3b089e9172088b7bbab0f18e102c44f9df54cde59ea7c33b5420d392f95f4396

Sharing

Copy URL Twitter E-mail

General

Target
Default Project.zip
Size 18.8MB
Sample260813-nm862aad68
SHA256 3b089e9172088b7bbab0f18e102c44f9df54cde59ea7c33b5420d392f95f4396
MD5 7f3e75e500d4cfbc074cbf0218586240
SHA1 3994b7a581eb146df319eef2db3ce637b467c316
SHA512 2a5a8541deadbe4156693b2ab9733a30273e7fe633fc5a64e78fe5daed9e2e77e876414900a4695a4071899702d9d00206d97636d7ec350bf73aefc964c2a2fb
SSDEEP 393216:5YmqP0p6aJy7oWt3Rbwk3WRqUeFoNkjykD8A/kNhu/WVHp89s7MvMegL6ett7Fy:KTOy7nFT3WRqU1kjykD8A/k3VH2gMi4
TLSH
T1F617223DD41CD250FB86607863588309928D1EBCA253A3E93F245A8D8ED5F8E5A37F47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Default Project.zip
- Size 18.8MB
- SHA256 3b089e9172088b7bbab0f18e102c44f9df54cde59ea7c33b5420d392f95f4396
- MD5 7f3e75e500d4cfbc074cbf0218586240
- SHA1 3994b7a581eb146df319eef2db3ce637b467c316
- SHA512 2a5a8541deadbe4156693b2ab9733a30273e7fe633fc5a64e78fe5daed9e2e77e876414900a4695a4071899702d9d00206d97636d7ec350bf73aefc964c2a2fb
- SSDEEP 393216:5YmqP0p6aJy7oWt3Rbwk3WRqUeFoNkjykD8A/kNhu/WVHp89s7MvMegL6ett7Fy:KTOy7nFT3WRqU1kjykD8A/k3VH2gMi4
- TLSH
  T1F617223DD41CD250FB86607863588309928D1EBCA253A3E93F245A8D8ED5F8E5A37F47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  Default Project/.venv/.gitignore
- Size 69B
- SHA256 36692e1840f82f75adce103fd03e65b1eaa35f798c885b3b545e3abc14ffcbf0
- MD5 9e67d41aff7a7ff4f40412375930b954
- SHA1 df3abe65bb5f91b3d4eeb61ad661bdaaa8deccb4
- SHA512 add59b8eee4da15d0db5f8a809bd477d9afc2afd827a89337dc9baa11ce7d29a6b557107d7a6809e1881ae5deefc08d89342fb11c2d4d4dc8a9dec3cc9088379
- TLSH
  T13FA002F389726C041BE259A603C0B149D2E37B5826DA78A954DEC0BEC727EA83914709
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  Default Project/.venv/pyvenv.cfg
- Size 325B
- SHA256 a2486ea7185c18aa355b961d8aafff007ae312a45e3120ceeece9fa0ee1079a4
- MD5 961c4bec9d1b11b57dfb12a96ece48ef
- SHA1 c25404986da3301c814f390b2caa8672eb2d7dc3
- SHA512 3032cdcfc13527d9ba30ebb430dc8c8e2db3bca56fe881423ec5d64683ca7ceddb475793e0a7204ed93b7af1bd150bf20f0446a2b5b5573c4cd44675360d5c11
- TLSH
  T1CDE08609115DD3B505F155D4B141711167D27BCCF2C108CDB9E4CD185696E0E8077FB7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  Default Project/__pycache__/selfbot.cpython-314.pyc
- Size 46KB
- SHA256 c01ced3621ef468befd141c25527e296c953a30b972dac6d8e5deb9ceb61a55d
- MD5 f9f03f2fcb2772c60640d9df8d6884db
- SHA1 0460fcea968df2c30871221a597f696612295590
- SHA512 c320473d320caa139100fb6013476ca5663aa4ac7bc45ac05c34f88dec370f16cfa3be8cca44445457824b36c7f64db4f34d7b3ccbfb07e5c1bd9d73ce4a1373
- SSDEEP 384:urorj59qZIfgl2nvyalaDw/Gv4W/0AGgZNo53Zks21IF6gc8uXEuRr25feZkdT6A:uOQ6fglubkF0o0Zc8u3RqC6hWRH5A
- TLSH
  T1BD23B4B8B830A62BFDCDF67971D396A1273142027605D30BD13858BE7DE93458E9871E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Default Project/config.json
- Size 21B
- SHA256 f0a3c466026081d39e7358f5130cf7a8c7f0230bd63c24746fe4ee2104e6f640
- MD5 7858b2043b650bd7f5ddad771c828761
- SHA1 f37a30cbab6fb689efe7543c959a4ec25b6d4de5
- SHA512 751407a33aeb7be103ebd4a531623e509ec4358bb9fdec8ea74b2d5cb97e493cd9837dea0df9f1b456672b1d275895c70c7e41c469cc9225a8ff8b46c32482e8
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5
- Target
  Default Project/requirements.txt
- Size 41B
- SHA256 15af4c074bff4a0798078f01844f093119849fe61fd27cc395a9bf7391ee7ec2
- MD5 043ef83dd84ac8a2b24c739f61c5a6ee
- SHA1 517fd6642c82a07b744b60fc9778116d5bc3d634
- SHA512 1ed74cefe4db3bad7b039844a02f8098ff59a22f3eafd6b369f697cc981956f0ad3637f64837de0b048c8f25f11cac1d633c807c9902a9d1ebaa650065c643d2
- MD5 SHA1 SHA512
Score

1^/10
behavioral6
- Target
  Default Project/selfbot.py
- Size 23KB
- SHA256 65195e2bfe47a2ebf1ce0ce2cbaf67c6d17aeff07984785c0b587d2d3150db94
- MD5 736b6bce32d426c58702b6314ad7af4f
- SHA1 e17ce792de96c4da79ee86c180ca269ed4ff163e
- SHA512 9731713dbdd77c08bb0ed712069d66d2bd9fad00991bd325ade519ef094c036e1e203434edc129307155cbe761fb6434b040f83d413f4d0f9db1734c8b000a7c
- SSDEEP 192:A36Cq05FHQqrdUdGSx7BVZkdiocxld7DEKS8ZWd7PJXi2I2ed3lxIbq2fq/4gq+H:k6CquHbrmvZKzcxEPgRlxIW2gqT1Rwn
- TLSH
  T139B28259A9112820F383CD6B9097F5436B2E2E072E0D1569B5BDA1F84F64632C1FCEF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  __MACOSX/._Default Project
- Size 263B
- SHA256 8b3f91c10ed1e3ed43a188fecbf521bdeac6983256cf6ec50a0bcca5b1110036
- MD5 dea3a367f5b46752a82258eac80b4918
- SHA1 209f64d9768d702ba8b78d7049f3278dea82a55f
- SHA512 fdb34d455e90b2f18729445eb8143bdc0e38b07f64a6aab29a630b13dbadda7ea741a19a1d1cbc82ea50547356abc3a7030890f5c9056b8357af23b48b0e9c2b
- TLSH
  T107D02B68030092C0C537837812D26E10636448BAF2E71103775EC0440340A00BBB57BF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  __MACOSX/Default Project/.___pycache__
- Size 163B
- SHA256 19089fde276f3a827d0c10c22cc39a053a17117c79a353b91c739f681f32f5f1
- MD5 fcaea99cc37fc0095313b6a0e55cf3fd
- SHA1 33c797e28b1fb99c3b5cd390d947e36913d1b648
- SHA512 9a382f9db7e10d2abc02b1db9e2e1a44bbb75c93cf5f27cb7f4e7a682aa8f1920198631b8dcfbdc887699f334312907e4a66f356e606c24c6b148d96558b986b
- TLSH
  T1D2C012A41AC0C2B0C51840340BC73E16F3E45435E1B31522761D44880700220B79420A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  __MACOSX/Default Project/._config.json
- Size 163B
- SHA256 19089fde276f3a827d0c10c22cc39a053a17117c79a353b91c739f681f32f5f1
- MD5 fcaea99cc37fc0095313b6a0e55cf3fd
- SHA1 33c797e28b1fb99c3b5cd390d947e36913d1b648
- SHA512 9a382f9db7e10d2abc02b1db9e2e1a44bbb75c93cf5f27cb7f4e7a682aa8f1920198631b8dcfbdc887699f334312907e4a66f356e606c24c6b148d96558b986b
- TLSH
  T1D2C012A41AC0C2B0C51840340BC73E16F3E45435E1B31522761D44880700220B79420A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  __MACOSX/Default Project/._requirements.txt
- Size 163B
- SHA256 19089fde276f3a827d0c10c22cc39a053a17117c79a353b91c739f681f32f5f1
- MD5 fcaea99cc37fc0095313b6a0e55cf3fd
- SHA1 33c797e28b1fb99c3b5cd390d947e36913d1b648
- SHA512 9a382f9db7e10d2abc02b1db9e2e1a44bbb75c93cf5f27cb7f4e7a682aa8f1920198631b8dcfbdc887699f334312907e4a66f356e606c24c6b148d96558b986b
- TLSH
  T1D2C012A41AC0C2B0C51840340BC73E16F3E45435E1B31522761D44880700220B79420A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  __MACOSX/Default Project/._selfbot.py
- Size 163B
- SHA256 19089fde276f3a827d0c10c22cc39a053a17117c79a353b91c739f681f32f5f1
- MD5 fcaea99cc37fc0095313b6a0e55cf3fd
- SHA1 33c797e28b1fb99c3b5cd390d947e36913d1b648
- SHA512 9a382f9db7e10d2abc02b1db9e2e1a44bbb75c93cf5f27cb7f4e7a682aa8f1920198631b8dcfbdc887699f334312907e4a66f356e606c24c6b148d96558b986b
- TLSH
  T1D2C012A41AC0C2B0C51840340BC73E16F3E45435E1B31522761D44880700220B79420A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  __MACOSX/Default Project/__pycache__/._selfbot.cpython-314.pyc
- Size 163B
- SHA256 19089fde276f3a827d0c10c22cc39a053a17117c79a353b91c739f681f32f5f1
- MD5 fcaea99cc37fc0095313b6a0e55cf3fd
- SHA1 33c797e28b1fb99c3b5cd390d947e36913d1b648
- SHA512 9a382f9db7e10d2abc02b1db9e2e1a44bbb75c93cf5f27cb7f4e7a682aa8f1920198631b8dcfbdc887699f334312907e4a66f356e606c24c6b148d96558b986b
- TLSH
  T1D2C012A41AC0C2B0C51840340BC73E16F3E45435E1B31522761D44880700220B79420A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13