Extracted

Extracted

Extracted

• • Target
    Guns.lol viewbot.zip
  • Size 71.0MB
  • SHA256 fb51773f5483122bcd41514dcfbc1e193c9a1bb9f3c58e65511fe72340325ea4
  • MD5 9cb57765a19cc59045305b8773f71ae7
  • SHA1 7f5520468efb6b47971d150af98c72f4e35efff0
  • SHA512 ec26479a4f6a6b0b93b2e7a483a1c10155d0eac6daf56cec22e3d59b0595197e68b5bb471a8ec8d0975697933444a87c439a1436ab762676cace375616379bde
  • SSDEEP 1572864:J0IwT62Oejptj4PhYqEMnfvWuPUI4MAXhFhaqMUM1dima6:XCvtjuTlnfvWyARFYfPdimL
  • TLSH
    T1CCF733B801CAFE947C1648731AD8F4DAC538CB4F82539B1D6F60AF42D672B91B65206F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Guns.lol viewbot/Guns.lol viewbot/Guns.lol viewbot 2.34.exe
  • Size 71.0MB
  • SHA256 e710c578b7c63c76ced706dfbc4fe4c4d5b75bcde9b15943095a7266abec697d
  • MD5 9707da370a6e655dcaf2aae722eadede
  • SHA1 c28dca97d7a55bf94d50cdff640c7ca0f60dc07f
  • SHA512 2d18e719acbaeab554fed5cf7eedfdf4ad8474e136bd3ad26d4e9593a1063f039de1b26cb285a8e2db817dd711fc8ae59f13d6a945ec5c3b8317772a1bd30556
  • SSDEEP 1572864:gEigCtE+Ws9EgvCt/s2yQJrfMS7MsCYU515ZU0uiG1Hms8:ggIygv2fBJrfMGUz5uV1Hms
  • TLSH
    T15CF733A800EBBAD5FC1A987349D5F0CF8634D60F81539B197E709E8692717D1FA8206F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionoverlordxmrigminerpersistenceratupx

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4
• • Target
    Guns.lol viewbot/Guns.lol viewbot/readme.txt
  • Size 305B
  • SHA256 7b52be2cd7f3d6039b315b6a2a0ef7422bcd6b2f06dae210d377f743afa4e989
  • MD5 14a10ad17bdffc90b4ac0e95e9120953
  • SHA1 f89b83f7b445a86757fa75e12bd791720ade1e5a
  • SHA512 ceb4c45dc5e66741ebfc93b5c18902575d2e9115cd8eb194ba1b6552e55ca34b4db4ddad11bcc333ec0225b185618088ef6f51cd9aa14d84bdd07e991407a047
  • TLSH
    T1F2E02B386C88E37B02A88AA3764838C6F3C4702CC6704781845162392677F2885BE58D
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral5behavioral6