE1BBB2785AB34901E7777C49077196CF13A0946A1F77BD09E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Badlisted process makes network request

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16