General
- Target Clarity Makcu V2.6 - Free.rar
- Size 78.6MB
- Sample260731-atfleaaa45
- SHA256 959b5da0362bb7bd6f3e72da784ff2a1178d219947b97aba70bcbc10d25cc2f8
Malware Config
Targets
-
- Target Clarity Makcu V2.6 - Free.rar
- Size 78.6MB
- SHA256 959b5da0362bb7bd6f3e72da784ff2a1178d219947b97aba70bcbc10d25cc2f8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target AI_Installation_Guide.pdf
- Size 17KB
- SHA256 2a6227b91fa6adb672220af14fbd56f5efeffbe1f59b5d99e72ef606ffb9a2a7
Score3/10 -
- Target extra/configs/!loadersettings.json
- Size 97B
- SHA256 4f6f3998b33224bf7b9e14f1d04f7a94c9a6637db6094cdbbb60edef43e00fbc
Score3/10 -
- Target extra/configs/insane fortnite.json
- Size 1KB
- SHA256 8bf61fb5a59cb8673448a1f86a1ca0686666eac3253733bb5d51946d81b4fd02
Score3/10 -
- Target extra/configs/preset-mid.json
- Size 1KB
- SHA256 0c405c5b5246ae8d4392f51784e90da8ee1a32d60e97cd6740015b5a566cd8f7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target extra/configs/preset-smooth.json
- Size 1KB
- SHA256 7fa3d46762dc949a9db1ee754972f80ede6f2bbe3695c34fac755ff07e5136ae
Score3/10 -
- Target extra/configs/preset-strong.json
- Size 1KB
- SHA256 4e06689c503ea63cdcf35de9c3c8eaf983ee5d5ee68d2038934376e6eac338d6
Score3/10 -
- Target extra/cs2.onnx
- Size 11.7MB
- SHA256 bb4a927c764d555c40c48c11ca09a7ab1a74aef25d806c7a77fd654f8b0d95f8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target extra/fortnite-best.onnx
- Size 10.0MB
- SHA256 ed4a6f95616b6c4bc22da95f666e3a2d9beeedca32d29aee1f12b1dc2edb7d5b
Score3/10 -
- Target extra/fortnite.onnx
- Size 36.1MB
- SHA256 7c9d3653a9e1bbd7e77e11f20781d4ff40daf68a0a61c21433ef5990026c4b3c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target extra/launcher.py
- Size 490B
- SHA256 b1118a792e0b1ff20dcfddda6259f9582f47ad04852ef530364c2eabbbe1f8e4
Score3/10 -
- Target extra/main.cp310-win_amd64.pyd
- Size 1.7MB
- SHA256 79c9e1077d18814c0fa2d455a8fb9620e5c0f47e20280f23dc35e28373adf5d2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target extra/roblox.onnx
- Size 11.6MB
- SHA256 1517b64bd4e4dd23516881bb6495944a60547e590eef50664be4e7edcd5104ed
Score3/10 -
- Target extra/universal.onnx
- Size 8.8MB
- SHA256 6c21518eabf918f18a7f3f72a03914f34f4771c837c2a6eb5f60582ffc793aba
Score3/10 -
- Target installs.bat
- Size 4KB
- SHA256 1576f924c091b697b767344b7d518b63377e47d9ad4b7df9037160953c503676
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target run.bat
- Size 1KB
- SHA256 be85d43a50af84de17d180aacc667cffbcc6666ea385435e220918195da3a475
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1