4bbe69107a3b443e4d60841dc193369142c9efae792b75bd4454df3024f435e0

Sharing

Copy URL Twitter E-mail

General

Target
exitLag-auto-signup-revamp.zip
Size 58.2MB
Sample260822-hadayasaqd
SHA256 4bbe69107a3b443e4d60841dc193369142c9efae792b75bd4454df3024f435e0
MD5 1b3c7f235f5ad76ee8f8fa043ec8b335
SHA1 a5291e0edff781e1c780101d5a10eabd6777e435
SHA512 4fc08854b710df5c22df3f8348bd760d8fff19ecfabc213455ab7d7474b9ba6e3cb312aff35d9c9c7f6f7953cb23c0e0e07ef45aea89e2576b6945839b02284d
SSDEEP 1572864:nNclq9JEpTAES/6SQwFsmmasZ6SVJtjjj3whpmWxHO65:nNkIEpTA/hQkSVjj3kMWZR5
TLSH
T180D73364E839F9B1A99D51E558BD2D2CF2FF80E13CC8C422347D3C86AFB91D40AC5A56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  exitLag-auto-signup-revamp.zip
- Size 58.2MB
- SHA256 4bbe69107a3b443e4d60841dc193369142c9efae792b75bd4454df3024f435e0
- MD5 1b3c7f235f5ad76ee8f8fa043ec8b335
- SHA1 a5291e0edff781e1c780101d5a10eabd6777e435
- SHA512 4fc08854b710df5c22df3f8348bd760d8fff19ecfabc213455ab7d7474b9ba6e3cb312aff35d9c9c7f6f7953cb23c0e0e07ef45aea89e2576b6945839b02284d
- SSDEEP 1572864:nNclq9JEpTAES/6SQwFsmmasZ6SVJtjjj3whpmWxHO65:nNkIEpTA/hQkSVjj3kMWZR5
- TLSH
  T180D73364E839F9B1A99D51E558BD2D2CF2FF80E13CC8C422347D3C86AFB91D40AC5A56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  lib/__pycache__/__init__.cpython-314.pyc
- Size 178B
- SHA256 6071ba5f83eb10b2e08972fbaec514aec992a49ed21cf0c1f913c74346934fc8
- MD5 65f3cc3874c04c4df9c082950433bc2c
- SHA1 ddc0f7ce5e596d46e45bdb734f4c0b265e40585e
- SHA512 7a249edfb56df2fcbd9dc05f5ed68cbd30ccb5059b6206486b9f8f363e41665e81f5eadb478ca68a676eeea787a1c8f71a7dd26de88dc654e27f37c9ac670eac
- TLSH
  T15EC08C966082D48BDCAB207172B3937EA6C9C9C960A89617732A359E3D6DD818DE1809
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lib/__pycache__/audit_monitor.dll
- Size 87KB
- SHA256 8fc5401dc165b3d5872a71275838d9c7644160c906e1e2397825ce3ee394d380
- MD5 0d34d7dad5eac62b98497f121ed477e7
- SHA1 48f5ca59b7b6267ae49f01956beb72c107dfce1f
- SHA512 f349ed3b8a5d321ab51ed68a19dbc40b15e729748c4ff236009cf6fb001fe6ba18d861ba793422c17eaeddda228c550a8e5830e26eb504bd3843391a18b5c315
- SSDEEP 1536:IJV03jwAEBukFVVg8hgkgaYYsS2vpeF1tU7xYYqKQ5:IJjxBzBg8hgkgDYsnvq1tUXq75
- TLSH
  T1F19302E9649A6EAFDD025036087987FAB5F0F5530BD14D737021CA32C63499E27B18BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  lib/__pycache__/cx_core.dll
- Size 4.7MB
- SHA256 546d0a489a6cf56b5afcd15b8ef52971c4ae2c8224fe42b8f80df2fd787c2ec0
- MD5 c986228239d7b392a08224ae9dc4ed8b
- SHA1 2dfd6a002ab382b7eb74d8293b2241a6d1eb2d11
- SHA512 9bf4b48188ea9842fc89f83cd63892d7ad8ee1586a302c3b61e57789c902ece756415a59d3459c9e1bfc78437df2b5718a0f0802d757d1e48838b72050972151
- SSDEEP 98304:Q/DhxRg3CDrT2AKAGvipl3BhC27/jkoFr9nqrefhOURn:Q/Dh/yCDrHKAGveDjkw9ncefD
- TLSH
  T1F43633DA64C96C87DD3902FF81614737127DFF12AF930387E431153A6661ED43AAB28A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  lib/__pycache__/cxcrypt32_helper.dll
- Size 6.1MB
- SHA256 f9ddd1ea4cc96238e8a1eb29e3890d648176e3391b89861a72c131824def9a14
- MD5 615ef545caebaf4062db06d1db83db5a
- SHA1 88ad344052244812d9ef6a126e04ba3c192035dc
- SHA512 c2216b772a7ca2ab6e47c8ac1456cd2c46c04d3dc0b3ab024ed0f66ac3d41bccd573c7ce571e0544afa3a8b81e0f6232d614d489e170b26c8b19b71c2c042715
- SSDEEP 98304:qG3WRRh2yVTX9cekLPAIKKqIKbDba0Fmp7BapUiX0rMsCU3pxfBpJjL65aJ:qGmR5+ekUIvqZfbXm4UdrjxZFJjea
- TLSH
  T1A756331D2AC1CD88C3AA06F4C31F94284459828EE4EBDB91A53E491F553395F6FEEE1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  lib/__pycache__/cxevtlog.dll
- Size 5.8MB
- SHA256 166f26c6096b1d20588726cdf0f3d2e0acb955b5946b0bffb949721eb3499f91
- MD5 dfdab551eb22e1411cb1668208d7779a
- SHA1 0b4041411a33fb6e351928dc0f9d846c2c694731
- SHA512 e828da567bb9a244a9303114dca82dc8a60393204be63e83970e7573d1bf19200e62b3062af067c21c22556a3f5975fae02a01c132a17fbace0a760573692307
- SSDEEP 98304:bMEA7YWX+vXifAC9pV2qSxs+L+5CtbAovwbOvi5oTKxeO5lfy4MC760YUA6SYnUB:bpAMWXszC+2IeCOooCvSoTXGgjC76007
- TLSH
  T1355633914BB47AFCF50CC8B30ABDA16A5FD0546979F7EE142B7230CBD6390532B6844A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  lib/__pycache__/cxmem_alloc.dll
- Size 7.4MB
- SHA256 35ef307f12f7b1f7871873315e1814262c6e4a476119f6351df496693ce3f64b
- MD5 5b10b7467d90d86f49216bafb2bd078b
- SHA1 9778e701d6a83426c1b563592a97fe74b85bcddf
- SHA512 a04011f28d633d3c7ebbe2a4803934fbd4574f8aaf5f971de4ab0150fdd4b314d4955f56f3a2e7fab464f66e33b695ccfac7bff8757f52d92099f2bd39a00f2a
- SSDEEP 196608:28I8uhkTA1QDIlZwpLSFz3mCMG6ukJlrzomfNbcUPW7:28Ivk0EIlZwpLyz2C/F2YG67
- TLSH
  T1E476335C0E8627DCF7D8D67E7A3129E9C1164A5481717A9E1E53B013AB002EBF83973E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14
- Target
  lib/__pycache__/cxreg_cache.dll
- Size 2.4MB
- SHA256 3f6c43d08c9a104d246e5c41c6b5ed61052d7fb8d82423f6452073777bd26714
- MD5 db74d810df20d7d740877e2ba543522f
- SHA1 5e2f5425599035c4fe765928751931c03abae8bf
- SHA512 35a4bef4e6a8ed2695907e909088b7c190c3254d931fad0b092c7c100b570e081974e7e7a65f59c92372a33796c0b7b8945cd894ffd4abec2a659270ad3cbb18
- SSDEEP 49152:0nfZlal38dC5SfFIoXFXJKKMumVMazqQPSusT0F7rHoDY1xnqv:GfDa9uUSft1I0aPi050E1t2
- TLSH
  T193C533AD24473EA6E87201B905E3FFCE3799F1BFA87D6BE8C35E283006CA4D58155511
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral15 behavioral16
- Target
  lib/__pycache__/cxwinsys.dll
- Size 75KB
- SHA256 f30383a8c565697c844a463530f0600ed5418038ee4c74f0fc90f10fe423cd7d
- MD5 44bf494d895cbd9d107e8ca31ace3dba
- SHA1 ec75d486934c586644040da77fa14d7cddd1d808
- SHA512 e5b91107e65061704b81f354af70424e2ae43df023480991d3ab737bf53984f6568fe3d9f9f9d38ebd9b07e784a87529a63ab9ee64798992a0babddb6d5ee825
- SSDEEP 1536:Nourt40a80OkKd2gfSLHKdFVkf2aoC71/YgU3rY:x90OkYn5+2M/YLbY
- TLSH
  T12373F1A076D654B9C61BC07A84F247FA9EF22842214676378B85F7364E315BDE3BD808
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  lib/__pycache__/d3dcompat_layer.dll
- Size 73KB
- SHA256 30fffd0ca1458bc1bf09bb4d708a1e8ebac4e8e32d9ce0c79a7c1a016f98b709
- MD5 d2e2e9242e033d8a3450ce1f87134900
- SHA1 cdcd715b3d0da9cb3ff33e4db5784c6fbdf0e2cc
- SHA512 2cc8e31568bb9654df89b8ecd9d1dc411fbf9d907eaabfe01e7cb838d22966f4f1e0052f4acabd1b99bd92f30850596a4640d8cb6557193017270afd2bfcbe11
- SSDEEP 1536:kkaCyjcZYJkoCqkFxgOiMSGTw0E9D0anYu2nWJZ6:COYnkTP7SGTyD0Vnm6
- TLSH
  T1C073020D3042AD9EC10A457106DA3B7FF1B17066961A5E7C0BE8DBB61CD3AFC4A7C898
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  lib/__pycache__/lib.cpython-314.pyc
- Size 2KB
- SHA256 f835506e8ef3520499c8bf99ee6e1f7dafba487b8a357875f22919238866c78a
- MD5 b43e525f0e6866f5d37a7a802b1fb0d5
- SHA1 f278c38f232339826aee993bc3a43921bcc3df2a
- SHA512 6b342cd135935b90058e7f079abf96cbd4450aa4e4b7e1b4a470e15f1f13f64570d244294595d0f4b662536ff65145ccd76672a77f2ece5145d0c6db90acc830
- TLSH
  T19A4195CDE3C91857FCE591F4A0E24CD9F753C8692140574B5479B0AE3CDF90A72A3611
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  lib/__pycache__/ntdll_bridge.dll
- Size 58KB
- SHA256 b172104eb60dbf1b194faee7d0cc1c197dd2b4fed7384a8d9c098a55eaff89c7
- MD5 f48d3c9ab9983589cc0fb5eb16abc274
- SHA1 4961f09b943a4e02933ad0b0a14b934ca20723fb
- SHA512 8feca874962763fe26f9d40cb8545dde415d24612bc8782f02823e16dd6f88100aa1db938380e311d1898564efc08d4fa794189e43a613563f965c62189ec84c
- SSDEEP 1536:zTJVzsghvzFOt0ahldOe3zr1an6qrub8r6RJ:PJVlhvzFEfZ3zr1a6qr48r0
- TLSH
  T14C43E11D221A45BEC917D338C1EB0BB6E767340155329B2E21A0E2363DF4DD5AB38946
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  lib/__pycache__/vcruntime_ext.dll
- Size 89KB
- SHA256 d67524a27b5a864e1bc06961631e09e1a516536c497b722e2e19977f9f3d2c42
- MD5 b92a6cafd1de4332987e9bbbc3723d84
- SHA1 02f4790cdd91ef6b2044067253b9d36879be35a3
- SHA512 ae95e7fe5732683480422c86ca7fe84aed8866b877ce467db18250655d18909fe3faa3647ec820eec9e7c4b0b0d9e2746fe34b922d788b32a547528e4b06162e
- SSDEEP 1536:NAWUEZz1jjzUTPpLKzL7Dpn1pVAFiLMbe+k8nqim0Ca:NHL1pjzULGB1BMbVkNU
- TLSH
  T1ED93F12EB2924C69C54B487E4AFD03BAD4B4B0121E2E8D3A6605F33E4CF451DA77D4AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  lib/lib.py
- Size 1KB
- SHA256 6d2fea1431643db80893944054bdbabbef30ac36ff25f93dababf28c59543844
- MD5 ed8c6394a8ae812f57f2bf036df07bbb
- SHA1 10fa198eebb17ff584db8ba993cfff0a24a9290f
- SHA512 b7c14d4971f5fc3efc90ebf50504bd6a8c668594744aede5c7f93df9e9a23c08356fba28acf9b4e1ad645deb6df7bb2fd175f4dbd1e54ea5ee52dc3dfbe54c40
- TLSH
  T129311F8CE2C72C12D2B5C3AC8144E082FBACEC2B560E0636B8BC90983F87C1D55136D0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  lib/windows_ui_lab.py
- Size 18KB
- SHA256 c78ff7a9f36323887051dab2b70afe940cd1361e51361a779c67adf539490528
- MD5 1c6762a7a23ec6e8a94751ff7dfa803d
- SHA1 ed8e31f1febce35c76d634b8d455bffbd4651117
- SHA512 30a7c6283aa2b9992c3c890e6518a70bd82003fa824d3fe5cfd52371f2901a9306a255d374530a0c90343d457f0f6e4843bde875061d51472320ee42041c52f8
- SSDEEP 192:sy/B5bXmJeZQ0D/GVvjnDc/Ua7AFSTuTExGN7MST1:syseZZuVvPcsasFSSYxGNISJ
- TLSH
  T1B98233118814942392A3C52D1F63B2836227BE639E491935BDFCA2503FD9537C6F3DEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  mainrev.exe
- Size 31.5MB
- SHA256 1e8785e7959aab74e757171ffbf5873fb2ef93afe497cecfd370037e2a02f79b
- MD5 e694a1855b8ab73148eefe1eb433af66
- SHA1 9514ec898be61a85b8612bed9c3cf1ad837909a1
- SHA512 c9a045042e70f2d5e6f1f42aceaf00caa8f7c9a9405bf7fabca68685df3cf001965b5541e4f7671559de260ba55346908d4a54fb821e7149c2b4e2205f99eabf
- SSDEEP 786432:hQfCKyhZWr8aoYhjGxhssHaLLGF5FueHqRWacZ:hQfCKyhYr/VMhBaLLQ/Hq
- TLSH
  T13177331858F09076F47D907DC90D6959BAFA74A30A49881B39BAF4C1BF3E1E0A472F17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32