Extracted

Extracted

• • Target
    Guns.lol viewbot.zip
  • Size 73.2MB
  • SHA256 1bfd71376c6b02fcf3a153733c2fa300cfc7c42cf0d0765c3ae259d1ea577ff1
  • MD5 918146229b875c55fcee1b60d427e409
  • SHA1 8d820ff7ae709383692fbeab20bd1805bb31b442
  • SHA512 23a045c8969100b302e2656aaeb6d927fead1e472f5787593ffc79c7d711deb6e2efdfd083d48c5275cda58a24f9d727fc06fe33dab76f05ddf7e4b35a8267f0
  • SSDEEP 1572864:tatuTJW66UQI8ivqCnxaIr+1Vczjt1SvbOK4uYmcdDpEQDZpB:Atk67irhBpkvbF4u3cZpX9P
  • TLSH
    T1A9F73376E01CEB47D38A4E6252ACD9831ADFB7F4077E66E5B04E3B1D119EEC5E10048A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Guns.lol viewbot\Guns.lol viewbot\README.TXT
  • Size 562B
  • SHA256 c39c8a424286a8ccb8aaf8e8006ce26eb9d5a153360c17e64d022e338e7cb612
  • MD5 a70367169ff8be3aaaf6477e264f4a1d
  • SHA1 10374a7cc1dfc709523a9529449c3c91751e1f21
  • SHA512 7425caa6dad3aa84ecaa8d74385da1f3c682814764ae73944edd2c18c12762b14c11160f2ac33b4f696f690329abcfac2d8a934795721a958d0a3dc85a96570e
  • TLSH
    T1D5F0208B79C02BAB72E615B3F0811616C360A20E125454708C96E0CE087EF6500FD7DB
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral3behavioral4
• • Target
    Guns.lol viewbot\Guns.lol viewbot\guns.lol viewbot.exe
  • Size 73.4MB
  • SHA256 caa5ffb3d7aa963a0ce0d566cd912269e97031c50d16f042585489b7b4d8787d
  • MD5 7b8e6deb4add06df0ed937cefa9abebb
  • SHA1 a89cf2c8a849da62f7c7ffed2f8f86a082784be9
  • SHA512 c88e3c047923969fe760bc93d7aa090ecf02bbcb14da1d5c3a3cc647613030c7d0b0506d186b96dae20ffdf2976c7a74a8df268a6d0cee98a50d63e39b65a62e
  • SSDEEP 1572864:AcJmfzAIueAS0q9CQ3JQwXE1PCF5/Xu/j0OWkMmQbxNhogy:hJmutExHv1+/j3WkHQVNag
  • TLSH
    T1A3F73376B098AB46F7470D914A67AD430E8BDFE753AD066293CABC2C5C1FE55EE0008D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxmrigminerpersistenceupx

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5behavioral6