Extracted

Extracted

Extracted

Extracted

• • Target
    Uninstall/1277444444.cmd
  • Size 324B
  • SHA256 e0f4ee0ed8f037ffbebbf7558cb0bd5e79ca596c0eac90ddfabaf54c868e9306
  • MD5 fbc6105ba459d1a967023781299303ad
  • SHA1 929517d7f1aba3d5c82e8b917ab799e681c86285
  • SHA512 7f7a91645e302d9f80d4ea5dbb65247619387782217ca6fbb232e70ad0320f000ca4ad2151ba6766a981afe1b4f4072f055686e775cbd799d73e2fe007fa3d65
  • TLSH
    T194E0CD244961176C75D5BF340135B6D51B062386B928D6C0B634001D635F079D5144C5
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1
• • Target
    Uninstall/KMSAuto.exe
  • Size 8KB
  • SHA256 95ee4b9f039d8491f6c3b537a57a8a16349bdf63cb1d0d69e291b0fde580e4cd
  • MD5 1abf8d434d51f11a79e1b4ae689a2bfd
  • SHA1 70e061ed9387f807bdc5e7b7db3b0d6da6a7348a
  • SHA512 4aace50cef53f6fca8b3cabe4a5be25bde72dede989dd8124b5b5c05314504a89c9a08b31bc5e5cad1e0edcb97ab4a7be4a2640677b26655df3b07a2077bc652
  • SSDEEP 96:VuC1n2uo8ciTtath/Z6ejVAkJUpMwI3WNtW1jYcFKNVcz1W4oKYMsLYUa:f1n26csath/VAkJJL8stYcFwVc03KY
  • TLSH
    T1B702D64293D44372DA7343B77D779381CB36AAAB1C865BE8748C821F3F2655187233A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral2
• • Target
    Uninstall/UnRAR.exe
  • Size 406KB
  • SHA256 77f954665a4d1fa39b4ac908409432e2508244f07007c83f8f86fa9cde2d9578
  • MD5 ad757512c5af298772e986834ed5bcf0
  • SHA1 82f8f9e239a2b0f7b2ebd604303502cd3cade0d4
  • SHA512 23fafe54dfe9e19055c7e61bc3d73ece0d021d9e4c8160d2004d9f5ce9771d29b25381cfb5bc806a74c59dd8e652d7b6a2548c17cabd52d334a8e2ffa6b7607a
  • SSDEEP 12288:D4y2mrWEUh5ebWlncrbQ8/mZXSrH4rRftwKGk7E9B:D4RmiSbWlncrheZXSrH4rRftMqE9B
  • TLSH
    T1CB947D49EBE504F4E1B3DA34CDB14606EBB37C895A70C65F23A9815B2F637509D38B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral3
• • Target
    Uninstall/activ.rar
  • Size 4.3MB
  • SHA256 ca9c732d3162f92f07b8bd38fc560c687bed59887f5d8f5d85e89f8bdf4f72ca
  • MD5 c51ce8914140b013adb2feb8c84e224b
  • SHA1 700a7c500bb2be5776fb65c90ebbbaaee65c3b1f
  • SHA512 bb0b21c8c9984051cdd4db187dddd8ee25cf6ec93865a96bc9ef1575d076ef60dc0b146b9ba151dbd7bcf54ca2ea0af815dc6591669b710190ed92b19f6e8fcc
  • SSDEEP 98304:/khEoPRV/TUbVGIEDvT+fYPZpzFPo1mnPgSU46sk:uEoPjTUBGRjT+fYPZpzFgUn4S2sk
  • TLSH
    T1BE26331F5B0F0B2F97DE49D8844147FAB538B0BF17283CAC918795A29D1623797238AD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4
• • Target
    libcurl.dll
  • Size 26KB
  • SHA256 51a63fc99d0c554058fece4a3cb070d156b4eb8754af0f881a4ac0a87d82f8a3
  • MD5 3b1912044ccc19e2c0c1eef84c20864e
  • SHA1 be78362a9987ac53d77c8be7b313d94df5bcb52d
  • SHA512 eecf2dcdf2e5a91807d0274068b01b013453bd0eb44a51eb4413ea66d7358a098dc6b5ac037b965eba1c7eaf5bd15c10534a53d3b2f5e6dbe29c14703525b599
  • SSDEEP 384:ZPlTKh7zU6q7PnvQvExH27CdRIlZCBgv1fqxQ2EorSEKKs8wnSD:Ztuz3q7HRNd2ZBtvorS9vT
  • TLSH
    T180C27C09F2D84DDAE9B28138D8F35B0AA4A6F5319B3243CB47F04A6C1D2BBD4A539315
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojanupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Creates new service(s)

    persistenceexecution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5
• • Target
    𝗞𝗠𝗦𝗔𝘂𝘁𝗼.exe
  • Size 818KB
  • SHA256 4205d2cc3f3153517b97e98595df351546d2fa7ccbb503f6e6297cc97a058a70
  • MD5 dbd70a5f2e8210eda561e53b575ccc46
  • SHA1 498b7c983a3ac2f742f28c28690a4b5f5098f24b
  • SHA512 56eb6088bb1063c6402a9d9c95b2eebe53da41d4b1b7a7bdce9228a69597bbf249047d4e52b0780555d1e1a4cab1e2a3370d76b5f9d8d11570fb6c9390bea96f
  • SSDEEP 12288:ZUBd5kroRASCwPgMAaWUV67R6ggjz5UksxGtC2UJCUhKDnH7xPcRC1Xfon9Twm64:mxmfJonH7FMC5feTwm
  • TLSH
    T102059E1A67AC01F8E1B7E13889964606E7B1784A132197DF47E04B6E2F277F15F7A320
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojanupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • OS Credential Dumping: Security Account Manager

    Malicious Registry Hive Dumping.

    credential_access

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Modifies Windows Firewall

    defense_evasion

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral6