6b1201846fc437d9f95bf87e4ed92632705bb7884503ba7c37695a1e2bfcf951

General

Target
phantom forces.lua
Size 682KB
Sample260810-pxvbastydy
SHA256 6b1201846fc437d9f95bf87e4ed92632705bb7884503ba7c37695a1e2bfcf951
MD5 7d46cb0b649c1496154fdca312ac2169
SHA1 6a02bf598228306b6c438f88b4b043a937a9d5be
SHA512 b8a84225a90fff71569cf704544871409242c292005209e3c70877c7c3d016906726a3852fd380a4da028dfc458e8f0435202788f136283dd0d80ae687ae56f4
SSDEEP 6144:pxGsLB+yRgPNrbfT+iXKMB8b6J8wb0WrZe8wyvlKlAuzQf6qAvAH:/nB+EmNrLT+iXKWvxvloAuGAvAH
TLSH
T1D4E49536B24B26A241F3F2599C9F610AFB3211433239055A7ABC814C6F7499D71E1BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  phantom forces.lua
- Size 682KB
- SHA256 6b1201846fc437d9f95bf87e4ed92632705bb7884503ba7c37695a1e2bfcf951
- MD5 7d46cb0b649c1496154fdca312ac2169
- SHA1 6a02bf598228306b6c438f88b4b043a937a9d5be
- SHA512 b8a84225a90fff71569cf704544871409242c292005209e3c70877c7c3d016906726a3852fd380a4da028dfc458e8f0435202788f136283dd0d80ae687ae56f4
- SSDEEP 6144:pxGsLB+yRgPNrbfT+iXKMB8b6J8wb0WrZe8wyvlKlAuzQf6qAvAH:/nB+EmNrLT+iXKWvxvloAuGAvAH
- TLSH
  T1D4E49536B24B26A241F3F2599C9F610AFB3211433239055A7ABC814C6F7499D71E1BFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution themida trojan adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Probable phishing domain
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2