713d197bd20f2485806597ed43f12d703dcc18be82374f8fd9cefc0766ddb4e4

Sharing

Copy URL Twitter E-mail

General

Target
rebooted_crack(1).zip
Size 38.3MB
Sample260815-cdhryawhpe
SHA256 713d197bd20f2485806597ed43f12d703dcc18be82374f8fd9cefc0766ddb4e4
MD5 9b781f7742252c947c460a0c2f9a5dd2
SHA1 e87d5a184cba055304c7f60e397fbdb6dbae8cc3
SHA512 d5bf08944b7486d9f3fe69e5ab9aa29dfa1bebbead04fe16f67a804008ceb905d5b99a6a31b37a83974f4665c819b67f432e64073cff9e9c6c5142c11dd3ebeb
SSDEEP 786432:jQoqWmrqugUBvPYFsxAKmr/bQVdbAjV7nuXgUG321Tlv+O29PBBJNZx:jQVquzPYF57/sHbAjxuXXI29lvD295BP
TLSH
T1719733D4A92BCAC5D4676BA126FE21DA8AFD1712CAE0E7485F9BD0155CF1C20333CB49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  rebooted_crack(1).zip
- Size 38.3MB
- SHA256 713d197bd20f2485806597ed43f12d703dcc18be82374f8fd9cefc0766ddb4e4
- MD5 9b781f7742252c947c460a0c2f9a5dd2
- SHA1 e87d5a184cba055304c7f60e397fbdb6dbae8cc3
- SHA512 d5bf08944b7486d9f3fe69e5ab9aa29dfa1bebbead04fe16f67a804008ceb905d5b99a6a31b37a83974f4665c819b67f432e64073cff9e9c6c5142c11dd3ebeb
- SSDEEP 786432:jQoqWmrqugUBvPYFsxAKmr/bQVdbAjV7nuXgUG321Tlv+O29PBBJNZx:jQVquzPYF57/sHbAjxuXXI29lvD295BP
- TLSH
  T1719733D4A92BCAC5D4676BA126FE21DA8AFD1712CAE0E7485F9BD0155CF1C20333CB49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  rebooted_crack(1)/LAUNCHER.bat.txt
- Size 393B
- SHA256 00c0f5856b30a76be23c5af9053280b2025d6ed62e33d3b599733ce6b6d830f1
- MD5 4227591794b4f124d4b9526ffb068515
- SHA1 2a3a865ead848210aff105619c51ed6c6bfa06b6
- SHA512 320a8d32f18e936f045fc3a6cf86fe039ea70b2bc534267671c8906d2d897b809151e9f7f26c232ad43a592ae7bbc31dbce5b98ff9ebbd37879e482c090c5010
- TLSH
  T1BFE0F10126EA03BF8334E541C15821A5ED5C634B301844DA32A1A1743B05580C7F4CCC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  rebooted_crack(1)/LAUNCHER.ps1
- Size 4KB
- SHA256 c6bc91613bfdcebd8f1b46871a4f3bce0639bfe4a0438f1452e156778c90140a
- MD5 a835b3ea37f73108673ef30fef2ec6c5
- SHA1 531db6db8009af8a3dce954a1a730636daa8e700
- SHA512 4ee80883c61d08dd176148afe323d23936c6bba6d92b2093affd782f6f5a212a1c1c3ec2d39860047ceab09cc18483ea548f8bec16929421c962b7e6068134d4
- SSDEEP 96:aNmi3mPELpcET9NpIxBH8TC38zM2UJ8zr:Pi34EdcWIXH8FUJO
- TLSH
  T126A12135F105250E85F6169E0502B26CFC96C07752CB09C4B15C82AABBF6BAE4B36DB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence privilege_escalation
- Drops file in Drivers directory
behavioral5 behavioral6
- Target
  rebooted_crack(1)/REBOOTEDSPOOFER.exe
- Size 43.0MB
- SHA256 702a9a60b898192ca046399b9ec0a3ff17c3126e5a030c691ffa0bc271b90eee
- MD5 02cb99b7a27d1dd6c44d7402749a723f
- SHA1 7665693b3a690c2c8d215f6adab45bdbe66f1a53
- SHA512 f9a500a1c6431ecfbdf2f1854b5d0338304eb881bb1bdabeb43cbabcb247385360e2fdd5a9a3fdddd3f854f04e25918b785440d7d91269d12f92141fe3ed3115
- SSDEEP 786432:k615BMqw6B5LSzSzYo6FvR8VhFyLXLJej8aCmaoWLVFw0TwL7TuhyJ2u56v:ZMqtLSzpfvmrFyLtejLCma5ZF3MLfuhZ
- TLSH
  T175A723DB2AEA52ECD4C34B8057CF22DA51C1B53A85AD986D2FCB2C031530DBBD549A37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  rebooted_crack(1)/keyauth_emulator.py
- Size 8KB
- SHA256 59c5c29a5f0ee23f7d8ec335ecaaec39cae50d1f92c91cee0f97e937b627f294
- MD5 f2fa32852f88e3256cea57aae1ea39e0
- SHA1 1b3833350869167a8c1adb4725042ec96b064983
- SHA512 f1ea6dafd29a58b1c2f1c39d38b7cb422f4277b95b95c6091bc5346c124429fc338dfea6c9522e0a0a2ea3e82e3c8fd6e50cb1ad04c7afb000c355a5190f80e9
- SSDEEP 192:a6IcZ10/mLKt0TVOQiy82V2sGS1TDSRgJmFcFBpO/ueh6f568kEVwoxImbUdR:pIA1IIXRo61TDSRgJmFcnfjMmbSR
- TLSH
  T1890245269D05541701738B9ED41BA882F71E56073368A81B793C8BD81FF8C2295F6FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  rebooted_crack(1)/server.crt
- Size 1KB
- SHA256 3a5252e6652f1a379b34d409097352608d1f0737e888a4f450243290ce727e27
- MD5 33d52c49d8cccfedbe8f59dcbbbff941
- SHA1 59db2b186822a7e5180c2817499dac754889e296
- SHA512 5788c8e298fb13d308f81bc4462ff5c10e7601155cb4f987e3b5795462acc3b2cb00f9862b15b482ee9453028c94d17e3d92ef3fbfe9098d54eccb4bbf15d588
- TLSH
  T17721E75E4EB12A48989AF42B8AEB9250CEFCFCF181AC44C440189503B59D91C32EE846
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral13 behavioral14
- Target
  rebooted_crack(1)/server.key
- Size 1KB
- SHA256 2b9ff7a06f3667f8690f32831ce4f2fd75c1b3fb98a9b97acd93c4e787d68794
- MD5 7e0851e93ad4dad949c7d3a06d1fa7ac
- SHA1 e325543c61d89ccbf249dcb64ba68b06520da45c
- SHA512 7597efcf3217f1f3ba598219c415e6abd7216b25a0b3d347c7c4aed2dcdf09c684fdff78b5c4f07f9303184561564393f5ee2a793fa3f1d2d2af063562646ca0
- TLSH
  T19131FA392DF095EDCEECE0738697332E5A79F7380184A4648133B8A2A179F28686D951
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  rebooted_crack(1)/server.pfx
- Size 2KB
- SHA256 a86c438032f56d49abd2e3b066b515ae5a67247fb1207a0d2ef0089d8598e10c
- MD5 b34f60fe3a20b7ba0e1fc020850eb6fd
- SHA1 47f3c19591fff5def64df24106b7d315c0def06d
- SHA512 f1db1a616caa2f2e207951fcf550bebebf35d0344d02d655aa53310cc959cf5c078bea5e4649c87e76b4f3c073dc1033d1a0e17695ea22ecac3306c46d3fccc3
- TLSH
  T1F6513A3B5EF710B9F932CFC65C3D4AC248A2CFE33E348A8F161550E04D46825A4E8927
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16 behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17