Extracted

Extracted

• • Target
    Guns.lol viewbot.zip
  • Size 71.0MB
  • SHA256 63d3149d81cb17fffc1b92d9d5fb81f78b323c1f7c132fdb672cd0e9f10e7acb
  • MD5 e74b275862f4a70c3057f6ca6e9b421f
  • SHA1 c261e964da55dd0337905c9b845d662cfc560822
  • SHA512 726ec6ca24f4591681b44d72ef748e0263c18ae6c4a4ebf9ead333d040bcfef43bf702ef07e18c35bb5321e0230850603d5b84372f1957559e97743d3c138326
  • SSDEEP 1572864:sBhId0JDRnug99NX6Cgi1PVM/58ManA0UdSgqTDai:sBh5JD8g99NX6Cg+SR8NUMgqvd
  • TLSH
    T102F733B97309DC44B90459AB864F253F890DFA532FC8C2DD901D87F233E2E2967625AD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Guns.lol viewbot/Guns.lol viewbot/Guns.lol viewbot.exe
  • Size 71.0MB
  • SHA256 43cbb951d6f30351b22977eb5b0a9a2e2df44e4f9f7bd19fde5792ae74e8423e
  • MD5 55abaef12f7ad08e053c1d81a1c80c51
  • SHA1 1575fc0b0fbf666ea74b14a3975a77e92d1df251
  • SHA512 5360a507e8f60ac64e3ce0695cb6d17b5498596e09b30ff477a49656cb30e2021517454d93f8143f5ff6bb6a7ed41e75229bcbc1850b789b79749d79720c6f01
  • SSDEEP 1572864:877IhCyt/tmo97nBack+bZHIfV2OGVCUe5QEOMPk:877NytMo97nBack42N2jemEO6
  • TLSH
    T189F733B57309D840F50489BE854F243F8A09BA265FEC969DD05988F633E2A2937735FC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydefense_evasionexecutionxmrigminerpersistenceupx

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4
• • Target
    Guns.lol viewbot/Guns.lol viewbot/README.TXT
  • Size 562B
  • SHA256 c39c8a424286a8ccb8aaf8e8006ce26eb9d5a153360c17e64d022e338e7cb612
  • MD5 a70367169ff8be3aaaf6477e264f4a1d
  • SHA1 10374a7cc1dfc709523a9529449c3c91751e1f21
  • SHA512 7425caa6dad3aa84ecaa8d74385da1f3c682814764ae73944edd2c18c12762b14c11160f2ac33b4f696f690329abcfac2d8a934795721a958d0a3dc85a96570e
  • TLSH
    T1D5F0208B79C02BAB72E615B3F0811616C360A20E125454708C96E0CE087EF6500FD7DB
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral5behavioral6