General
- Target alpha xvideos by echo.zip
- Size 6.9MB
- Sample260804-tr34gade83
- SHA256 8707e81a1fedfaa2424df621cc188c5000838a1ceb369f427fbfff00ce45318d
Malware Config
Targets
-
- Target alpha xskidding/CrashHandler/CrashHandler.exe
- Size 14KB
- SHA256 3c9ff963c01cb1690021ce2e139119a5dfa750425583c1036077e7669e684e0a
Score3/10 -
- Target alpha xskidding/Dlls/AlphaX-Korone2020.dll
- Size 1.2MB
- SHA256 05201bb220426b58677187877b0c42ff0b67e206fe7f03f86fda6ea1c94a1d48
Score3/10 -
- Target alpha xskidding/Dlls/AlphaX-Korone2021.dll
- Size 3.1MB
- SHA256 1c044c83a163d4c4afcbaa383588acf72d7fd0c19ae40949adbf1c177be99439
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target alpha xskidding/Dlls/AlphaX.dll
- Size 1.1MB
- SHA256 45f4d037f99ff2deb4f97df40a0c013138ee939eea5981060ff1b6f940a893f4
Score3/10 -
- Target alpha xskidding/Monaco/index.html
- Size 246KB
- SHA256 1487de71b9b842a1760cda32d6f7e56d8cbb344c628c8c3a4cf790d936aa4ec5
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target alpha xskidding/Monaco/vs/base/worker/workerMain.js
- Size 133KB
- SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target alpha xskidding/Monaco/vs/basic-languages/lua/lua.js
- Size 4KB
- SHA256 ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
Score3/10 -
- Target alpha xskidding/Monaco/vs/editor/editor.main.js
- Size 2.1MB
- SHA256 9e2fb6171592f7a3c33d3b5baef58b516b36473ff7717bbd643574991923435e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.de.js
- Size 46KB
- SHA256 cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828
Score3/10 -
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.es.js
- Size 46KB
- SHA256 327437ee3793e9ae0686c78196b459592c282ed2e86f95ce28d32693b76d7654
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.fr.js
- Size 49KB
- SHA256 6ed837dc1905c06a20d102921ff06a0bda003c5368ed0576bf7e69494e889ae8
Score3/10 -
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.it.js
- Size 48KB
- SHA256 4fe2c4420294758883e134bdf7da9e6c2abf631d3a89c765f32f6c1d0f62653c
Score3/10 -
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.ja.js
- Size 52KB
- SHA256 1f3556ea7233843b9e08b3c97b6727c533d702563e195c2090a438070dc85f0f
Score3/10 -
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.js
- Size 38KB
- SHA256 5ff0084e6a7eee82a735616239aaf2190ea9d90e89e19340831f3d590828016a
Score3/10 -
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.ko.js
- Size 46KB
- SHA256 98e649fa40d8e2ccfdc212341feb8165a7d7bbec31e8a77d9819ad9474e4b8ba
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target alpha xskidding/Monaco/vs/editor/editor.main.nls.ru.js
- Size 75KB
- SHA256 1bb069d95a395bf258d1f262814591aa762c4b30529adde32ccbcaa7c7ca508d
Score3/10