General
- Target 101 tiktokbot.rar
- Size 5.9MB
- Sample260730-pevt4sxbmc
- SHA256 19dda8b4f8a3101c53246553166f584207ba3d32755765972a0e666404b71e9f
- MD5 cf17c5b2035600a0997e1c72eb559a1e
- SHA1 561a098f09a85d964e7830c468e6610de49bc01e
- SHA512 3980f675a4cba40fc4b04ce0ccba84e8c3f613cbb8feca77949e59c88f38b67f6de9cace918ef5e34e146829cd848fcedd26024c3245fedaa7c0c7df458f81a3
- SSDEEP 98304:MWkfiO3yDCkWDl6fh5xeaYs6hcyTGBIxC97VlhLQLEwUc+DSsT5M5t30CPFu:4fiO2C7BmTerzjTGBnhLeEw0jML30CP0
- TLSH T14F56334201529335847D64DDAE4EBEC40A2F294C81FEC5094A925DEB6FAE35CE3BE34C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
101 tiktokbot/MADE BY 63857.exe
Resource
win10v2004-20260513-en
12 signatures
900 seconds
Behavioral task
behavioral2
Sample
101 tiktokbot/MADE BY 63857.exe
Resource
win11ltsc2024-20260709-en
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
101 tiktokbot/setup.bat
Resource
win10v2004-20260513-en
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
101 tiktokbot/setup.bat
Resource
win11ltsc2024-20260710-en
16 signatures
900 seconds
Malware Config
Targets
-
- Target 101 tiktokbot/MADE BY 63857.exe
- Size 12.5MB
- SHA256 e9cf3587f71800bd41c0c001f9e5af03db379f8617c15de04b0054125c0016e7
- MD5 88c4b0ce6eb84cfa5ca54658e65022c2
- SHA1 87e3f9afc6d84e17d4c80815a496a0fd90a2f37e
- SHA512 1e0c3bc6f6fb65933ace9de6d8d470bdec5848f3e5a9515e4a5714caf59e64d82eb69dd692e3e2d2b6cd0a0aa8cd8f78d69179a7322ee8c0c454f1183bc949ed
- SSDEEP 98304:AEcZPANi0gtlFdifbrRhWtdhS0ly9HESE5C2MR6VOOXKu1EHm/3X7vetXEGJ+EGK:AfINU3Fd6RcSrZR6VOOWm/bcXEGTb
- TLSH T10DD68C43EC5156E9C1ADD232C9B686527B717C485B3223D72B60F6387E72BD0AEB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
- Target 101 tiktokbot/setup.bat
- Size 2KB
- SHA256 49e71bdc92dceca528a424526d11319f4ba884198f383c10aacdcd4250258180
- MD5 ac56f4490c552e0c5338173a1470fc53
- SHA1 4b0787ff431a0c46d89e5fa6acf503607fe96ea6
- SHA512 548bdd619f746dd2ac7cc72c0ce40cc49044fe61f7c0deaef2ce2b58081137904aea5a797024379ffbc7948cdc136dbbc9de4bf735872d1edcfd954ba47e87c0
- TLSH T171514F3B780E4136515D8BB05EC611937E88525F82202EFDBAEF80642F65BD196FE7C2
- MD5 SHA1 SHA512 TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.