76d802cde25690c984c25cdba4786f57f79925026111e0ac657125a08e61e637

Sharing

Copy URL Twitter E-mail

General

Target
Cosmic.rar
Size 204.9MB
Sample260814-lhm2wsgh35
SHA256 76d802cde25690c984c25cdba4786f57f79925026111e0ac657125a08e61e637
MD5 717b07da1d096c0b0181834452e5453d
SHA1 b00699464a12c09546dfb36b34026405d9b0c704
SHA512 5092b86aa87f8321d0ad2beca44a199bb04281ab7e63d4ea37ba7304d77bac919add4f510450670366316f52c299e2b68641105fb3b075bb8f63677b93f24b51
SSDEEP 6291456:ulwS/Dy3qEjo4vx8Wp48AOR/YS1AZaheWpdCTQ9pN:ufDYVxJAAcWpY0
TLSH
T117A8334AB52BF1AB488E0C4FB1EFA15A8E9042F7E834287E7E564DC054961F3A747137
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  332313/UI.exe
- Size 16.8MB
- SHA256 d182e90cd23d0a49c09714cc354de34f9ae73673a8cfd3d1be2219f0d7a9bd38
- MD5 c47650ae80ea6f01b31c5e66be2a79f4
- SHA1 ef487390ae03b7288c94e6eb74b60a5ebed3d35d
- SHA512 6bfa5840bc413a97202094decd99d456f8b6c416c4d0ff6ab009fae28c9047b74459f9ce4cdda539cd6180a10d03cdeba96d373035832a805b3535edd1ff3a71
- SSDEEP 393216:P7AsyOLF2xBsuphiF0cSU+uPaayFsmkTe:P7AsyOLF2xBsuphiF5SU+uyDsmH
- TLSH
  T17A0718257B5A996CD19BC47483478AA20A7030DB0F39B9FF548596383F79BF46F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  332313/bin/Injector.exe
- Size 15.9MB
- SHA256 5be1c4f31ff25fe4b07942e2b1e3751049f9dbc50986fbe437fb0a4fbbf5ccf8
- MD5 4b585b56457400e92bfa71ad8bc99f0e
- SHA1 9919070a5ceaa9d5f70754f101a17fe3024f2253
- SHA512 d4b080a1ecacbe5ed6fb87a4fc5fe5d561868e769c3cf0f2e901ba6796ce07e18acb222c435c6df9bbd6965eebaf90563fe10b36e5e85e7332e6941bcc66a8c6
- SSDEEP 196608:/awnrzZtTMia3xV0f7a+j2Dzz3DRoPwQBqFJ9DLEcBnuCs5pzjL388n5nK:Xn/Zt9a3xe7R2DzzCIE0unp3Jn5
- TLSH
  T133F68DE730E3A6DDC506C5BB8352FD7FCA8FB13A051AE8A3A218B1159E27C507614F19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery themida
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral3 behavioral4
- Target
  332313/bin/SecureEngineSDK64.dll
- Size 28KB
- SHA256 a989c8bcb5f111fa6a2e538c4c79c62be515f1713b2310cb9f60c58d6536166b
- MD5 92ff442bee98d2df4c2bbc2e8a3e019f
- SHA1 95c7637bbfc6c1ba583068769589c7ffc5a0955b
- SHA512 9949f6e7eab3e2fd14f276ee0fac83ddfc2be40ca668c15f0c3e897bd3e7517fad04e8966d022c1efa8605cc14629d71943af1eff9aed1633206d64feede14dd
- SSDEEP 192:I+Ai08s5GvuxBdKKCeotPpWZlNCryWlHqX5xS5haBWUcSAfMVIBizxUv:I+AdZxBnCeqPpWZglsfSgA0V
- TLSH
  T1DCD2ABAF05B56EFFFC0D0CF4058F3A9822C3F7D22DE48669276E458541EA81B651F289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  332313/bin/lsp/lsp.exe
- Size 11.1MB
- SHA256 911203eb5acaaade326eec106b48824f64881269c85513fdb30e6455d9e6d721
- MD5 f8c9f2f036ac7c6e8d100834b5c49ee6
- SHA1 421a756eb507ab22a3e5c714231c2a5d7d22f2e9
- SHA512 6c0ba341633e3b362beabc140d73c88dde88c9d716f80e88d2164fd38e6ed826473e0aeb450a735f402963e196fdc974d3adfb9d643844b8a576a7d01a5d268e
- SSDEEP 98304:VKETtoj3FI6XomceAPRHB7YABv0xn+QW0WHk:cCSjFIWXAu0QW0
- TLSH
  T147C66D77229C01D8E0BBC07D8BCB9E93DBB2340903719AEF05A045565E5BEE95F3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  332313/cracked-version-d584fb6c717a43d9/Module.dll
- Size 6.0MB
- SHA256 204fad9ea15e3359f3b4e1a7b4d549952b90800d698030126e46e158a2f1128a
- MD5 3c003c36eba98291c2d75aaddf020f60
- SHA1 c10e920e874861f4a34586076daec11b3bc5ac87
- SHA512 ed60330e42002ef745f2f506b31b3bfc978ed1429904c3669d1f07e8ea9cac8e9cebb14814536302b79be5cc1dd0dc9917aa533468987a9d089b97f60b458ea8
- SSDEEP 98304:ttKWa/1sov7v4MX7hu7g0bGAjlUeCtygTL:fKWaHv7v4MX7hu7xbGFjL
- TLSH
  T14A569D66B3A102A8D93BD1388B53CB13FBB1B454133197DF16D0469A5EA77E02E7E390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  332313/cracked-version-d584fb6c717a43d9/RobloxPlayerBeta.dll
- Size 18.7MB
- SHA256 76d0be8d9a54e665e8ac577cc46dd7650199c5c4c0e519e3eb7a493704d095f3
- MD5 27944446b8aba263df91b496302fb5a8
- SHA1 325e59923577c5731840b5fc95665012516e7226
- SHA512 bbe8b8532f4d975e887e5eea17a40954591691a65c08f60ed06a73f4ef81ff3c6b34be2e2d579b14b64c994d97f57841deb1b852992bc562ebe57df70e89c42e
- SSDEEP 393216:AOVLiawKuVXlKEbWe68j0aUygLBmQ4a2Wc1DA0Z:ASNtu3d8ygp3chAg
- TLSH
  T14A17F1BDE68157C5CA156CF991DF3DE6B3C0393C8F2AE4715E1E8286A370110AF64E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral11 behavioral12
- Target
  332313/cracked-version-d584fb6c717a43d9/RobloxPlayerBeta.exe
- Size 134.1MB
- SHA256 46c0e6bc67f78d2898616702d270ad4625a6bdf3fb0afbafe4e6c4af0a2981bd
- MD5 4269ed3be8123ff251761dc24a745a53
- SHA1 4c0917518fedda9a3ebcbdadacc61d7a02de54f8
- SHA512 fa0af08fd4d84e6f56a13bb6c232e0c47216461b01dec78a7393756dfd72200d8e5413ccad8c18901c431b2087756f58f2e088b5933fcc00190500934a66265b
- SSDEEP 786432:vyHPnU7Yx0R86STjQM64HS8o41xFm0qHDivNvrynj8M/dKYxc5hieP+ygFjD8I:Inxt6STjxS47qHDiFvOnFjxc56BD
- TLSH
  T10068BF9AB2B940E4D17AD078DA1BD913F7B13804033097EB06E45A5A2F77AE45F7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral13 behavioral14
- Target
  332313/cracked-version-d584fb6c717a43d9/_RobloxPlayerBeta.dll
- Size 18.7MB
- SHA256 76d0be8d9a54e665e8ac577cc46dd7650199c5c4c0e519e3eb7a493704d095f3
- MD5 27944446b8aba263df91b496302fb5a8
- SHA1 325e59923577c5731840b5fc95665012516e7226
- SHA512 bbe8b8532f4d975e887e5eea17a40954591691a65c08f60ed06a73f4ef81ff3c6b34be2e2d579b14b64c994d97f57841deb1b852992bc562ebe57df70e89c42e
- SSDEEP 393216:AOVLiawKuVXlKEbWe68j0aUygLBmQ4a2Wc1DA0Z:ASNtu3d8ygp3chAg
- TLSH
  T14A17F1BDE68157C5CA156CF991DF3DE6B3C0393C8F2AE4715E1E8286A370110AF64E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral15 behavioral16
- Target
  332313/cracked-version-d584fb6c717a43d9/_RobloxPlayerBeta.exe
- Size 131.0MB
- SHA256 bf384c9f880f4ef1073a3853656adf487f45a499453eec4ace3b4874409cadfc
- MD5 1689587c6587ca3c48757b2899b5c1a0
- SHA1 72dede910f7b1ad2f62295e9bca4d1bf5d3fce43
- SHA512 daa0ba7d3dec17cb1ae48f83115271b368722942b8e66e1440f674d7bc21e6b4ff19048bfa84bc81b4a01dbed558d9103b2ab549db31a29e0b731775c870b85e
- SSDEEP 3145728:Tf9GW2wGUzg/sQGcQwxyqvzRGnxr4m4yfVI+jx+6Bd:b9Grbxk1wxyqvkr4QfV/Q6T
- TLSH
  T1D86802E2F7259AD2D5028D369D5A41C07731ECB04A53E38B36E8720E9D6E1CD8F67A70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Network Share Discovery

Discovers running processes

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18