4b5b6596dff7e7123e46379b7d310c318145ec054793e30533c8e31085d81c6d

General

Target
RextBotX.rar
Size 104.8MB
Sample260730-rsclsszcnb
SHA256 4b5b6596dff7e7123e46379b7d310c318145ec054793e30533c8e31085d81c6d
MD5 ccc2dc0378db4a93bdbf99ca988df9db
SHA1 4fc0de82ab65afbf87d916c2882889e1912b8e92
SHA512 ddf852bb2a42774cbdcb994988cff4d21c6ad87ef663e6d1910a60500baad781c34f9529ebd16b6c87a3022db317fbd2780fb0ee40e51da9784fe6993b2772b2
SSDEEP 3145728:L9BY3pye/Hw9s3D+cVP+sZ60747jEK8RzfCfxLS9O+q:pBypyeo9aVP+sg6aRxk2
TLSH
T1813833D5C7B6C69F80A7E4EB6A82C80204564E4171FEFBBF6937245249F821AD339707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  1D003CB316E1.exe
- Size 17.1MB
- SHA256 43782d31333f0512e34d54964477f3d58e327e47baf27a606c146d9d0700d9dd
- MD5 87c0c4f8bca054063841527561d85c61
- SHA1 304e30e9ec71ed120118f3fa1c27465eac18cc01
- SHA512 ddffd9e8de45ef8732c388c9b78136731de5de9a0979ed59a384d3d9256f2a6b51bb09c67fe0850eb7116f16eeebe1a72dc44127e1f719aca453f2905dbbbbea
- SSDEEP 393216:fqLYj55hn7jSG6VQO/KSo3uV4zWQuZxg08MBS:fqkl5h7K+pS7QuZ+MQ
- TLSH
  T1C207E116774561BDC05FC078D20B9A366B72348A0B30ADFF51C5A9742FBAAF05E3A718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  locale_folder/x_bot/app/Resources/map_img/map_attr/Metin2_map_capedragonHead.ini
- Size 2KB
- SHA256 f20cb5b36e1fa44a1299ea9591be3ba9a22794f6d0ffedfc8b5bbae278ac1ac2
- MD5 49ebb4252a2b63a68b3770c07f5e9dc9
- SHA1 693453d1b103651a137ac52ae557f1fb9857bbf5
- SHA512 2173b32324b83629620304866ef46bf100b4832e34cd99680dc62c89731718312d49a8d2c7d6b8e31c74b7e7a1cfa8218ae03094390ef2ae4b05b5b771ed7e93
- TLSH
  T1885164AE508645016732D391BAF1B20CEE51028BF3D66E40B4BE566B6FB5A01C8D3FDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  locale_folder/x_bot/data/i.exe
- Size 348KB
- SHA256 7b8e2d76847c0add368a366824e80002a6ccc4c9a2a9f6ba7dacd5badd91d6fd
- MD5 73337af069025def7e41dcea39f6893d
- SHA1 14c94ea0297ce0f3e3b7440761159e2e690f7253
- SHA512 44af2b90ee9da88c079157067f0b77cd58603ada09e596a7ba3b93883dc1cbc19857e72cffd18feb0c26f73cef8492a44e23098abc0a8afb42e72a78e00562af
- SSDEEP 6144:zn4CvIxfc2p63VPSR+VXMYPqlGb50/1PEhOUg0:zn4CgxpuXMYPqi0NcsU
- TLSH
  T1AB748D1AEAA814FDE1B7C178CD674906DB727C4B03B1A6CF23904A961F276D44E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6