fb50cc4ce811041c5dd3ee722e65277c0f572d693bbe8050ead3da701938309f

Sharing

Copy URL Twitter E-mail

General

Target
itarmykit-win-x64.exe
Size 121.7MB
Sample260804-jjcansal3s
SHA256 fb50cc4ce811041c5dd3ee722e65277c0f572d693bbe8050ead3da701938309f
MD5 3f89a2d4d61bad05986ddd147c011d5a
SHA1 623ead2404ceb515959dcdc034f1649b600ed466
SHA512 480beb36430a392906fd7bc9dbda2bdaeabc162cd8070ed923d7822800202809b4ea58154896cc4fab3354c513feac3ccfcb8f7f52c59408c49280e30e2c8397
SSDEEP 3145728:kJ0SrxKEHzYC8yqly+tUWvUSJSZnwL/cjvb29mFpLiC:tTAsxy6y+O43g5wL/c
TLSH
T15458332E0F0198FEDE1ACAF3D842132292BA5F455998720765F33B3CA979D0CD116D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  itarmykit-win-x64.exe
- Size 121.7MB
- SHA256 fb50cc4ce811041c5dd3ee722e65277c0f572d693bbe8050ead3da701938309f
- MD5 3f89a2d4d61bad05986ddd147c011d5a
- SHA1 623ead2404ceb515959dcdc034f1649b600ed466
- SHA512 480beb36430a392906fd7bc9dbda2bdaeabc162cd8070ed923d7822800202809b4ea58154896cc4fab3354c513feac3ccfcb8f7f52c59408c49280e30e2c8397
- SSDEEP 3145728:kJ0SrxKEHzYC8yqly+tUWvUSJSZnwL/cjvb29mFpLiC:tTAsxy6y+O43g5wL/c
- TLSH
  T15458332E0F0198FEDE1ACAF3D842132292BA5F455998720765F33B3CA979D0CD116D9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution pyarmor pyinstaller
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  ITArmyKit.exe
- Size 203.9MB
- SHA256 271698d484d248bcf6267e41c9f2faeea3efe0c89ebc75fe0b96619810648d9a
- MD5 140806da2ffc9a0fac3293470e0cbebe
- SHA1 1a911db12140e7a768ad87eb17293c0e73b831cf
- SHA512 b4fe21f5756342c3b2eaa57da1ee647c018e85465ae56fcb5e3389eeaf2d4610b2bf5259faf2ba559219f73e8545db2219acc29953cad5046482b9e26bcf6a66
- SSDEEP 1572864:k60qxRDwoahjKJQvVQd00L0UQpLdPxNIyb4BpxxpKf+mPm6Xrj+2stwoZwcH+hlz:+PBJTFtJ
- TLSH
  T135A88C03E29A41D9C01DD175975A9633FEB1B8054B24B3DF2BA447522F66EF82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

command_and_control defense_evasion discovery execution pyarmor pyinstaller ransomware spyware stealer
- Contacts a large (1051) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral11
- Target
  LICENSES.chromium.html
- Size 15.2MB
- SHA256 7700bce2a052ebb6057f5df06f605e01e9b6677ab5d53ad4437b79d22185e4f1
- MD5 4ed0035d5ff6bc2b031cbe525aad27f7
- SHA1 488c3fab5701ce0a6ff8f167fe9952e318aac857
- SHA512 701347dbf819546e8f2267f11f5e9348183b24e45879edd43bf1df6fac3be02a5b7aab86523f0ffdc07840457e47c62e475b49af5c31f11a60c8315b0ab0d8ee
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+U3r8xd2zJQf8xF6DNgQdGxw:C
- TLSH
  T127F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 f53888a97d49996d240d590dd6941888adbc662bd0159d09fa9ff3713593908d
- MD5 133ae9003697487bf73eaae64a5c9ce8
- SHA1 955c485435662a13b7f2a565ea09e052dc85990e
- SHA512 b763a1531082c28a7afe85c02239accbc55d59cca41f7d74de1de6c4b9beaccd513c1696d3b28c621120289e3543fc7d9541c512e7fc0577ffb596a86abff023
- SSDEEP 393216:GT3fSaN1bEs30RdGvwMup31kzMCqfzC0:naPEJX6MJT
- TLSH
  T1CD473A122646D49CC059C879C7678B268A6C30E73FA7B8EFC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 d3f9c43208ea130c014b878e6b64e3ec995cafb19ae8451342d0b25d812e1f2f
- MD5 6065f8d4983cff088367a86cd9ceb658
- SHA1 bfc1df9a53740d50f1a2255fb0c3a3f4a90d6c8b
- SHA512 b148001cf28bd2412d0834ee8916edc8a216eef91f4c66aeb295e43b6ef65c57d548a935cb123a3520f6eb8432e8dfa04b14e391f6b23e4f9199d543a1577f89
- SSDEEP 49152:T+Ad41hEcdYfDaKzGeP8YXPQ6M5199a1LKIbU7k6L8Fzg5NoJ/ZgYbi/VTg:6AQFKaeEyPQlS2NoJL2
- TLSH
  T1F7E59D03F6D651EDD019C03497AB9313F631780A4F209AEB16905A223F67FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 503KB
- SHA256 29b418c8b7983bb153d946da4731e6945f78b1b42b0caa42b0a47b9f72f8722d
- MD5 ed0cd6a43158d779768d0e2af54db664
- SHA1 4a69f862ff46ca85f3b75e28d6d1f67019b833b5
- SHA512 6ddeb3871f3463136cf90fb130fa625189c74c1f05087b686d903a243cef334e5c073450084afe4eb7a70eb9ed72a9ec04a377f95bea22d4d8e7cc8f6ca91e04
- SSDEEP 6144:0YVaHcV+MLZbkH5jBIrWwRa+iDacuquKW5kiGnThLLcRFOm6PdTtaHV0:zzbc5jrxDFuKWEnThLLcRFOmKVtaq
- TLSH
  T111B48D15F3E94BA8D07AD0348A538A42DB7574960B75F9DF02E052393F3BBE45A3A324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 456823cf75a5645759f809806c2c65f85294ae05cef7aee7601963045b7ff043
- MD5 6e983ee780830d806d6e9ecf4de7d5f2
- SHA1 0b169a70405df058cea483024c223385ca517f2c
- SHA512 9fe11146eece2d79cbffddc0d7bb8c919c214417cd7456a22f7b8133442b9a2c2b6573f198a11e58960347ebc8cca1a74e2c73c243beb2710c75378f9706f181
- SSDEEP 98304:lx9hz11oOcnIJddob9vcBsGZrv60OXBUsus:r9hQOcnCBsGZPjs
- TLSH
  T160867B03FA9681D9C05DE274875BA623FA31B8450724B7CF2A9453162F66FE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  locales/ru.pak
- Size 1.1MB
- SHA256 2e4329b1a1e6619fe4191301e9515b746f7e133c6d2d8fe24a4a89bf4d1b07f5
- MD5 3db3d29bf5102037877362755a802c65
- SHA1 7c1d5dc928431ed41c575dff321a85a94434ac40
- SHA512 5afb2ce1e7472c1f6405fe981fca760653240bf6766ac5d60ebbe10315881791780879631d5eba1492495301a2720d65f0200cbed8462bc0498608616ba24391
- SSDEEP 12288:gOzKwrjovfQeRo4YwispFzJ9sF+oa+O1zXx6HzW/oqSvgs2ACWEN2igA8NiadQYM:gMrj6qvoSi
- TLSH
  T15C358860669E64EE1101F01BDD08BE0D3CEB45FE3FAAA35619642D7F34F2024C67E65A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources.pak
- Size 6.1MB
- SHA256 cbd52c444c17aa79d961f802fb7f94bd8d4fff6ac5c8126d738516a0edb688eb
- MD5 77435fb3691ee6016630d71248e00935
- SHA1 3eab64154a5a99858b3b03fa03a3cde999fcda02
- SHA512 65a31b640251bf4b51232f82258273fa9641031427ddd089871fa084b8d73227c7bcd3cc8ee40e597422b6e3c0f47521f700b73b018a6a465cc8d41162cf3307
- SSDEEP 98304:5Jj38HD9PJ13/RclWl/uJogybAHltND8rwri0J/xUaAUXLPC1GP4kFbG:vshBR2lddtND8kri0JlAYz4kFi
- TLSH
  T1F35633E2B7A06CBFC5485379D19542343A3ED91F25817396188CB33CED6991EEA4823F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app-update.yml
- Size 94B
- SHA256 7ecef811a55dc97e778e6d2904ccbfc3d38f71c1a4ebb1016063e8fcbba5d557
- MD5 72d7e86bdcf7004cae7e93edc75afbd3
- SHA1 5c935f969b4de15c89e72075fe6a2a175b093a15
- SHA512 a470a3113b08fce622bdd0139ae234fa1c52cdac1058c65bf5469c7fb4f3f74d56e1e1eaadeb7ff4515c68d8ea1f841a93fbe05712d56858b3bd306a16a3ba24
- TLSH
  T174B012238340C69387211CB07C471B31E3C521458C43C01DC6E7005CA313C0449170DF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar
- Size 47.2MB
- SHA256 13660621ba79a4eda3e4ef004f260d566824a71fe992a0881618e9574b95e93d
- MD5 e25343744b9a557ca6f40bacc009bedb
- SHA1 bea981959f64a93264883c05ce99e55511ea7ec7
- SHA512 80e870bd547aef43c18888dd66886530ab72f639550254b908dcbfa7b0ba81dcb163cb395d6088c91fc5752695f7df8432f86c5f1ff79225152b402c2ea0e4c3
- SSDEEP 393216:OLEenLQnlnhhzeqBIPbsXdT1Wd6qMd1PcE6:OLEKLQnlnhhzeqBvm1X
- TLSH
  T14AB75C4A76F61432D65361BA4EAF0002B63494076809DC54BD9D83A86F95F3CA2F7FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/basetool-dev/localhost-remote-config.json
- Size 299B
- SHA256 04afc1165458cac720ac91145e879a25fdbbbb30c40ccca19da9e9b5d8fd2d66
- MD5 46ac4b5cfde083c5fb4b37f05ee31bf9
- SHA1 5fc32d2b2c8987d132a101f545364577e3c4c6a0
- SHA512 d3545286c223af4a0e2464ef6ab7e492b6c18c4bbe848f5ce08d445410719237f58b67530d6d6d576e373cf3f0c013d60097a2cc4b183400fdb6e835910bc2f9
- TLSH
  T156E05E25CD794EBA06F97B78B1299703F5D18BB704950C177C7D200C0F379560445E5E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  resources/modules/basetool/runtime/RUNTIME.json
- Size 569B
- SHA256 dc9f46f3f9d2b7f8ca60d7c38586e0b11381a2b83bcb509345173bb425e7c7c5
- MD5 0427c6bf92bf273c0aff86ebac6936c5
- SHA1 e241b41fc3ff874a690c073a0e70c78ae297177b
- SHA512 a4f17a9e6c9d4fcb8d874d198de05db38fc1c802bdf41dbb38c88f23dab0cd337bbaff0ea7b13ae215377c84e42f8513085bd86e515380e7083f0c36f6520f8a
- TLSH
  T10DF084748139B05F72C0C300F98157E2A3E11E6B2682B8082B4352686B0F8B7B03A3DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Protocol Tunneling

T1572

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Discovers running processes

Contacts a large (1051) amount of remote hosts

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Outbound SSH connection to public host

Reads ssh keys stored on the system

Unexpected DNS network traffic destination

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32