General
- Target anime clicker.zip
- Size 53.2MB
- Sample260730-s5taravwet
- SHA256 fdb5acd2b661f63f10b1005f7f1742747ff443a80f8d34dc7e9c11bacdf6e279
Malware Config
Targets
-
- Target anime clicker/_internal/Crypto/Cipher/_ARC4.pyd
- Size 10KB
- SHA256 f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1
Score9/10-
Looks for VirtualBox drivers on disk
-
Downloads MZ/PE file
-
Looks for VMWare drivers on disk
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
- Target anime clicker/_internal/Crypto/Cipher/_Salsa20.pyd
- Size 13KB
- SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target anime clicker/_internal/Crypto/Cipher/_chacha20.pyd
- Size 13KB
- SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target anime clicker/_internal/Crypto/Cipher/_pkcs1_decode.pyd
- Size 13KB
- SHA256 320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc
Score1/10 -
- Target anime clicker/_internal/Crypto/Cipher/_raw_aes.pyd
- Size 34KB
- SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
Score1/10 -
- Target anime clicker/_internal/Crypto/Cipher/_raw_aesni.pyd
- Size 15KB
- SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
Score1/10 -
- Target anime clicker/_internal/Crypto/Cipher/_raw_arc2.pyd
- Size 14KB
- SHA256 1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9
Score1/10 -
- Target anime clicker/_internal/Crypto/Cipher/_raw_blowfish.pyd
- Size 19KB
- SHA256 6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target anime clicker/_internal/Crypto/Cipher/_raw_cast.pyd
- Size 23KB
- SHA256 7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target anime clicker/_internal/Crypto/Cipher/_raw_cbc.pyd
- Size 11KB
- SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
Score1/10 -
- Target anime clicker/_internal/PyQt5/QtCore.pyd
- Size 2.4MB
- SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
Score1/10 -
- Target anime clicker/_internal/PyQt5/QtGui.pyd
- Size 2.4MB
- SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
Score1/10 -
- Target anime clicker/_internal/PyQt5/QtWidgets.pyd
- Size 4.9MB
- SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target anime clicker/_internal/PyQt5/sip.cp314-win_amd64.pyd
- Size 119KB
- SHA256 d28abbdd34489218c228dbbd3b6d2dfad87e172e975e8d69d2e8f3c4d6d4d376
Score1/10 -
- Target anime clicker/_internal/VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target anime clicker/_internal/VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Discovery
Browser Information Discovery
1File and Directory Discovery
2Peripheral Device Discovery
2Process Discovery
1Query Registry
5System Information Discovery
5System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2