1b0a8ed580d194b7bf64a0be0f43e4a0eca2e23106d6c579cd7fa0daf5a4b44e

Sharing

Copy URL Twitter E-mail

General

Target
Diabolic Traffic Bot v6.22.rar
Size 59.8MB
Sample260812-qgr2nsch66
SHA256 1b0a8ed580d194b7bf64a0be0f43e4a0eca2e23106d6c579cd7fa0daf5a4b44e
MD5 07cbd7024830a041d1543a3cd73e5a81
SHA1 78250233b495947513627a9752ee6fc08a63b308
SHA512 82a8057ad2bad5361fed1692ff0a74993ebc45ef3e83216ffe83b05cd52c706c1709c73f4e474074b0d9a37e65e26046377e8ed1502f3b998bce29551ebd46c1
SSDEEP 1572864:d3DOVKpSSxOvTjiMOXLe8PWDEMzx68DMbKpSSxOvT1iMOXLe8PWDEMzFg:d3DOV0OvOeTvV68DMb0OvYeTvJg
TLSH
T174D733445B302D19AB792AF24D0673C9665792FE1BCB672950C80933DCCB266D3CE6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Diabolic Traffic Bot v6.22/db/Firefox/msvcr120.dll
- Size 948KB
- SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
- MD5 034ccadc1c073e4216e9466b720f9849
- SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
- SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
- SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
- TLSH
  T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/nss3.dll
- Size 1.5MB
- SHA256 4c965ab79d4c7131f87d5cde7ecc8923be8d26e86f4ee3a6a15463aeb97a413a
- MD5 165fa7cd4a06c3b14eb24ffce036f69b
- SHA1 2db9c1412cb60034f7f576ab5924e118e245883c
- SHA512 8c8be2674562c3df88b7aaaa7340413542acaddfe89d6baec56781ce66ba2a98f3a04a2111eb9aca2110bd1f7f8966b703468c9c714035e6aabd1b5d3d197959
- SSDEEP 24576:HLFRE5XipPSCyQafxaSGGYQGVQFnUaXwJhI6qmNentmbjA6GCcB3KgXarZzAlrd2:rjDeXHKHjiw2Bc326qkAMS0TEs1
- TLSH
  T1BB757D47E7C250F1FFA600351162EF3F0E725925E325AEC3C799194588536D2AE3E2AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/nssckbi.dll
- Size 400KB
- SHA256 e807076edefa13aa292a6db354f98a8243c868f71988c7d80954b14816107588
- MD5 cb2c4ab44b14c9567015ec4352a4fbbc
- SHA1 24068dd7b45df98acedc94dcfaef23743b4a5021
- SHA512 982f0514ee762499ee8438398438e3417068c034dff3feaa41c7b5e7cdf229df6ae5b5891c58c91de79ef4a9257ea28e0a66bff248f430be64c854972b52b116
- SSDEEP 6144:9l4rSghD5Kl8upHXKv4iB9sIphlcI3+KsyFIFozI4oKk:MrSghDc+upHSJ/0IpIFozI4oKk
- TLSH
  T14E94398BDB646A11FECF4AB071C6D3273E76D694BBE586A70215C5922DC2FE42D0C04E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/nssdbm3.dll
- Size 85KB
- SHA256 453b875ff6377d12c6b8c4c0d8a73186afadd79e3c2aeaa44e77ea898cae48df
- MD5 0e33c5b8ce5d1276a5b2ea79b6f2c6ab
- SHA1 bddc5c4e92771d2fec187b7b1c11d77e3eebf119
- SHA512 f1561b35afead0e40be1735405c4532278fbf7c2ad68f2de2a0af4553f659a6314ecc5bbd373289d7c56996a1c0c6ece754a2566f9274d3e351729fd6e19f0b9
- SSDEEP 1536:Sro+et8XVgU5Er/1tbYkvAdIDGG8y0vhf0rUEr+y24vi9ZcojZ85YhqR1ZDRL+OH:SrRy8XGLr1NnJj2Er+R4a9Zc0Z8kqR1T
- TLSH
  T146838C96B98290F2E6D60075B135673A4F3F991AC725CDC3C73A1A460C260D2EB3F6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/plugin-container.exe
- Size 273KB
- SHA256 70ad689e89c97476474f209a802167eb058dce71c7eebe83fa633c8920b24461
- MD5 e428725ae38bf1803cccbf348d280d39
- SHA1 b68defad7a4d89c32a053958d5660dd707a36e7a
- SHA512 b784473bf0c2930991be50f19969a0e2c29be9021283fd52a5ec476b69bb060fa35a83a73f2198425c1f9da282e98263eef902fbe4d1ed5d06db5420510a2061
- SSDEEP 3072:6RXrKiHPiho+TURzc1Dl4U9vbPTrdLjJCIfkAHU2Ie+Q4aK5eL1P5:4eiHPWm0DlxrHdJ9jvcURB
- TLSH
  T1F9547D01B6E18079E47302731A36AB32677D7C704FA28B0AE7981D1EDE31690A7757E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/plugin-hang-ui.exe
- Size 163KB
- SHA256 764a165a2c9b99cddd81353e304f2bcbb5660943cb019a4cdd6e176f5d2d3543
- MD5 ca7a4661f14428d997c436224c44f31d
- SHA1 74d398edc0a4e538cf44e00e826bb486dc489cf4
- SHA512 a5473c037210977e7c0243c9a55688a00d89a64a5ac432d63be05850407c8d006ea6afa4eca0b4640e506ea79e026128462657805c2e907d8e1964049b5591c9
- SSDEEP 3072:Zz6yXGXWtDEDQnMkXuCIfvtw7qQ4xx+JcCNT56pHH1vVCU9e:IyAWa73fviqx2GH1tU
- TLSH
  T1AEF39D117AD1C071E17342B209F9AB754ABDFD324BA28E4F77980B8D5B34681A326773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/sandboxbroker.dll
- Size 208KB
- SHA256 c58556ea4237f702c5893756006788cb17b5ef16b8d97bfede1c51432c35ab79
- MD5 e15060600dd74baff625e75132beb6af
- SHA1 940196d0a449be1b57683da9df573aff8bcb126b
- SHA512 6f26287c7918a6bd61a6c8ad6e1a3ef8b3a34407774928129056c6994c547dd53f0fa58251d4f5bd4dde09accdde6a227ccc0adc9ba47adee2b304b516dc3f6a
- SSDEEP 3072:8rRAIdjXgJTqDko4WYFIm0osOXg3nNQlt3UlH1:k6I5IuqL+m0oRg3nql4V
- TLSH
  T141247D83FA810CBEEBBF21BD5C322738B3B6E9060A519616D3586C1E4D1177197623DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/softokn3.dll
- Size 144KB
- SHA256 b6f798b688e15ab2041e177d7c13d35ab936a5532f90094f595e19299bf9625b
- MD5 a7fd2cce764cb5f5f2cd3afbee51c8a0
- SHA1 bff22a5f28da32973016170dba73b83a91094be4
- SHA512 30f5c6d916feee9097128d40dec2864713787598db1d3ebeb501cda879c521523fdd3b2a2444ecc15d4948c08fc07e3cb56dd764ef2050aca43bee698bcd7856
- SSDEEP 3072:pcAWt4IBYnxRTpPGzpkj/eGwaSVkNtstENoYwjll/ibeu4D3weTekuWz4L:uAWBBYn9O2PXScyMJ4jkBT
- TLSH
  T101E33A42B7C951B2EBD240B622B5173B4BBADC11A3248AC39B7569590C352C1FF3F399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Diabolic Traffic Bot v6.22/db/Firefox/xul.dll
- Size 36.8MB
- SHA256 756f78a4295f0870f858fb59147cbf59947ddb4cea2ba285263b600f3bf6dd39
- MD5 f8ad5141abbb51b548d49cc6fcf8492d
- SHA1 76fdc6b6fc4ad4df434aacb4ea77e239aa227a36
- SHA512 98e2de7c930723bb3d74ce99be2977fb5c532775b3f8f24f5b305080f5dfeb1c1438dffde3e4b5009a2c32e26eb78ec44f69d1595449f6f3b11d5e63afeade02
- SSDEEP 393216:oKpNNtC8dew9Mo61Rjak2HRIEZYWj+TccBxOFbnIilTZGXhMMRfX/cKhYN4G6mue:93Cu6hmZYWjEvViB4G6AqNzTG7JGO
- TLSH
  T18487BF13E7C280F6E987117049377B3EDB796B184329C6C3E3981C86A7615E1763F29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Diabolic Traffic Bot v6.22/db/Geckofx-Core.dll
- Size 1.9MB
- SHA256 dabff9f0ee61a9cd171e49e7590493c3c65d5eebdd6b63d872f8bf729e18c31a
- MD5 850e3d7a1dde0b423c45fa230775d3d1
- SHA1 a67c4f82a6b7c9601a55fc3447abe963ecca3891
- SHA512 c7df9a0933d4f7e3de4ecd00fb7004a0de78f7e1c38fa603f74da9c3b9cd47659a9141aa1f34fcf30436c01808f5e84230e53368d43bca2a41151087846157ae
- SSDEEP 24576:j6eSefygPSAMb+qnvSqGKymIMN8GXEdEYM3hUp1NJCuX/whYz9I3D4:BjNMNBRbuX/whTD4
- TLSH
  T10C95D545FFE02A7ACC0927F584B30A108AF0D555570BEF2B054C93BA2EB7B54DC562BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Diabolic Traffic Bot v6.22/db/Geckofx-Winforms.dll
- Size 133KB
- SHA256 9f66e91690954d85d316e84f94b04e5cdc6491b8b6c2efbee3952e7932abe640
- MD5 57ff6cf5c0f164cfdff058811230b567
- SHA1 90e4716419465318b7756f50821d473ae9aca833
- SHA512 933f94ff0b45abfe6c004566e16580d1e4f428b7554f3f52ec6bcaaf4848d8ac5c4a72ac2870f57ab9669b6fe0a475b5210cd37391d9ed72ad7e66fc6e114576
- SSDEEP 3072:mB6mUtAEOWGaQZCY4JwdTiPMQ5u8g6g7:mMhkxTEwtDQiT
- TLSH
  T1B7D34B5023A42A35C4BF4BF2EDB69D706B74A4C7F412D32A0EC616AD3DEA7504C09B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Diabolic Traffic Bot v6.22/db/Ionic.Zip.dll
- Size 480KB
- SHA256 17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89
- MD5 f6933bf7cee0fd6c80cdf207ff15a523
- SHA1 039eeb1169e1defe387c7d4ca4021bce9d11786d
- SHA512 88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6
- SSDEEP 6144:OhagC/Mq25o9sXGtSV41OJDsTDDVUMle6ZjxLV/kHu4Bht79I9:iagxWS4msNUCe65fkHdBf9
- TLSH
  T183A4AD0427E90A55F4BE5BBAC0B69260C3B1B4166D6FD70F4EE020EE2D37790D9147AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Diabolic Traffic Bot v6.22/db/Launcher.exe
- Size 53KB
- SHA256 0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
- MD5 c6d4c881112022eb30725978ecd7c6ec
- SHA1 ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
- SHA512 3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
- SSDEEP 768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
- TLSH
  T11B332A489A4C9773C9ED46BE98E366904375C02B6B47E70FBC8982345E133EA194279F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral25 behavioral26
- Target
  Diabolic Traffic Bot v6.22/db/Modules/2_Random_Clicks.dmf
- Size 474B
- SHA256 627f33dd4e7f0b453ce5c4ee8b5ef27e1f18620647cbb0d4e0667861c541a2d8
- MD5 57453844c53f128454e91833a07a97eb
- SHA1 31a3af42ef12648423b6b7044bb717bc08ef5650
- SHA512 ad2502ae939a03701603becfea45c46985ea276948f7a6aa16ffe0e5bdbf391dad20e288cf2b7444aefb2eb0d2fc1652f3bd29f99fe80409587e16b0edce7e4a
- TLSH
  T1D6F027CDDD9541404059DC8C3DF2D009E51D06AB0DF594EBBE008A2D9169AB035AF399
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Diabolic Traffic Bot v6.22/db/Modules/2clicks.dmf
- Size 487B
- SHA256 092dc7d34df71ebf4140b069b4ca7c4f2f1e9034f4ae309da14f1412b6f2e7ac
- MD5 3a745699b359f087cca10ab899e5a60b
- SHA1 df52fea1c54425523b25b371cfc4416372158ea0
- SHA512 2c51cd538b5f3c789437c8a5d324e5fc581f2bfbc573b9e56104449c70a57c53e6c94790e454d3e18440a84c05655a5446c90b975c20ce51d5775e6625ccc1a5
- TLSH
  T1A5F09788DEC280342879AC082C74F00D632C1A391C3188E23A144E8CA27DFB07A7F77C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Diabolic Traffic Bot v6.22/db/Modules/Amazon.dmf
- Size 838B
- SHA256 f21272a4dbaed3ec889cccc0c7f833fe96b62cfcf4e7d22fa40766d104b8a535
- MD5 0b16f78634f9c5032a9c3885fec3aa44
- SHA1 335e7d0307e2ef4b1fff0fafc595885f2b998250
- SHA512 7f92d600cc1e50ddfcbdb2176cf78c90692a14088cec202bea650b9fe7c1739694cd870a359c27534e21c1a530c7ce721d1e6cb58b45850d5e34c246be9345ae
- TLSH
  T11F014141DBBE4A2D8DB7123051F4388BF749403E177266AC78899239862CDB4F0AD8CC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Adds Run key to start application

SmartAssembly .NET packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32