96e4ef399e57dadf1fe9b79406a25ab584c23dfc18d49cddfb677273c0984345

Sharing

Copy URL Twitter E-mail

General

Target
Installer.zip
Size 8.9MB
Sample260825-rbttrazvg1
SHA256 96e4ef399e57dadf1fe9b79406a25ab584c23dfc18d49cddfb677273c0984345
MD5 76c8689f9e894f0fc4befc2230d62696
SHA1 26cef978e6ddc2f57bf17f25b0c0daf28967fd8e
SHA512 1fdc4789749abc1224fecb2fe35d58fc5dadfce5677e67cd75aa592ee0c889d75f7324dd8ff0b31916300436cf266ea3227e8de0f18fe6eda6968d1ac9eb6a49
SSDEEP 196608:JT8ikPiW2kZsrUvYvl99OaVRyD7s7PRxxPhb:d8l1/Jgl9M1PmL/
TLSH
T13496330E92E77E9C214A2F3D4FCFAA80B045F111E5D9725C1BFE96048FF91ED8606A61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Installer.zip
- Size 8.9MB
- SHA256 96e4ef399e57dadf1fe9b79406a25ab584c23dfc18d49cddfb677273c0984345
- MD5 76c8689f9e894f0fc4befc2230d62696
- SHA1 26cef978e6ddc2f57bf17f25b0c0daf28967fd8e
- SHA512 1fdc4789749abc1224fecb2fe35d58fc5dadfce5677e67cd75aa592ee0c889d75f7324dd8ff0b31916300436cf266ea3227e8de0f18fe6eda6968d1ac9eb6a49
- SSDEEP 196608:JT8ikPiW2kZsrUvYvl99OaVRyD7s7PRxxPhb:d8l1/Jgl9M1PmL/
- TLSH
  T13496330E92E77E9C214A2F3D4FCFAA80B045F111E5D9725C1BFE96048FF91ED8606A61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Installer/!!!README!!!.txt
- Size 2KB
- SHA256 4183e28e3a081910a7e002c2ae044143e0fff18cefae5334ea7227f4a6014596
- MD5 f48ea165dff168150cac7db08cedfbcf
- SHA1 7d9cc93e2fe5c0721bdd05a260f2ce522f137cd6
- SHA512 87cccfb5afc02b48f1bd93c4cd93281144d9fead3706bcc0559aec75f98559566bc1badda383b89f07874a94ab4cd3bdf785e7c931a62bb7ad31ee1e4e71cd0d
- TLSH
  T131511A5EFFDBAAB39041DA112B1ED6A2C20D516CAA470B101A5450BC36A06B379FA4E6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Installer/ALI213.ini
- Size 2KB
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH
  T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  Installer/DW/README.txt
- Size 544B
- SHA256 7f022910960d0b0b59a8c34cc6aa8ef2ab6b3812556edbff37c705ae84f9e7b3
- MD5 cfaa8fa0af14238d62ad14cb3d6f9a98
- SHA1 4ef6bf9018c513f6a1f1c950e77b75aceb1709d4
- SHA512 e087d62af3569ac6cd6b02b843e4d3281a04fd9dc2e2f540c67a436ef99c8c14071945eca3b0fa87fa4dc38125d8f966d649a39c339f7d96efef1c45826686c4
- TLSH
  T173F08B0EEFCFA6B21501E7926B4DD953D208A43C93618DF45835217C61703B46AED6F9
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  Installer/DW/dw.exe
- Size 3.6MB
- SHA256 56e25bff1587bb278f048a1ae5f74e2286946f1cbaf59aaa03d3cea070a462ae
- MD5 c503cb2ca43594f1ac72d5c9c3b9bc27
- SHA1 67a9b5a371f806be8e8009bc37153165e42f7b23
- SHA512 a655b257a8bcd3ecbc56f11573320bd2024a4f1842e2b1223997b146c703d38fa1b864a07373fd20f2b0e3b3bc6a3032232df1d3fe6d689d62c991724de8c699
- SSDEEP 49152:sYxgaLCN+0v/2rdPm/jUJu75vfX7WMsf1SgibezD1BT:cNc+U
- TLSH
  T114062707389411E0C8EB9A35E1BA1262AB247C8DC73473E36E5167702F667C13EF9B59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery spyware stealer
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral10 behavioral9
- Target
  Installer/Installer.exe
- Size 3.5MB
- SHA256 5e1c98cddce4b990947d12476ececc3703bc593fe503c55050b0b6cd299f3c23
- MD5 2868086a4034f2fcf8f54780fdf95c46
- SHA1 0148b1c5365dfe5cfd033ece2890e626ce9a3c2e
- SHA512 48f262479065c7b75d3870561a6788e8f7e4d3457dad399887baadff4ad3891493e1ee72e9295d58868ae6d4b06ec989ea27684f96081bd6b91fcdbb212f7b33
- SSDEEP 49152:umxZogJTDW3kj1A/r7GV5NGUcUnufCP0ZwY/D2oEI0nXO3bgwGQj9mC5ND1p8tk/:uSTaGjNGUc7CP0//REI0nXc0r2
- TLSH
  T1DE06190B3885B060D49A4D31A13A51627B207CADC33C27AB6E91D6B51F767C22E7BF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery spyware stealer
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral11 behavioral12
- Target
  Installer/Serilg.dll
- Size 125KB
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH
  T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Installer/SystemEx.dll
- Size 23KB
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH
  T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Installer/config.jet
- Size 697B
- SHA256 7ab308abac85601d348005bbb7032c92261fa25c782a712f1b0482bd85845ede
- MD5 53a9cdbb5470cba6ec4fbafdf7ac618c
- SHA1 dd8600c6f92b975ce54f300ac854abbdddb96559
- SHA512 c501cf9bbce1186e42352612d60c1f41699c0e297bfa93a6a91ad586b8f09fcd81b00b67ca1cc52a80a227d29750739ec56a8b494fe3f679ffca0c797ccec02f
- TLSH
  T1CD0176308A7D243C430CCEAC3D62EB5AAA7C020F5784C41FD56D8EED1BC00A159D7352
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Installer/data/ALI213.ini
- Size 2KB
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH
  T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral19 behavioral20
- Target
  Installer/localdata/Serilg.dll
- Size 125KB
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH
  T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Installer/localdata/SystemEx.dll
- Size 23KB
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH
  T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Installer/localdata/bin/shellext.dll.mui
- Size 3KB
- SHA256 965d0e8e10aa6b54143ee53fdddab4d741c6d98d25d98178b952ce59525fc38f
- MD5 efc6c0bdcfcc4855ffaa417c21dd974c
- SHA1 09ba48ecfb36e41e5c6cd15a26f2107b5a306e4e
- SHA512 2a69e0bf20ab668397a6d1bdeb4dff03156360eff00dec42b898e03174509de8ac05adc384db129a17e05d6d3f84b4fa82fc93331b37dce83ffd8527138c6456
- TLSH
  T1AC71A10F9BBB4117F0A65B304BE745C227BD7E137392A56FCF0A142924641386A90FF2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25
- Target
  Installer/localdata/dll/libasset32.dll
- Size 8.8MB
- SHA256 c127f79b4996890a01986f88b4e2076ff7cdb8b6de01092c548b3f28aeda35dd
- MD5 ec1498f406642076468424ef2f45c452
- SHA1 4ab87728753c802273ad96f5567ecabfe1274465
- SHA512 df23385529ccf209478ab64756971e242caeb6c9157605bfc4c8b77bbc8af588f54c90b9fd3814372dd7f226edffb4425516eba296881ef5230bb5a9d591f60a
- SSDEEP 196608:4L7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wKl3bc2EeJUO9WLcb0T:ylOJDm1Lrc2EeJUO9WLcbU
- TLSH
  T1CF963951EA8B58F5EE936B70818BE33F5738AE10C532EFB7EB08D529A8335C21905751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  Installer/localdata/dll/mfc140.dll
- Size 5.5MB
- SHA256 5e62691bf7275652019073c2d41f3ac50116f4dca4b73d52aed4708cc557627a
- MD5 5e9c970ad0b02973bb082349a051e14a
- SHA1 294efe32d7585a434c48876b6a82061054ace070
- SHA512 e1b287b3a818b6304d37e5e8265a5779e39ead3985f0edbd95ec427152901bca3fdb473c80ccdaadd4f381f3e47aa88707f6924e40bcad908f18a314c6a33168
- SSDEEP 49152:9D4hn6nlxf/48dzk70ogp4HjGXSBG378h/1Qs0Fz0+vULJCuSwIbFLOAkGy3zdnk:zKTWULYFLOAkGkzdnEVomFHKnPU
- TLSH
  T10F467D46BBAC4494C566D07A866F8E4BD3B3FC50273157CB0026679E9F337E24A39272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses Microsoft Outlook profiles

Checks installed software on the system

Looks up external IP address via web service

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses Microsoft Outlook profiles

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29