darkcomet | fe5d035653074b65b98991d1288f3f9042769ed73d3d5685ef0e779e49622a6f

Sharing

Copy URL Twitter E-mail

General

Target
Rf menu installer.zip
Size 194.8MB
Sample260806-kw74js11ht
SHA256 fe5d035653074b65b98991d1288f3f9042769ed73d3d5685ef0e779e49622a6f
MD5 93213eed760cbf256aece619260a0b93
SHA1 1aa5c86a131f3f026065dfefd203ada098215a93
SHA512 b81af89db8ec25ae20f1824a75e8e8dad815c5cecdb4c77253ccb8d43b19a08735cff62474137f6532cfd575d27ce76cb8d6754f50b137ba26fefa7aa060c7c3
SSDEEP 3145728:9MFKfuKXfVIxqFpEhVUJ0mDM+pHU1ZJKWihTd5VWIh0z+YyrSDb/u8ZtL64ZYJ+s:KXKXsqFWe9DM2ao5VqyOju8jL6iMnLn
TLSH
T1FDA83368B11AEE78D9071527A2D8D76C96F8C1230B44E9F63F3F17767514EABEB60002
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

nickman12-46565.portmap.io:46565
nickman12-46565.portmap.io:1735

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Userdata.exe
copy_folder
Userdata
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%WinDir%\System32
mouse_option
false
mutex
remcos_vcexssuhap
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Extracted

Family

darkcomet

Botnet

Guest1111

193.242.166.48:1605

Mutex

DC_MUTEX-2QRLPN3

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
Rb5l52XcV9no
install
true
offline_keylogger
false
password
313131
persistence
true
reg_key
winupdater

rc4.plain

Extracted

Family

njrat

Version

0.7d

Botnet

Geforce

startitit2-23969.portmap.host:1604

Mutex

b9584a316aeb9ca9b31edd4db18381f5

Attributes

reg_key
b9584a316aeb9ca9b31edd4db18381f5
splitter
Y262SUCZ4UJJ

Extracted

Path

C:\Users\Admin\README_HOW_TO_UNLOCK.TXT

Ransom Note

YOUR FILE HAS BEEN LOCKED In order to unlock your files, follow the instructions bellow: 1. Download and install Tor Browser 2. After a successful installation, run Tor Browser and wait for its initialization. 3. Type in the address bar: http://zvnvp2rhe3ljwf2m.onion 4. Follow the instructions on the site.

URLs

http://zvnvp2rhe3ljwf2m.onion

Targets

- Target
  Rf menu installer.zip
- Size 194.8MB
- SHA256 fe5d035653074b65b98991d1288f3f9042769ed73d3d5685ef0e779e49622a6f
- MD5 93213eed760cbf256aece619260a0b93
- SHA1 1aa5c86a131f3f026065dfefd203ada098215a93
- SHA512 b81af89db8ec25ae20f1824a75e8e8dad815c5cecdb4c77253ccb8d43b19a08735cff62474137f6532cfd575d27ce76cb8d6754f50b137ba26fefa7aa060c7c3
- SSDEEP 3145728:9MFKfuKXfVIxqFpEhVUJ0mDM+pHU1ZJKWihTd5VWIh0z+YyrSDb/u8ZtL64ZYJ+s:KXKXsqFWe9DM2ao5VqyOju8jL6iMnLn
- TLSH
  T1FDA83368B11AEE78D9071527A2D8D76C96F8C1230B44E9F63F3F17767514EABEB60002
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Rf menu installer/Code setup- (Password is 4).rar
- Size 146.4MB
- SHA256 d822ac2cc58b626170ae747de23c5582b4677c453bb4612c75e42fd93cccd345
- MD5 b8abf327d1cd0daeb8cc10c8af748a45
- SHA1 af8f8792e4c8ad529d935aa8ea266f319cf5e800
- SHA512 4ac8d9894f6cb0c371ddfa1c6eb5299a4ed365d47dcd8879281b6a725edb6caa95b281f77150569897f14a5d0793730ee0b86f98a360d50f2af5dda1eb3d3100
- SSDEEP 3145728:JqheDE6BrJwfgRhMpzq/SQTiQpF4j/3uy6hVZTJaC/6tMoo16Ljt9:0h6B4gRmE9TicECTJ4owx9
- TLSH
  T1E578334D3029DAE8CA0A0577A6DDD3AD98F8C3220E44F5326B3F55B67075A6BEF31016
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Code setup/Setup1/RunMe.py
- Size 1KB
- SHA256 48f319f3dcd2a57779a21964329ebf9e6ccb772410b8d7ba4ed6d8c2298a11ad
- MD5 ec8a02acfb949477160445c210709d75
- SHA1 f51cd3a82cb16b1c048b8a98911c211d9ef6cf56
- SHA512 27def37c6f90df44a4b14bcd0c836ae9aa43c33acb5b6321cf5a0599a000c4312bc09e2744479b584b176dee0c8bffdcac2e1395fe0bd50a49b0d1cd57b4960e
- TLSH
  T1D43197129D8F785911F1CACD681096AAF703821366206833FEFCC7201F753A866F4E6D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  Code setup/Setup1/setup.exe
- Size 36.0MB
- SHA256 b9229f8c8f5f36be1d6a54ccd9c617a508169d3cb2378f20276e3b9042814da4
- MD5 da7941733714583171c48cec0351d7f2
- SHA1 0e522c7a2caec209859302a5f9b4f03f2a6d7416
- SHA512 c148028781a7ce6616f2f35b371a95a7065434c4fa9943b93455f1705970b56aa3c7970109d52f33d5142c6145d75d06155e2a8dba056a53058cf18548a67789
- SSDEEP 786432:2Xbznxv2JL00HrxDm1sUC+nT5T5rH18Ug1MiVEgBObiSUQe0pNw:2fndeHrw1sOThxHIMngaWv0pNw
- TLSH
  T12D8733D101C10196E996A23551BDC7B393B3B9812B32DD6F0FC8975E39BB2D25CBA780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral4
- Target
  Code setup/Setup2/%IR.exe
- Size 8.3MB
- SHA256 9ebed67716490f9da091ab0bbe3cca2b44bd5bda29f1166fae0ff2f211d69908
- MD5 23d5fa1bcf2a0c8a1f6efca64b229067
- SHA1 dbd79ada460ce1bd896be6ddffb7e9b36b4951f4
- SHA512 d223a71ba2bf670a7329a68d7148a508cd2b5c548b1db4e2f375a38b62bf9eb6d45ee573303c88884781a0321d55568a6d35e36be2ff99e87a66f0349b436a33
- SSDEEP 196608:pbLGlHwtbW897G+x7eovq5XMP6PzFcsxHsoqrbRjMF2:09w1Fdq1B7LxHsoqrbpi2
- TLSH
  T15196339513E105E7F4E7E23D0A62D1A6C272B8102B22C6DF17E4866B3F572F26D36B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5
- Target
  Code setup/Setup2/RunMe.py
- Size 1KB
- SHA256 48f319f3dcd2a57779a21964329ebf9e6ccb772410b8d7ba4ed6d8c2298a11ad
- MD5 ec8a02acfb949477160445c210709d75
- SHA1 f51cd3a82cb16b1c048b8a98911c211d9ef6cf56
- SHA512 27def37c6f90df44a4b14bcd0c836ae9aa43c33acb5b6321cf5a0599a000c4312bc09e2744479b584b176dee0c8bffdcac2e1395fe0bd50a49b0d1cd57b4960e
- TLSH
  T1D43197129D8F785911F1CACD681096AAF703821366206833FEFCC7201F753A866F4E6D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  Code setup/Setup3/100________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 220KB
- SHA256 1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423
- MD5 3ed3fb296a477156bc51aba43d825fc0
- SHA1 9caa5c658b1a88fee149893d3a00b34a8bb8a1a6
- SHA512 dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e
- SSDEEP 3072:EJv/3Ppzq+M4Lh5VWK5qlYRV+hvuFiweXXbGgL90v5mq33Z3:8hzEA5GlYMWFBeXvx0c+3
- TLSH
  T1382429D727B941A2F9113CF0229A82B586470C3EA2D22F14DED83F56667F27DB115A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (100) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7
- Target
  Code setup/Setup3/101________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 136KB
- SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
- MD5 70108103a53123201ceb2e921fcfe83c
- SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
- SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
- SSDEEP 1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD
- TLSH
  T128D339B3AC82C8D5FB2D38FB957FA97C816FAD083918B4129905310A187EED3657345B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit discovery persistence
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral8
- Target
  Code setup/Setup3/102________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 36KB
- SHA256 db0c7e3029fb2a048e7a3e74c9cbf3e8bcec06288b5eafac5aae678d8663bffc
- MD5 65eeb8a0fce412d7f236f8348357d1c0
- SHA1 c31af321819481bcc15b2121f3b5c04481eaf525
- SHA512 fad1b721a6420984e13d2278b1d6b5bd70442ab3517553682880a9a8d90f9d47000ad6069cb68d3218d01bc23f771936bcce2529b646501984b954ae9e9ce573
- SSDEEP 768:/TiDhjVPgoa8G1RW7v4cweXAvgbAfMvAvcR885GhD:/Tit5IZwz4JeXBbdvlyh
- TLSH
  T1E7F2E723E7AC6029F55687B12632529618373C314931DD4EEB4E6E5C2B736E388F0B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral9
- Target
  Code setup/Setup3/103________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 56KB
- SHA256 fc2ced1d89845dcfae55b6e854cd0e622fdf98baeeb4a67a60852ecd1212f93b
- MD5 a1f722324492fda51077449ec2db2827
- SHA1 e4d8d27d77f8c2f5282a899a48184c40939c1665
- SHA512 6c30ce6a2055300990a951ab487039d92985271a06123d81864495bebc88fb6790be81397f729be4dfb2667d5bad506f51ce93426e4f9369f93fe5c832d8c9e9
- SSDEEP 1536:/eC4p0nWLutsr+dTIpqUWtlBNhcx5s7VVDo:WTpcWSZp3IGBVM
- TLSH
  T19043292AF751402DE19282713A2D87F75675BC790A91CC5FF7457A1938302EB98F0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral10
- Target
  Code setup/Setup3/104________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 86KB
- SHA256 400c72ef312e3b46fe417aa82d6691d18a07c0708e94b6fa7b47934909d3db7c
- MD5 70089174cf0b97d4e4de889f03e97a7a
- SHA1 c87c555b412929ab73562a048893bffc529436d9
- SHA512 29c52942edf46ee11e4bae6837d632ed76372c13f1c5811546ea964bbb81e2076c596cd93936a34e7f4a45e0741c7ce90c7cf871a613747ebd329b174fb33538
- SSDEEP 1536:+RYXfuc7irz4OQ7K0+ezvio7GDW/1CD+xD+xljEErxTWDTMqhGKYIZTET8JsE:+2XfscKAv8WNCDgDgljBkMqhGKZTbP
- TLSH
  T1EC83E1CB8020DEC1E8AB797D191861F9E7DA444C7AF57049F83643DFE095640E2BC69B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Code setup/Setup3/105________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 1.2MB
- SHA256 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
- MD5 e0340f456f76993fc047bc715dfdae6a
- SHA1 d47f6f7e553c4bc44a2fe88c2054de901390b2d7
- SHA512 cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc
- SSDEEP 24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG
- TLSH
  T103452394A452D017D2C67AB9C036DAB45BA4B831EEC2391BC354F651BD70383CB67B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit discovery persistence ransomware upx
- Renames multiple (140) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral12
- Target
  Code setup/Setup3/106________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 10.6MB
- SHA256 9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305
- MD5 e9e5596b42f209cc058b55edc2737a80
- SHA1 f30232697b3f54e58af08421da697262c99ec48b
- SHA512 e542319beb6f81b493ad80985b5f9c759752887dc3940b77520a3569cd5827de2fcae4c2357b7f9794b382192d4c0b125746df5cf08f206d07b2b473b238d0c7
- SSDEEP 196608:+ahZ5qN3wvdJBiAv1hXx7jeeDt9/wGoyIu+sTvDmQONhL/LslAVyq8rZyA+TXtT4:+w6NAvPAA/Xx3eeDtTD+GDONhL/AlAV8
- TLSH
  T144B6330595ABD4C8DF4DA234C7B8DCFA82827C4921AD054B7ACF3C977B7F905E824266
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Sets desktop wallpaper using registry
  ransomware
behavioral13
- Target
  Code setup/Setup3/107________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 92KB
- SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
- MD5 fb598b93c04baafe98683dc210e779c9
- SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
- SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f
- SSDEEP 1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6brM:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+7
- TLSH
  T12F93C713FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA419D79892D416EBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

host defense_evasion discovery execution remcos persistence rat trojan
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral14
- Target
  Code setup/Setup3/108________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 96KB
- SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
- MD5 60335edf459643a87168da8ed74c2b60
- SHA1 61f3e01174a6557f9c0bfc89ae682d37a7e91e2e
- SHA512 b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb
- SSDEEP 3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx
- TLSH
  T118A3E0417AE1AE3BC67A6EBA197546410BB677386030E7DD0C8250CE29E3F044A91FDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral15
- Target
  Code setup/Setup3/109________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 4.0MB
- SHA256 9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885
- MD5 1d9045870dbd31e2e399a4e8ecd9302f
- SHA1 7857c1ebfd1b37756d106027ed03121d8e7887cf
- SHA512 9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909
- SSDEEP 1536:SGZiTHzreu+4SHYEJicHHkxcPiwlJ6BjQaJ7ehgQpmnp3bDBq+AD3tSYxV:Z8AHxicHEuP5l/aJ7ehgiYDk9SYz
- TLSH
  T174164A082BE8CE29D3BF0B7D67F4255D8B70A2536A12E71E0ED055FA1A537C40A093E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

guest discovery execution revengerat persistence privilege_escalation stealer trojan
- Family: RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- RevengeRat Executable
  stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext
behavioral16
- Target
  Code setup/Setup3/10_________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 16KB
- SHA256 da1798c0a49b991fbda674f02007b0a3be4703e2b07ee540539db7e5bf983278
- MD5 0231c3a7d92ead1bad77819d5bda939d
- SHA1 683523ae4b60ac43d62cac5dad05fd8b5b8b8ae0
- SHA512 e34af2a1bd8f17ddc994671db37b29728e933e62eded7aff93ab0194a813103cad9dba522388f9f67ba839196fb6ed54ce87e1bebcfd98957feb40b726a7e0c6
- SSDEEP 192:nC34zPAmm2VkeyLffMhyyuyeYHOGFeDK6P6t6:U6oj7LLffMI/jqBo
- TLSH
  T1FC72C6A67A584EA5C84D4C314ED3CB31EC7A64B10708A23723F2F85E193C6B9783D89D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  Code setup/Setup3/110________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 666KB
- SHA256 438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499
- MD5 97512f4617019c907cd0f88193039e7c
- SHA1 24cfa261ee30f697e7d1e2215eee1c21eebf4579
- SHA512 cfbb8dd91434f917d507cb919aa7e6b16b7b2056d56185f6ad5b6149e05629325cdb3df907f58bb3f634b17a9989bf5b6d6b81f5396a3a556431742ed742ac4a
- SSDEEP 12288:bB/72HFAQBMiZB7fJJ2qDHKK/K5FJL+xQhrwjeI:bBKqFiT7fJJ2qbKK6F5+xQhrEJ
- TLSH
  T1D6E4232F4D4C2BEBEB4A58B0B4CB7BD94FE8153A52D85AD18718DB95F5760284340C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution impact ransomware upx
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (63) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral18
- Target
  Code setup/Setup3/111________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 104KB
- SHA256 b2fa6edaa5ffc51d12150424355a0c86ac9f46d7ec772d35ab8d9f4fe7996d91
- MD5 ef1952b755ba912b9f60b2ed8dd68d30
- SHA1 dcabadcf6f4a6079c8373ab2eb94b8ffeebd8d96
- SHA512 dd088f3ba5f97ae379d005ab252dd6aa98e10f81ef70d3029bfb4ece7bad5dde7558f25711c229bee6f5901bed980159fa82f217f281ce7476ee30e90a598729
- SSDEEP 384:k/exp+OvWEcAB9KybxgUamOUOtTMmlTD1DtkzyQ+dTXr9421qYGI6s37uP:k/WpR606UahvXDDkuRBXr9115Gq37uP
- TLSH
  T163A37B327CC102B7C69285B214B95B0BEB3F29322F61D543E7C89A9B2E315D0AC39717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery sasser worm
- Detects Sasser
- Family: Sasser
  Sasser is a Windows worm written in C.
  worm sasser
behavioral19
- Target
  Code setup/Setup3/112________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 104KB
- SHA256 00808f00ec970e3ed518ed40ba77f64be2b9761b02fbaea2047c5ac82d8b8f99
- MD5 fa3348956253f9f733b28b4cf1d45942
- SHA1 7185d2d017370978c757956be1bfaa4c787867b8
- SHA512 7805fd530dbc37f72c39f729982a16cb03314ad1b1e115fd16e1679c54d90a3cbc2f2404fcb0f6d0196a919395d1842fd75fae8c0b97d2af06a94c57f3251add
- SSDEEP 384:b/5zyD8MpMCi/8Zn4y5xsjmhaBs8DT0ml1j+/YPSfudTXrQ4PdGAWa8:b/lgpr4K2jm0+8Dk/YqGBXrQMGAWd
- TLSH
  T1F5A35C227CC20677C0D245B254E94B07EB3F6A312E709653E784DAAB6E31ED4AD39347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery sasser worm
- Detects Sasser
- Family: Sasser
  Sasser is a Windows worm written in C.
  worm sasser
behavioral20
- Target
  Code setup/Setup3/113________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 184KB
- SHA256 1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7
- MD5 c9c341eaf04c89933ed28cbc2739d325
- SHA1 c5b7d47aef3bd33a24293138fcba3a5ff286c2a8
- SHA512 7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b
- SSDEEP 3072:H8SIBtQnE7OhssdWJ5jy392aCmCbBq0ryEbh/Wl7hqU6Q4NJ15xgDbvSY5thfRb3:c7qvhssdu5jyYaCmCQVE6hqUI5sb9Rb3
- TLSH
  T11B04F17CB5005DE9E75E2237DAA5BCBC03B70911E98A58C551D87F8221F33B5FE42A0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of SetThreadContext
behavioral21
- Target
  Code setup/Setup3/114________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 49KB
- SHA256 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
- MD5 46bfd4f1d581d7c0121d2b19a005d3df
- SHA1 5b063298bbd1670b4d39e1baef67f854b8dcba9d
- SHA512 b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
- SSDEEP 768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
- TLSH
  T1AC33BF0ADA486E63C971B674EFB7EAFB403C544A5B7D38FB9B84004D053E2F5A163462
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of SetThreadContext
behavioral22
- Target
  Code setup/Setup3/115________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 48KB
- SHA256 2ebe23ba9897d9c127b9c0a737ba63af8d0bcd76ec866610cc0b5de2f62b87bd
- MD5 86a3a3ce16360e01933d71d0bf1f2c37
- SHA1 af54089e3601c742d523b507b3a0793c2b6e60be
- SHA512 65a3571cf5b057d2c3ce101346947679f162018fa5eadf79c5a6af6c0a3bc9b12731ff13f27629b14983ef8bc73fa9782cc0a9e6c44b0ffc2627da754c324d6e
- SSDEEP 768:WQbWH9cNN5EM4Xk9fFhPc28F3hT/BysVPkzEDGlnwOMYsGfM:v8cbWMFO28FxT3VPkpk
- TLSH
  T173234A16BBA1C032E062253818B9C2B15B7FBC7352B5859F7B98077D4FB13C0AD69366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral23
- Target
  Code setup/Setup3/116________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 203KB
- SHA256 750e37d1fdd64e9ea015272a0db6720ac9a8d803dc0caad29d0653756a8e5b17
- MD5 b28505a8050446af4638319060e006e9
- SHA1 d3ddca0f06af4df29a9f9fadb6bad8504add5525
- SHA512 889dc35054f5adc5b5445fc90dae5e19fe95ee04432f5230994124b73f9a1fc4bb050aac789f4934c84ed42d8c063b8219563e33a48b92f10294b7d8e426b9f9
- SSDEEP 3072:M7PDcEPPhtIlT5ri9bOqStDvzvSheG3ivbV0EIU9j4szgGGl/2tdnpm7no3:qPDcEPZSTrsyLzSovp0PGUGkQnY7o3
- TLSH
  T13014125FDF05143BE5643E3D8281366B3FCC751025E41E0A83A9696BD80FB62DD1BB8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral24
- Target
  Code setup/Setup3/117________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.exe
- Size 38KB
- SHA256 1772928750d316f1046f5e83a73fa3e121686ccfebdca9496e5a62c2c5af23d4
- MD5 63db723516db09bf837938254e8cb1d3
- SHA1 259b45f1b6ef457e1f41f3ea3844bc6da41d97cc
- SHA512 59e57b9ea82e30232a4e6cdc3e0723290788b6b0eb4a6c636c48048d4aa71bdf7c6d344995700e5ba9e62a03217c35acf7efaf1d3147e3afa2ddccbaaa14e00f
- SSDEEP 768:1o0WtLEv3e21Fg9YMeuJufh11r5lNT/XjwpHPQjw9kL+z2FQ4:OlAr1vrx1rvNTuveA4
- TLSH
  T18803E16F52A8C87BCB99193808A1121662FD92F1C17F9FEEC65B072F7C19924FD124A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  Rf menu installer/Defender control v2.1 .rar
- Size 446KB
- SHA256 b378d7f1fa1cffa05b55917225232224ff0b13a1d739feac017c7fe56f1b3adb
- MD5 96b5933de9fc36d0385cdd41f2955fe0
- SHA1 c457e29bc8638c9e2e1e10203bc00f19da1a8ca6
- SHA512 76733c94d51b26f23b83b0d32e8ab68dd686777186ad5b21430e14f76950e30d2ccc6278bf9e424fb26d9db00e7ad892dce4dbc0b570638e046795312bf5ae78
- SSDEEP 12288:oxnSX+G1gpDHX46Sd5XkQTvHZ0/5EIq0yK36skx:MnSuugpDIkOHZW6Uy46rx
- TLSH
  T191A4231EFAC6DE14B0067C23EB61FD7554261F0F94892ADA96CF2CF23651D958C28E8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Rf menu installer/Luancher.py
- Size 29KB
- SHA256 0803445c3a5e98785255c82404030a4a5854dce17664922ff4428c60bc28fd3f
- MD5 7a79d9f2f205ca2873a5bb04a8d22690
- SHA1 b4a1b194e39e7a89c6181b9a64879782843c0ad9
- SHA512 59952d83fd591dd4de7bf7093e0c9c53e10a1e50ef0ea98e6db374e5735568d6987ec3ba575d01afb9f45426dbf4562ba4aff0a025d62c5c9c31d991da7bc0c0
- SSDEEP 384:oCPckYjyVoCK6QDOho0QVeTohoSD569yx0/Kyro3ANyIKb99:fckYjyVxpCIoKToh30yO/Ky263i99
- TLSH
  T15AD2B7C75511D37913A3F4446E0B9E87654DACBACCD8E7A4B0BF061AF7A832981E5BC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  Rf menu installer/Password and setup instructions.md
- Size 552B
- SHA256 87e31e95f2645b833fda3d140a17360b29e2e29da49f94b111159d894164246f
- MD5 603ea87196426640017ccab6ddb77559
- SHA1 4e13af3c29107a41da110b7f80ad15d2da46e066
- SHA512 49a578324796f797db545b6f8b14fbe077f12d54d121b9c3e76407f4299a30f71bb834e9b85db627bfb65aaf01b42ab180556db04b66c465d6923a029ccf8cf3
- TLSH
  T10CF08B133522623909328408925E7693731BA5B202868530397B580DE3AA27AC9769EF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  Rf menu installer/desktop.ini
- Size 50B
- SHA256 dc81703a1825c2e7f4201dd8209cd5bbbacd1e968b9ea16da1e73405370372fd
- MD5 57547abc139a1b8e819753a2c8431d0a
- SHA1 f851705e60dd2e7bda41ae7afc667d66e4e00397
- SHA512 52e5c506c15e3888a1dc732a000b66783f433fe1e1d963ef65719a066519034a6771b5aca347c96f8904ff25c52b376d8ed87e1095ff53a23d744a199bbdf35b
- TLSH
  T13290024A00834A98F705311C096541B1C445589D21432F0686418150D4462949248940
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29
- Target
  Rf menu installer/imgui.ini
- Size 125B
- SHA256 ff91473bf8acab8139f2112d8d4f09d0bfefa7aab53b413e7bf07532a3743259
- MD5 2797c692eaf07d108de4d1d411babf93
- SHA1 e0b076068f4db981ba2259f172a53b66bff56019
- SHA512 726904cc8c30f83d8db0521dbe81a00bf2863059b885c1487f7500c63480debd35c6c8b42b592bcebd3298db7987ef0805d1082519804525d7d3953f3b954339
- TLSH
  T133B092033326135E22F79040527A77E87ACC2B046442B19811A8004ABD2B527A48B5DC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral30
- Target
  Rf menu installer/python-manager-26.3.msix
- Size 44.9MB
- SHA256 bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec
- MD5 481108867e8640739f8202c83698cf3d
- SHA1 c69fdf0ae2375c6ee091a9d3b356f726193ed2a2
- SHA512 c4cae5cdb83185463a202144032490bd72d5e75023ce978060f69f49489ec2acac12d93ddef6f9aa844e63cfa9cb35ce14f74903f2c85efd9a8e3a056df29bb4
- SSDEEP 786432:g8wSX9ok1R1mf6r95KmXI/IQn8t0YbdD73Fv6VT6awNrxOrp6IFoQ7Ef/c7lbPOP:1tD71mke/lng0kdgGawNsrp6IL1POP
- TLSH
  T156A73321FA0D1EF7E1537E3D51418F268F2D9093224EF48E2EB846E415536CDAB9A70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Rf menu installer/winrar-x64-723.exe
- Size 3.7MB
- SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
- MD5 f8c87a60b54c555b5bd5d18f7ad9b35b
- SHA1 8c1afc0011357ab6a60a39b4ccf1698865e2b0d1
- SHA512 93a49776b41cf6c47a615be914c6e8a1ff670aea3d2d966db9391054c0327c64ad852ec0807d8a7789d5a0f0f1fe7115820162ae3a58490129308fe3ee438a45
- SSDEEP 98304:ZqBAjnA0XicrT3mN8Elu+GDQOQ5X3555ViyKp:HA0XicrTDElu/DQOUXp55Viy
- TLSH
  T110062329D79514F5E137D534C8A10207EAB17CAE4771C6CF23EA198A1F23791AE3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral32