3abd1ce4486409986945cc5a0944f765fe56954880b75bb365ac99ee2e420634

Sharing

Copy URL Twitter E-mail

General

Target
Cythosia Botnet v2.rar
Size 3.3MB
Sample260912-xxe6davycs
SHA256 3abd1ce4486409986945cc5a0944f765fe56954880b75bb365ac99ee2e420634
MD5 e5abe023ece56c1111b2494a55cd6e58
SHA1 133dce9eff644495bd6cc6b16fc4d6e6c0d3eca0
SHA512 60ba9318f23b61d168445f9dfb973dada2a4000aee09b3edb9972b90bf90a2d5a854ccd5bce0bccb2b6142cbb4b3f210ecfd3f95d8de47e50911c27ddf488d28
SSDEEP 49152:fILcmOe92sEuQ8REm60UMlYm5yK1FT87AgUoo1Y37TptzV9EpgJbrSLG5JBFQZ:fILWt3uQ8imTHP/39q33nE6Jf3FQZ
TLSH
T15CF533555E78B4BE695AC7E5D38786237C2B3AD40730A8631B37ABE414420B39E7123F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  Cythosia Botnet v2/CythBuilder.exe
- Size 45KB
- SHA256 98db9db0de1283d119a4e1319b39e4164a51854fcc1a463b1cd5a00336dc7c63
- MD5 60252b0565a60abfef9dec2e20dd9629
- SHA1 7db54ce54f5ecb59253f59cff9de9ccd2b91d516
- SHA512 189991dfd75022b96fb14996c656db433b42e8fb0b9eaa129b9da9b99b836bc5c033fb1d8200ec501e65e46824cb1944d26f3ae5259bf8cd3f236bc35f413b61
- SSDEEP 768:rDsBjyIelZ2761wzO8P037fwWU7qrR52Yo2GRKURZ:sZve7Gi20zE7qrR5HyKURZ
- TLSH
  T1B6239712738B5B32C9641DB0C0FB152513F1ABCF1637EA953F4D228D8A533939E6DA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Cythosia Botnet v2/Eazfuscator/AG.Configuration.SettingsProviders.dll
- Size 18KB
- SHA256 c36719a71a4305c588f7d13cc0e9b69d77b8020570beedfe00df7e83dba9733a
- MD5 7936d33b7f050ff8792d90a763bafbc9
- SHA1 02a107d7fd21130232bb35364c539d6ae3a7302a
- SHA512 6486770dd4ca5dbe9aa6dc27dc62f5fe6fa8a50a570ba29341c8c68c94562d0b8ce178ebcf92221409b89c2b9ede23f8bea2d050f9aff48b0479de6cfce8024f
- SSDEEP 384:cHC1YbBQUzYeoDycSVyt1HRyyLHa+WEh69r1pcl/9u16CaO90VwxCuY/iAxFh52:wpAfBWw9Xfux23HO
- TLSH
  T15082391C8388CB2FE59D5BB8656A090023B5C3569467F7966DC5213E2CAB7B017232BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Cythosia Botnet v2/Eazfuscator/AG.Deployment.Updating.dll
- Size 105KB
- SHA256 70b2ee5039a10647a14f60c6a6191c450f1646a11c2dafaf0e47a4cb3664bfac
- MD5 bbd2ae604e6b416519482408172b3c60
- SHA1 c20ad8b1e57a418803dbaf9b868e2e5cf5c9e00e
- SHA512 686f474fb7f20a7d03ce7b0823952ba84cc7a4e04e424a951b4576d303b13a25b2c249092794b56634c054e30ff16dc0a2218bb39950f6189b15cc73ebe1b209
- SSDEEP 3072:PpWh8KETWwNeQNVHkp7aoyuiSTKwc8+56f0:Ah8KU9J5JrYcT
- TLSH
  T168B3F050B659FA7FCA4D0AB660D317624731CEB3B341CB6A9C45349E1E89340A721AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Cythosia Botnet v2/Eazfuscator/AG.Eazfuscator.NET.Hosting.x86.exe
- Size 9KB
- SHA256 2556ad590eeabfb0ff046089b8cc2c3ab528befc72e53f4bbe9cfc3bb5c455d9
- MD5 5e7df16a2bb078c4faf1356ac487a9de
- SHA1 001d866c98b97db2e915630a0e0649c95b56efe7
- SHA512 b0f3a2946e075f44e70a03641bbfb55b745a490caea92070b75b7852de65ea60a344352efa13106d8e355472b4aa230572a6c44c384af4c41c89dc6c4dae3627
- SSDEEP 192:FqDUj9YutmUMSJHXTukffz8LP8R/YPq18Se:ocuTTSJjfowR/Yi18S
- TLSH
  T132121905EBAA873ADE7607BE48E3A2409274D711EC1B9BAF6C84640F4E3B3215D42775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Cythosia Botnet v2/Eazfuscator/AG.Eazfuscator.NET.Installer.dll
- Size 25KB
- SHA256 ae1f5f06654316170e9f69d90ddaaf6ede494010a8f8b0ebea390d9cd79ebfbc
- MD5 ebd6659389cb9f66c16e0f3ae51def62
- SHA1 b18251e55ff37ab08041a582fa35fa728fb189ca
- SHA512 834a4913ae9bdd761c3cdfbaffd45d5417e0ad1b2d1a025cc5054de5677a508a8c06550cdbeab46f1d321f503cea8b1daf8e9b23d07a091bfa02a2f06217eddf
- SSDEEP 384:CPt2FnpqY86ReFkuYQeBe7OnAkSh5Ts3aaiKKYpeSZylW/XYaej+wyYf:CF2Fp9qFkukeEZ592WvYaG
- TLSH
  T181B22B0DABF4C673E29D0A36F4E3913017B092FBEA83DA164DD4EC9519257C726061EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Cythosia Botnet v2/Eazfuscator/AG.Eazfuscator.NET.Settings.dll
- Size 7KB
- SHA256 77cc49341668f1c5c1e990a7ba38c99a835ee7559a095f819e07fd377b15187a
- MD5 7d1a873710df94f4245d2facd53adf45
- SHA1 8ef831153a31ce171e7f4e62ddb5223784c63ecd
- SHA512 bd2b61b4d1f1dac690d554f5526f3d8e1b6a5be4c7ef2288877f912536a0947864a6538089758a858f888c0d90e08689797bb6c4e9b643d067cbc3889cd7e788
- SSDEEP 192:2p6lUvoDtBax50IDjFB4n3oE8HR9a/3qDJcDoX:HDaWQjFB4U9a/24oX
- TLSH
  T11FE1605183988B3EDEB31F36ED62934A5774BB84E833CF2F1C55800B4C5A2958BB1B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Cythosia Botnet v2/Eazfuscator/AG.Eazfuscator.NET.Updating.dll
- Size 8KB
- SHA256 ab7340b41c1f2d556982e1d7d3b942d05bcc000d944360daa9509e27c2a25ca6
- MD5 8b357f73560438678490d818ee0fd84a
- SHA1 515df04ee12e2f944ff4184f363a282f579ad951
- SHA512 17e69e8d295304ac4a504a18f2e829dd78ab5b81de9d74a811f214dcf3f691090154ceba1183e590068e9cf97e0177119a350e802522508cfd104ef91fea2f0c
- SSDEEP 192:2h+htNxuXDSxUl+93RAShGLtX8V/YGX6IX:2kjDUDSxUl+93RASEqV/YGX6IX
- TLSH
  T16E020902BBBAC739EDAE0B7A44D3230253BCD645FC73E75F6C95640D4C0A2698A15B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Cythosia Botnet v2/Eazfuscator/Castle.Core.dll
- Size 290KB
- SHA256 629d361f922d3320c941263721490aa9aedfe933f58208d2c37adee82bd487d7
- MD5 373e67537921844ae51d17ed23536840
- SHA1 0b357664b2e4791d26c1c6eeee05cfc7e79df43e
- SHA512 0bf026e802789811bc8bbb43f5942774df3e9e879fcfa96177054b8861429a7549a925205c5792a9aef2e07e8423f3d7f121c035421f3cec7daa85e04d691310
- SSDEEP 6144:r3JeUzArvbmlNece4jdQdMyk6pF/EVjOLa:rIUzmwjjd96pF/Ej
- TLSH
  T132543B1523EC473AEAEF1B74E070491587F5F94BA47BE70A1D81A1FA1C537928A22373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Cythosia Botnet v2/Eazfuscator/Castle.Windsor.dll
- Size 314KB
- SHA256 4fe9c1a74a2246da54a1804f4089d968d8b86f67c19cc0d3efac9d98f5b710ad
- MD5 fdc26852c6f776572c77176bf100c02f
- SHA1 85d0af7ce7da2df3f1febfdb049e081ed93a1c02
- SHA512 90f9b234076f168b49230a3cadcebf7659dfa53a9eaafbb54f8607c976f3448449fd455ad630f6a28c9772356c1d98b63a52405454ffbe238b951f536fc54842
- SSDEEP 6144:hTSc22CNuBJoR2XzL/e1wK0qHkrdhaeFv2zJZdQwYZQhNqxPbXv:hNhN/23HkrdhaeFv2zJZdQwYZQhN6Xv
- TLSH
  T1F4644B5123F80326E9FFA7B5B470090246F5F847B87BE71E4954A6F90E93B508A513B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Cythosia Botnet v2/Eazfuscator/EULA.rtf
- Size 46KB
- SHA256 5b0a1515c744fe5791f2efd7e3ba782119f67c8ad5d63136ef484120012037df
- MD5 f72956eb295bb3ec59c0ca92f4c20573
- SHA1 2dac9a468bd17d72002f4e19d7c0e772d2c93b91
- SHA512 b55aabf8db8df413247a36788edf7069e89cc79ab74669de6080e737c4140cbc3edbb67e672de53a0cabe9490949a7eb2155d972500c889fcd77dd751f973214
- SSDEEP 384:UP+oNrZxu3fvRWlvNAhZWyFBJkroYZqxH1lHUUS22:8+yrmf5QvWhZWyFTCoYZqxVlHUU6
- TLSH
  T14223FEBF31365DE7DE69D466A42FA5841AA0FC481BEA01C843BFCDB0B913346DB5C642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Cythosia Botnet v2/Eazfuscator/Eazfuscator.NET Assistant.exe
- Size 214KB
- SHA256 fbe816a0da3fab9e532fc3ded1ed8bd5146a9de981059015918e16c3d0fdaa7a
- MD5 932f76cb22b81f57fed5428e14cb30aa
- SHA1 3ca70db0aebb9bef65f473694e6c568846b85307
- SHA512 c1d8b65033d9cf61e0e507a40646c14dbaa162a535f53e6961c545efcbacc8e34a16a54ba6af6f33f2574fe8c004298bae1f749e036b6eff02bea0127c2123c7
- SSDEEP 6144:jbclXo8tyTbltHAxL9IZX6EFa0J2Wappppppppppqpqqppppppqpppqqqqqpqqqn:EVx+s0ZwWWtT
- TLSH
  T149249D6936488D27CBAE09FAA4D2C08403BCC346EA41E7CA9CDC31DD59E374676275DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion
behavioral21 behavioral22
- Target
  Cythosia Botnet v2/Eazfuscator/Eazfuscator.NET.chm
- Size 555KB
- SHA256 afe7920788a0c7065b1fcea98134e8d8af5cb98ce68e49508311106e810ea4ba
- MD5 b0947ea00da61151d330939aea838800
- SHA1 d032d2eb5553c8d09b1f8e7163056e14f8f7105f
- SHA512 135f123d39629dc8fde63dfa83cbfba6d9b4e6f6256ec300bc0817e1b4c3da55b7ce2fa73e1b8e9f02fe4361108ecb7921d9674a9cb3d2d10af9ff8e9fdacbea
- SSDEEP 12288:+FAlWBB6L6otlzPhT3xg5RDIvZJQGYDInX/lgjzH4w:+FAlWL65trT65CvZJ3q+/lgQw
- TLSH
  T1D6C42392A71A605EF1A69A37C3FF3C9F394A78DB96343204A3D5CD635E68A19307F041
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Cythosia Botnet v2/Eazfuscator/Eazfuscator.NET.exe
- Size 706KB
- SHA256 d1455956c951335554abede55cba8fd5d469000e347da7af32c90c13cd72fef3
- MD5 043a898a2b5f0cc46aea8ad19a8be357
- SHA1 de0e37fa0904ca761ba6829ff7df5121db19cafd
- SHA512 1b67c6382408f3f0d4c4a4780f49ef5f5cbe50f6d27eb3bd518c9d2658b8f1fa478b3cf2dc6a0b73b8ef82e139a746c9ead2c6de068ba8caf25a386cc1cacbd1
- SSDEEP 12288:hpJI3SBOWAFmtmcVFsXpSUbl3tDOma2ud5oAN8XrtT:+YOWaeudl9ama2uMGAp
- TLSH
  T1FDF406F146DE8206D64F3A79D1C26F05CFF09207FA4ACB4A9C952ED41A8D78B2C4749B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Cythosia Botnet v2/Eazfuscator/ICSharpCode.SharpZipLib.dll
- Size 188KB
- SHA256 e116215ef992dc209f0d6d8faca12e679446c15ea38d08af361f5e4eb74c1e29
- MD5 8bc795fb6d0d6b098b9a707a156a3610
- SHA1 5270b34201ad7407e0ccc424947c8bdd901725dd
- SHA512 9924549b4acecd8ffcffb598e2ff4c0e1a36e8fafb1d85256025ec7006554e2f4ad756ab05e70b65ffb3529195ca0269720071674c68b37ec08d897697e771bb
- SSDEEP 3072:u/9Xhtl0rAVXgaIMAb2nPgh2JyyFYt+t3IdvVHzjpKG0nLa7Eab6WYLzCDsEpDw4:KKAyaIsIyxcJk+b7d
- TLSH
  T17A14271477E8425AF2FB9B79E0755550C7F0B9A6363FDB4E4D4050EE2C62BA08D223A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Cythosia Botnet v2/Eazfuscator/Microsoft.Cci.MetadataHelper.dll
- Size 206KB
- SHA256 f43cd5c3c158e04f0c19da895a8d06a0132040362eb8b5c6b99e75c8bcbee191
- MD5 819435e600619e739e1e939d1e6fc5da
- SHA1 668db8613a1c088522dc812c2e3d66ddbaf1064d
- SHA512 230d8d8db012ce6990c4ae8a192206d3787dd35fba56e4fa2e228783cc8a368c64685ad5fb2f86262375a2056f632492fa58de17342e5d5b3d6872e2e62da059
- SSDEEP 3072:WYgKr/LDhh0lUwRZBl/zc1bAxv+83So2cB/yM5IcS//AhtAxChzpeUQNSQeyJ9Vm:WYfuuRMyrHAAUKSQey
- TLSH
  T1BE242A056754A2B7D5EF4BFA902508046F368A1BE54FEF49FCA092EA4C5BFC0E581723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Cythosia Botnet v2/Eazfuscator/Microsoft.Cci.MetadataModel.dll
- Size 124KB
- SHA256 a411800f5708eb6692585690ca700d13237f138738429e14ff41980b452933a8
- MD5 5d3840a769b0233e008048ee631c0864
- SHA1 3eaefa847b986131880b50d48a20d8a3b39382fc
- SHA512 8dd9f6fa4fa917112fdd2f994a27be4e3657175dc23fd61ce67a00a269d4862064127ae48fd3e8bd0dcef5cef7c217c3e20919386db029455efdbe862e717651
- SSDEEP 1536:GOE72+nCMRuQ8qtF/6+vf6AspGAiBjc4RMwC2Xho6kucvZI8z/zHD6JF8Elrag88:S8qL3ToEdMwXkuee8zny88abOsO
- TLSH
  T1BAC3081EEE41E2BBCFDA487FB07205311FB9C3470D8AA6057F996AD95013AED1892353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32