Extracted

• • Target
    mert219 hiyaki kaydeş priv pack.rar
  • Size 65KB
  • SHA256 b9632aa8ada5325939af3c2c36366fe6d0976f2dfef4e5a746678f3573bddf8b
  • MD5 d8e6b13efff013ab495ca8fbde5ea6b9
  • SHA1 241db29113215abd50647662ac50fe8b0d4d44a8
  • SHA512 6a4269a8877802489524740a2b5a7ea89d9d205a429c602d986794fd478ca1fe23cc9ebf23deb996ee9b3264b3384e3a14e81d7611873987aca4a0cf9ec144f7
  • SSDEEP 1536:D1ckNwWPBB2P+GssxqFuWr+dHi46AUkiji+7NoupYmbR0:D14WJBCv5Hi4Ckobm
  • TLSH
    T16D530209FAB83B77BB7F5824F21DA085E1DCBB8A844CED9FD11574105A1124E6C7067A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionblankgrabberumbralransomwarestealerupxadwarepersistencespyware

  • A stealer written in Python and packaged with Pyinstaller

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    mert219 hiyaki kaydeş priv pack/assets/minecraft/sounds.json
  • Size 551KB
  • SHA256 c37d3d4eff899680bb2892d611e68644f32f7470bb54953affe94cd2031df9cd
  • MD5 1ff2d091afffe7ea52648417c0ed030c
  • SHA1 65e6d5482d97966fc8c870ce3c0c6483158e63b8
  • SHA512 f693a74924795c8f5fb6280a63c1905ea37885d8936878ebee0676ab3ca58d0f8592ce30cdbb3dcd62b58eb800155e68bf8c6b8ae3744ec203165e0f5191b9a3
  • SSDEEP 3072:ePIN8FsDWVQ3qpE0ZeJsDWVQ3qpE0ZpDsRpKZQdsDWVQ3qpE0ZeLi9kPIsDWVQ3t:xaPAji3Yg7LucJBU4Bn6aw
  • TLSH
    T1A0C438A6C5B51ED600CD72B25AAA1243B13681834CAC3E80B74CCF8C5F9DC9FA5765DE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4
• • Target
    mert219 hiyaki kaydeş priv pack/assets/minecraft/sounds/item/totem/use_totem.ogg
  • Size 19KB
  • SHA256 229ddfa10b80946b443cb944fc7886df6d04ab1ae42cdf7b4a81a153445609b5
  • MD5 5a3745797fbb0d1f2db5805d8ba9978d
  • SHA1 361b59c632a1eb87bf38116d600fcae5f2b51df8
  • SHA512 e5e6aaaa7394c130ee613283858cb20136b765f5c044ebafd07f22c23a8456e35be108d7089c7e59b6e468df50279a074947a4d16481b322858139a71bc7c310
  • SSDEEP 384:pVi+OoNdgT5nYy66f1Y5Phbuxsu8x4Oa9/8lo:dZ8n4Sabpu8x4O1o
  • TLSH
    T13992D0D08BB8902AC63253FD60A2856E63E5752D065C775CFC6AAD8E06A5CC4BE234CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    mert219 hiyaki kaydeş priv pack/assets/minecraft/textures/item/totem_of_undying.png
  • Size 352B
  • SHA256 caeff8c3e05b3fa9d82c667a36ace3e74d40aafedbb5c3b6779478492b7a231c
  • MD5 86d771c9daa64fa6e81ec783237b4cba
  • SHA1 10be78c8976a657a44a2c5751556253cbf913c1d
  • SHA512 e0d3a756224ef31532d3fd6818744618bb3ea39a72754a79be02a1e3f48baa37c1d23d0e5386684de1c838ab9c8956fa884f72159990cf05c2847c75cb2d9b65
  • TLSH
    T1C2E0C0E2E6BC0E78DE4B88672029901224A217DF9CC2B35973F6D10A860958455A8307
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral7behavioral8
• • Target
    mert219 hiyaki kaydeş priv pack/pack.mcmeta
  • Size 98B
  • SHA256 f26d5d2e505e0d1b2ecf92548b3d9c2d11a2e254c41dcbba0d5934bab10ca266
  • MD5 694a5a81dcc0810164e2018781a47c31
  • SHA1 6e538c94d635ec673f91ceb5d2394c361cb85330
  • SHA512 2834eb32ddbdd8d29d16753a50de1d3ffd50b1240c65393387b130efff6c1c860eda2a66b10dbd0dfc3008b92fb06a2d7eb72ba24a323dc2c892b53b95988cea
  • TLSH
    T1CAB0127AC4200C26006682240C3D411A392D925721C0C8E5BC4C058C0F240B5C426700
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    mert219 hiyaki kaydeş priv pack/pack.png
  • Size 11KB
  • SHA256 2644348421feea4163d140374c7ed809fa54face1789e27a1601f25aafc23ddc
  • MD5 4f8a308575e9fb72bf1929386704dac9
  • SHA1 b4da062f6267f22e88eb197c42394670f8387815
  • SHA512 816fd8fba72a3e07b7ea9fdfa3ba1f5f0e99a1a1584e8f3e44cf7c9b377cadbcba0e3ac99c426afe5b4da5fbf2b4a281b7923d11df142a861a4d6de985dcf4e6
  • SSDEEP 192:cLVISI17ANMsiIHOKFHsFtxvN7SGYtAguth51oNZP7iEFsNtXveum0hEzesYrsb+:cLVc1U7iIHOKFH+D7SdtAt2NZPGzvwzg
  • TLSH
    T19E42A059F81102879A5E74623CD92ED040A30E5AECE2DA06F3D2A9DF4F325D4B916D73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12