d32c0fbb8181b4c9667658d1a26fe26ce2b57788a34a3b0c74a0c375cdb9ca80

Sharing

Copy URL Twitter E-mail

General

Target
vello.cc spoofer Cracked(1) (1).rar
Size 74.1MB
Sample260803-ldnsmafp7v
SHA256 d32c0fbb8181b4c9667658d1a26fe26ce2b57788a34a3b0c74a0c375cdb9ca80
MD5 23791afa0d5720e26aaf5f4907086b6e
SHA1 7955afaf5b846b1e66c8be56cbf8c4be25d9a222
SHA512 2049136db55d148e6474fc75bf93fa82decb05a3f2f8542ac8ce4bd97a4a2a1391f1679c01bd4a636e11db962f7c233f741bec3d13178ea311e0fc9f6df25fcd
SSDEEP 1572864:r2TKPvTzC42LXJiVzrVmG5rzdO8OhRkwuQYGOj:r9/2U1cGzdO8OhRL2
TLSH
T1590833D663C99233BE0AA0E087354D640B6762A625430AFE9EBD6DCE1C7744D03DE78D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  DebugMenu_Press7To_UnSpoof/Debug.exe
- Size 3.5MB
- SHA256 4fc1932b7bf2f365683614e1ca961ff553eab2085e2f532bf0eb20d25c52a670
- MD5 4bd3354b1a0fce08b158791d792e7a4d
- SHA1 c77ee7bd3144ea93644a0743d5632254be21e19f
- SHA512 9099158e2d4daa339f6b8ca4336f8bdd062c8a152a1fe03421fa5f288567b1f6ea6bf7e35e313393d57c85672378ca5cb1037e7ef987f26aba4cc57e77aee2cc
- SSDEEP 98304:Zw1icAWpinQLTviuOh86GnjNUqvA8WU1gdGx+UmZC:SibWAn8Lhn2yvU
- TLSH
  T1B3F523B437D268B0C09FCFB0C65B71BE352EBB42AA618D1637AD26015F23215FA35365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  HP.der
- Size 978B
- SHA256 d9a1f0c4d832259148fbad92776d71858d4d305aa0aed842351c66f212542f18
- MD5 9258127fff317e82043b8335f86e1501
- SHA1 e3e093998796fcbb0a790ab04789d16f71e93461
- SHA512 2a09fd678a6ee01cdd367a3979366506f4c75d00f950432dbda5af44b3792f73acd4982c9aa7ac4c6b4a5fa804c3428f181065eb11893ce1f006e0024dc409e6
- TLSH
  T14511C8A0BA981DB057421B13A0ED8DE21F76EFD31E5020A1F3479C7461C7FA1490402E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral2
- Target
  MPM.efi
- Size 44KB
- SHA256 dd88f19ba5633d22b63911ad5c9f9a4911eec39b42eb6f073d67f9fc3783c419
- MD5 118f9abe0952f5ac755df281aaf24391
- SHA1 7929c06a605157c82e670ad124f0517917190b56
- SHA512 3740b91d513dbcad1f4994d6116ac2ff6b39a530ce0e454ed57355cbcec43765fadb46e0af10b9d53ef95fdb905711051ae3964f8e4cce5888041496351b4e0d
- SSDEEP 768:mVstWBjDW5HmZmZqRxlCSZBh3ORSxQVXEy:qsM520YCzCSTQV3
- TLSH
  T1D523E609DFEA8169E077C9708EF245ABEAB23105A634C20E43D1C6967F53761BD28F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  bootx64.efi
- Size 917KB
- SHA256 24dcc034bf6a5158f43b23b71a16acbfdcf1597de55aa309f7f6ac5af90666e6
- MD5 b1f99a44c80e0593ea009e5c5b4948f4
- SHA1 8efa245d6c8d3888f1b9289d6f6f7582f9bf3261
- SHA512 c010b61f866da1e97510cbadc9cd16b9ea28cef936647f6726e21655a0d3b8667ed5e5dd8b56510d2c7a41ab69ceda45c469b3cdcf0e3cc0bde87f47ca0b2221
- SSDEEP 12288:PDN7U1fqcpUkOi28O6ppzC69jAXYuDlkV0w0H/7:PVUtDOi28O67zCqUIuaVO/7
- TLSH
  T110151B1123FE4248F0F37A355DB641269BB7BC99A938C60D029CA15E2FE3E109D64B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  startup.nsh
- Size 25B
- SHA256 616029e0b4c18027d6bcc6b30c55aec38bd365576d16be5b33c575ed6ffa2fc9
- MD5 533092ecff61fb8ca7fb8683291c7e59
- SHA1 f3379bfcbdccdbfdecf04ae398b29a42cd2ca595
- SHA512 c91997cc39fdcf816dd1b23d90241642d0bfac3b7950e4eb90ca22b106f5ac2fb06f930eb46f9cd9f4c8c10be2500ff8a9dacd7eea3e7d57b638e65745b134b8
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5
- Target
  step 1/Data12.png
- Size 377KB
- SHA256 5e66ba6e5dc98c65fb5d6a0c4bef4a090aad01386ef44643c416b613bdb70a38
- MD5 7ecdca11caff02f9c463bed663740788
- SHA1 def46a8b7f168bdb0ca8e25dd8d02cf3f77b226e
- SHA512 4d97b57a99a80617e829994a756fac4e14ee7b9f205d1cd25dfe0268255417f673f9887e862f75425a5b5c0cd2529c3c79391938f9c6fe5c2251529397660d62
- SSDEEP 6144:8YF3mEzg2Dm/BPZw5/C3PCrhbb2kfsGPJ0NAOOAsVLBfnsWr94ZRecY:P1gom/Bxw5/C3PCrhbb2kfsGPJ0y5Bfu
- TLSH
  T1E084F62AEB9620F4EC7791BC84922306FBE075684731D7D777AD460A1F33AE4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  step 1/Data28.png
- Size 3.7MB
- SHA256 7c6057273903aa7e9b998a36d14cf9a15be175dd0863a3509cf87dafbc4c876b
- MD5 14e50882b56cf18565db83ddb0f88ed0
- SHA1 ff30f305ac85b6518fb962c569e72cb10c483101
- SHA512 17019421a09b96b8ed2e5b79340a689eefe9ba5f727094b070541f3e3ef5dcc4c89b0664c3f597b2b3d337e18d9ade731a66ff0825ee1d2c46c07acc402f0f74
- SSDEEP 49152:RnutQ3bGqBQlkvF3KDkR5mR4z5p1/8nEEuu2QWyJLFI5FWUlPrnwlq+iJP6ZbGI:Rr2a3KDkR5BInLn2IzI3d9+iqbGI
- TLSH
  T16E06331BA42AFD40D4EEEA319A31FD12F5C2FEC54BA187EB444FD82864A3317A95071C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  step 1/Data29.png
- Size 365KB
- SHA256 715eb7d445114e944ec249f98ae4c1d7e324e59fc1f06fb1105206b7cbf4eee8
- MD5 2572e90286b5bce7673fa8aa8bbba8c5
- SHA1 89649f27d5d9fdb77fa5bab2b3d90fa298d388aa
- SHA512 9a2016b0146ff8d380bd56a631a1d6ea91e6109d7d3af61bbf259a1aa7b6ecc25ef61d9903976fc34378bddfd33279c40ebd3801724756e93f6795d75398583d
- SSDEEP 6144:b/GYAqo8g19xZwO+y57PLquh7eSO2bK5Pqs91ZW+EFrLQYe:6Y71ax+y57jquVKEK5P/Wc/
- TLSH
  T13984F946EFA270FAD8B6D03C91921226F4B038A443259BD3B25D592A4F23BF5ED3D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  step 1/Data31.png
- Size 144KB
- SHA256 1efe8000403087761944b4ec2eadd19e3ca3cfcec71106038c9110dfddf4d589
- MD5 7986e653dfea1eefd5e567c3e0e505df
- SHA1 a326377e0b043e27d905a8df7f669099fdf33ccd
- SHA512 c3efdba80faeef6f965f1ede50d4a5023681a4c6fb5c8dda1d656d9c9a3485dfdbae919ce99f95050d9fba93a8d3be8abbd7cc2168f70e35225861293ab1d97f
- SSDEEP 3072:SMmIcRC1BP5gn6ENjoJszSKxmLdWTZILJMu99:hURC1yvm2fAdWYM
- TLSH
  T103E32A91719200F4C6FA953889E64A16F3E178244316A7CF267086270F33BE9FE7E795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  step 1/Data33.png
- Size 5.2MB
- SHA256 2bbd482267c97d49be95314057b56415d784d69aedcd9947b0124fb1f81baf93
- MD5 ea00cc3145f5ce2810ed9c5dffe93f47
- SHA1 9a9184b3921b4e6b3e95d2c3be83e256d4667ad0
- SHA512 3d469e0b35472c6911e5c340b57ca551958c4819cfd5180302781991e2461152af83d2cbdd33182153d3a87c4cf1b004964643a63cb4cc5d7f2fde3b15313bd0
- SSDEEP 98304:arO3bsxE3YaMGYUWdsDmLG6RPRSpT97Qwm5rPxff4soOpNLBx7JBBY0p:rIaTYUosmauSF97Hm5rtf4soQrJBm6
- TLSH
  T10B4633AA6BF02CDBCD365BF23F8945C55CB354728D40D7646B2B006A1598BCEE7B6380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10
- Target
  step 1/Data6.png
- Size 476KB
- SHA256 03b998810b4ad9796c1b85d91c4794bc150ae3d9d3e7284dc9477536edce8a90
- MD5 39fcb928225762b02379290cd1a0ffee
- SHA1 34a52fd1c655b6477930812a77f9e969ed455441
- SHA512 a222bad7bc654e2bddcf9497c795bf6e6c0d1cdf7ae8711c9e5adf38d947fd7a3599e307d2ab8dfe8604fb19fd557ad3065e626a9212733cac3c0b12788fa65e
- SSDEEP 6144:Y/GYAqo8g19xZwO+y57PLquh7eSO2bK5Pqs91Z/+XFrLQYe6rJkzbpm:pY71ax+y57jquVKEK5P//h/6t69m
- TLSH
  T182A4F846EFA270FAD8B6D03C91531226B4B03CA443259BD3B24D692A4F33BF5A93D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  step 1/key.py
- Size 6KB
- SHA256 99511cf05a1953526f463a3fbc8998c56f910938087a7cbde047cf8621665a06
- MD5 3a91784859f02acf50b87a3e53c201be
- SHA1 3f95978f11230916e67702fdc020390ccb7df68e
- SHA512 ac92eb32983bb8b9025024a5761fe2d39d8009defc15baae9e9a2b895102773696edbcd45aad801cf3c71bb12761f88f29bbdff2646e40260de72f41d535fdb2
- SSDEEP 192:Jh4vi8lPXhyZJ8rCuGn3FifFfUUX2hfYXB8pxe+opQH9:JSe9
- TLSH
  T140D18466F8525C138383C826E956EDDA631E6013AA08311933EC519CAFAC43ED4FBDDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  step 1/localhost.crt
- Size 1KB
- SHA256 bcf47313122d6d583dac1d59957408a1423014c112f98be7b65c1ac341f65f40
- MD5 6de9e0cb0e5b409020931d5d257f5a8a
- SHA1 c6939891da7e95fa5d1283dee5367629b92fb20d
- SHA512 f6ae04253eff344fe0eec0543d607c2442a677be75ad2fef4316d70e175d70b652ec1409db60b0649bfe90ffba767d013c8c881faedb822ee800bd1186f2d782
- TLSH
  T15F11E9183FE799942043D8DBB0BD59D9575203B1C07DE0331A1FDE507BA2137B06C842
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  step 1/localhost.key
- Size 1KB
- SHA256 b58852db3e9f3da863ed82412598a31640ebea24bf8794764d054781663bc610
- MD5 01e31a93be391d9e26051e8385b5475f
- SHA1 d761122904c1b06ce93330b7ad72f6af63ccafeb
- SHA512 a7181288439a95e9bbd63a88c7e8d8f952d06412e9ec34ea5d5ef5c978ed2be5166d538e4975952abb15536afed557795b7b705aafae1018bb52234e02ca813d
- TLSH
  T11331F80B5A81AEF590A25134B9A7B62A0EE1D03817EE74DCBD7403895C10EB0803F209
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  step 1/python-3.14.3-amd64.exe
- Size 28.8MB
- SHA256 b68ad91421afbbd1a628105199c8c5f6179b21ba799067a8d8c0bbac3b7defb0
- MD5 897f5296196cddf98ea8c0409c299753
- SHA1 06a2d048c4bdcaba0c924265c37dd0c5eb373821
- SHA512 d282f9435418b633e014d2e6fec3601076f2b6be0bbf4eaa7ce83bfec9bf9e3a24f344d4857d4ce474db5d9e69500c937a9ba68ee82050e79836b95fbfc22196
- SSDEEP 786432:PGFrc6zKPjH84GQLYeE4vxezYjGnRpZupft2:uW6Kr8FuYeE4v4z6opZAk
- TLSH
  T1FC67333264E54133E3E00272B724AB70AE2DEE306741CA59D6C8FD943D766D227B7786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15
- Target
  step2/ADD18CE95C8.exe
- Size 23.6MB
- SHA256 237926a7b95ad4765bfcf3881f3aea72eb9b09cbbade427366bab7c1f921192f
- MD5 7c79a8f240839f3ac3481bbe7719d63c
- SHA1 b0b224278a50a7fb97dac6f5e6799835268694df
- SHA512 f89940cd6af91fd41fb1b769bc925ad9bd389ced20b59a949dfcfa7cc6c998f69b3b938543886f5816718bfc46e02212e9ff68317cd202302bf9fb9a30404f02
- SSDEEP 393216:eslFd5K1qQo2iuhrjxh+sBBaUBId6BiXJ65hOK6CEEiwSMCt8:Dwzo2fXtqUU6BiXOp6ht8
- TLSH
  T1B0473372B8C67EE0C1DFEBB6D2C16CAD7067F76782EB8C21765974220C96618773A041
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  step2/vcruntime140_1.dll
- Size 10.0MB
- SHA256 271ac4b8e251ccfa6af2f65826ddbb9f7ef449451296bfac9d2cd17335ce506f
- MD5 b0c2a3938e1f55b6c034a3db1eee9bfe
- SHA1 983df00b0850717316be1310e7c6aac672d9c875
- SHA512 f819ea4eaf8e8bd7d82f576bff7f075e6c5a6d1c3aa17bd277c10c6497cb104e77089d5fb32a6bf394562325f2f92d26d715bac8e4281cfb390493651a4d7a11
- SSDEEP 196608:p4YQ/AW8Y6n3G7Ir/xCnfQOZVL+/e4SmywJbcJj7MmnVo:KPAWw1onfQOZVLGyG0HLo
- TLSH
  T106B623D814F042BCC4528030D28E07FAF5C6395E4EFD491BBFDA59212A34C69ED969FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Badlisted process makes network request

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17