dc84fe2220d02403410162c643438c2836121c99729b00147d1c1c72aa1481dd

Sharing

Copy URL Twitter E-mail

General

Target
1785801225_brserverfrptool1.0-windows.zip
Size 11.6MB
Sample260804-m7jlfaycna
SHA256 dc84fe2220d02403410162c643438c2836121c99729b00147d1c1c72aa1481dd
MD5 b4f5f80946f142fa44110c640abc1a50
SHA1 8c7e2527ae17918d82cd699e7e9d4d553b0ab949
SHA512 714f09bd932974660ae3b54da65e7d9d3dae044c4c3aef2a03269e6c7d748d34be3b23b8b97d77c8a020e8fd32a15d935327161af77280fd3e8d0bcf26a4a626
SSDEEP 196608:QZrrIRMTgyaz6kRUL48XGCajOozRRN9IQJtqmdoVOT9XILlYDS7kjwIg0sOyF0q5:crUMgyUclGCq3TwqPT9XelH7kMIDM0q5
TLSH
T161C633086CA5A8F5FC497DB5E468FBD179AC728DC0C06E6347357AE6083C2F5B414CAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  AdbDotNet.dll
- Size 19KB
- SHA256 646f35f2fada20ac9c9d380950d80cbce122367baf7e415818eb1836ac34547d
- MD5 e1e8685c6ae7b57cd1b8c735685d74a0
- SHA1 d2b3eb92a98b861429b2686abbe804ac4b55b2fe
- SHA512 3e0163cd5c2a318a4f8382a434d3a756ff065d6893c776371ab5ea481357100a104c5fb5ebe28ef2e613107d7fbe2f84172ffec9bbd1d8beb5b0954ca811d312
- SSDEEP 384:d8oUc1pYo29+6pbsi3f4cPIAGxekKhrT9VJrh:qOwdqi3WAGxekKN
- TLSH
  T1CE92E81C67F9C225DA7D4B3DE835022502BAF61AA562D70C8F91A0F93D73BC49102E7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Newtonsoft.Json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH
  T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Tools/adb/AdbWinApi.dll
- Size 105KB
- SHA256 fd96c88a315ba271018c0b54e7d696aba16d6bac132d9afc49b60cb14e4a822c
- MD5 819e3e651ac7f490eb1500e0df246c3e
- SHA1 e4948268e2b3974d1728fe474195df011c380f45
- SHA512 912da4212dc22adcb878c8b34ab7970a15878d7398643e8bbd3f6682d85fa5364f52a0e471d0c3299ad30fece47fba29a75ed5c83529fec3931343e34eba7fd0
- SSDEEP 1536:Dwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPN7jBx:DwqD3L8Tezq0et+ui1yE
- TLSH
  T159B36B327891C072C8D761B919ECF76593BEF5A10B6489C3339803DACE653C26B7529B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Tools/adb/AdbWinApi.dll.dat
- Size 105KB
- SHA256 fd96c88a315ba271018c0b54e7d696aba16d6bac132d9afc49b60cb14e4a822c
- MD5 819e3e651ac7f490eb1500e0df246c3e
- SHA1 e4948268e2b3974d1728fe474195df011c380f45
- SHA512 912da4212dc22adcb878c8b34ab7970a15878d7398643e8bbd3f6682d85fa5364f52a0e471d0c3299ad30fece47fba29a75ed5c83529fec3931343e34eba7fd0
- SSDEEP 1536:Dwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPN7jBx:DwqD3L8Tezq0et+ui1yE
- TLSH
  T159B36B327891C072C8D761B919ECF76593BEF5A10B6489C3339803DACE653C26B7529B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Tools/adb/AdbWinUsbApi.dll
- Size 71KB
- SHA256 25bb8b33eeb702b340defcf078eb249420c885b8f4fedfc3fc56ada66bcdbc14
- MD5 414d7ff85d3707752cb5df159e81273b
- SHA1 5c944ccae169d2b52d5442d0169fe6f2be7611a1
- SHA512 af2039ec528597adccf1268185d5e1686d2a276102197c3d028abf9167bc10d1d1b22b862f93bd880cf75ae2c2f6c5d0c862384f8be74008d468e69e21a019fb
- SSDEEP 1536:572doFmOiHizFbPlspcsbj5ZsP+YeTs1pc75ZxQ:5SSfN9+YeTs1pcFI
- TLSH
  T110736C227990C472CC9651B818ECE621A57FBA511BB0C4C7779D03EB9E203C1BBB9397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Tools/adb/adb.exe
- Size 6.1MB
- SHA256 c1cd7a9dad57ead9df7c84133cd9173cb232e5c78de84616302de3dacda0e0b7
- MD5 92ee5d21157fc32d7fea2156128ea688
- SHA1 fa9fa372a413cd0e68c92743dcb286813e80d4b6
- SHA512 aedb5fb9a88de09d9c6aab5b8a4a009b6693836cfd3bd9a652071cc1535269001e3957a380746078c6c75dab5af8464e330c880c8754efc1d14e2687e0bc7b27
- SSDEEP 98304:Knn2+Bcp7uWhYHI0FGGVwtCdW22ix8EVy:2bMl0FGbtSW2j
- TLSH
  T10B569D85F693A1B8DE4700B0116FB23FAF344704C724CEF7C6E4DE757862992293A669
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  Tools/adb/fastboot.exe
- Size 2.3MB
- SHA256 c37bd6a598a157f0fb808f06c836cff9f81cb9cf8f46f176b927d8ffa753676c
- MD5 b076800d74016b1f77bf6b8e3230a020
- SHA1 7967259c9a15954b7a915c7048abedbafd969fb1
- SHA512 bead90f524a27800231020b3fdd0dbd0d32fe13452dae45078cd517f1d70fb9fb0b3aa5b4bf6a347e0ab28edb9b9e59c2c3cada36d78804176eadaf5c77d7c9e
- SSDEEP 49152:GGOV46XLb9A4QLwNX+qCcfhuaGgSiRHfgFhUZqYx4x8EVep:GpA4QLwNXdhIQHrLix8EVy
- TLSH
  T1C1B5AD45F693A1B8DA4310B4611EB33FAE340B008725CDF7DBE0DE746A629D2253BA5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  Tools/adb/fastboot2.exe
- Size 1.4MB
- SHA256 da590fcb1d40bdf02cb3158aed8423cd94af4b15e57ce395bbfab9dfd2add308
- MD5 dfe453b8407a72a7f3b27ecce28365d7
- SHA1 4fb94bf093d1fbbf6464d4276a33fbc57ed21fdd
- SHA512 cbd697d1f5dabd1cd51d1333d676e8f927d9f383806656e6b24c511be561789da6601cb3cf3b8d5c32a34aa14399216139716a246d120f29d6f11ec4c6a88571
- SSDEEP 24576:x+oaWQe5SvYC25H2wrDB8sxUaLDi6SUasTjffpGyxknw4FYnshx8OfVe247:xJHh3B8sxU2isTLPx4x8EVep
- TLSH
  T1C465AE65E70795F1DC1306F1094BFBBFA6309A0A84308D1EF68CDE98FBB2C61546D266
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  Tools/adb/recovery.exe
- Size 1.7MB
- SHA256 d136829eb33816061ed0878e7902a90d9bd0f2e4917eb13e08ebbf2e10a948a7
- MD5 57b0fc8ab3bbe322dc8269bd48d26abc
- SHA1 8fd287412206527174ff45d03d5285e5b1555d36
- SHA512 bac5c2b122580dc9311d2b3fea69a390f058227d0ac4e02a73322825a763142547321aec8c3e160e64830c7f579d5576334919770c904e920ec43bcb5326eb40
- SSDEEP 24576:tRSpQIq+C9Fv+Lyxknw4FYnshx8OfVe247:Yq+4v+ux4x8EVep
- TLSH
  T1FF85E0207A86C030E5A202B26E7DDB27243EB9701B7555CBF7D84F5E5A708D16B36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  brserverfrptool.dll
- Size 157KB
- SHA256 126b6452acd24e32fd12422e5159fe0baf6bc49c010b10ae324ba4b6855b4229
- MD5 d1924ee3db613e218d041707068f4512
- SHA1 31f16e646199b9913a1e5345e8537077b1e6e6fb
- SHA512 a6e023ce3e0e38a889a2f02330bfd2addd1dde1e1e1b001759c401ab56a67b7b94b41402eacba9624d419127053bacf5093ab4cb78d1496b6caca37bc2574d2a
- SSDEEP 3072:orbBX2YkHwF01WKXwMUEGk8ZeY21pwYS9wbD+1fu1Wuvppkclx3Ic4sA+BThDk6m:o3NkFfa9wbS1fu1Wuvx3LA2TlBOD03V9
- TLSH
  T13EF3274033F88F56F17F8BF989368051C3B9753B692EE74C5E98A4CE18A0BE18541B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  brserverfrptool.exe
- Size 163KB
- SHA256 26a926906334405ce92cc916e5a2265d721bc9f05f0761a2c1a905202276b8c0
- MD5 45f4a69adb12a9150c70f3c49cb84044
- SHA1 a1009cc6079f5c3aa75b4fd2701ab910bebd8d56
- SHA512 0ee60c9d662a08b77d1ed41cede9de6371542f56c592692f34714109726316d3ab5c2b0c67cac14fe9d8ac643ff075f766317015030481ff308d2ad41ff5e00c
- SSDEEP 3072:8qeXA/4yIbHkNPN+6H6xCYOigUE2659JtU3iL:8vdHkNFdaxmMEdJtU
- TLSH
  T190F34B07A2A851BEE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  fb/AdbWinApi.dll
- Size 94KB
- SHA256 caf90dd8e1e6def816925d5740a56156463bde12b4611dcc4427b786a05666d3
- MD5 c6c9cb0663996c070f905cf2dceb698d
- SHA1 8baa8c4085c4ae01c6db851733519437866943aa
- SHA512 c96b5af1a4fe9ac30bd6f7f3e95e610f86f25d5053850dfae8ece47494c43d306dd025f7c7d35bf54498391ebc1a167c327463ca02ffd8832ab3081c40bb6342
- SSDEEP 1536:BpCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt:Bpo0k6ZWVTaif6sCG
- TLSH
  T139935A313891C072D8D272B949ECF765A27EE4A00B659AD3379803DEDD643D26E3538B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  fb/AdbWinUsbApi.dll
- Size 59KB
- SHA256 88ca9628ab3326d265c2568aced59353af5b9011a3248c4895d912b5f834f975
- MD5 9806cdf97bf783630a75ed72cc1ba5ca
- SHA1 3c4d69241df65ba0b6590a49b2f4c39edc84b753
- SHA512 1a75f9fd6c07e6ec33e39daf997df91fc19f790ad3ce1c71c0f5e4c3d643b82d4f598ecc0d17e4347f6379220116232db73ec14177c05e8a287645db1b7a7103
- SSDEEP 768:zLNk0yiFYWkgALpW+QvSugX0wUepQNXTQXdF+Q+An70edrqqOkIW:yyY8wugEwOVEXdz70e4gI
- TLSH
  T1C5535B2279D4C073C89251F909ADF762626FF6914B6084C3779813EE9E243D1AF3938B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  fb/adb.exe
- Size 1.5MB
- SHA256 19d50d3676bae6a0e30454d6e4c2020cf620073507329a636a86f8a575662233
- MD5 073b831e08aaea9ebcae0a8fb38fdf44
- SHA1 b453c5c7926944cbefe2b81a8b282cb17e16d5ed
- SHA512 74b3486bba450052dba940ed47a8d9127334ebc9f5cd2dc6ea7f4828698e4bf663477a50ecef400a6a6a4e73b0770caf30691e5aafc0e4ae06ba09cba13404f3
- SSDEEP 49152:HnBLLPqsP3ibg9TPfjBXz0EQqyDvfax4x8EVep:hLrDP3qEBX47r6ix8EVy
- TLSH
  T1C3758D98FD8755F9FE6B1D708193F73F0B214A01C431CDE9E6A8BD85EA33991111A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  fb/fastboot.exe
- Size 1.4MB
- SHA256 a04558104415a105c5023109d3052124472d40d3a3e1124810173b787f44c339
- MD5 9ad27230a40d1b9471854b5475d7fcb1
- SHA1 7808558a955a14baa4387bc25ff02ddfc4a10e56
- SHA512 2db49e7918c565aff4aaa50ccb1e376d28fc37f532a7eaca6b1e8500486693b3dc535562de779415263b7ccdbb0a3643a07504c245dc441df136506148c2b0d3
- SSDEEP 24576:L+oaWQe5SvYC25H2wrDB8sxUaLDi6SUasTjffpGyxknw4FYnshx8OfVe247:LJHh3B8sxU2isTLPx4x8EVep
- TLSH
  T1C565AE65E70795F1DC1306F1094BFBBFA6309A0A84308D1EF68CDE98FBB2C61546D266
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral29 behavioral30
- Target
  fb/fastbooth.exe
- Size 6.9MB
- SHA256 77a2595ead48d71f498f31f064d5c688cf71420ac063779bbb8a9b46a2fa17c5
- MD5 4a61d901c8dd637c924132ff20346fab
- SHA1 d32c29930ccfae73f4c10e9a2f506df52bc7d975
- SHA512 b6e7f142fa792f68831a5640325752c7e215556b7e67fda9d16c87987d3a097896d642180c94846020dcf64f8a0ba2b832142033f13ebc9339714a3253a54fcf
- SSDEEP 49152:/lipMZE8Q+fzT/QwadfqUAnggWrh3Co6BjkpqpkmyUD7LNq0I698hczq4wvILkfi:9ipMZE8Q+f44fpOkfylw9LJ9sY3L
- TLSH
  T10F769D6773E74DA2C5E367759EFB53380331BC108A5A4F9FA64C86385A43284BD27B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in System32 directory

Executes dropped EXE

Drops file in System32 directory

Executes dropped EXE

Drops file in System32 directory

Drops file in System32 directory

Executes dropped EXE

Reads user/profile data of web browsers

Enumerates connected drives

Drops file in System32 directory

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32