Extracted

• • Target
    MASK HİLE/Extreme Injector v4.exe
  • Size 9.5MB
  • SHA256 4e57af02f430ffdacb81b8b597b251bac12de9c0703fb5325411dc83ca8d8e11
  • MD5 ce84b5ced6719ef6680c681e46014400
  • SHA1 7960e61fd077596e7d9630fe579ace4842a344e7
  • SHA512 cc469fdadc02a8aeef9fccf532e82deefd43bc6bb06adc990951ce2a92a04c3349edd1ea2e4a38f7b933fab4deb42f84916673fad73bf0a7c03861c4446fdd59
  • SSDEEP 98304:0bCTz8+F7j9+U22ihIYgOeieNEVJyZlng4p2V:0KzpFOJIEYEVcn1p
  • TLSH
    T115A6E1447551BE5EC3E68C32E4FA1C1C933098A61743E30B653AF695EC5F2B66E803E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  kurbabndefense_evasiondiscoveryexecutiondarkcometrattrojanupx

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    MASK HİLE/Mask2026.dll
  • Size 490KB
  • SHA256 fe48c8ea90d53060a55296cd4ba6ca8c43db2ba73b8b36fd1f3fe608a282f88f
  • MD5 aad8d8a25b0a571d9200b26a9f5950e5
  • SHA1 08c1c20bb724dd18d85cbbb19b5ba76263a6b930
  • SHA512 3ff9b57894cadc7620ae6781f278084dd6b0bf679e77c75a27bd256ea88c3b380578c19b6064424101986caab0a41618a7447c71688574b6b4f9245f01133022
  • SSDEEP 12288:uySG7l9bKcJA4Kw4JpWwvu7oduEMKk3YaDzi:uySG7l9b04EnBvRk3l
  • TLSH
    T17CB46B4170E181B5D09D52B0B5B93B9FAC3A2D88432491C767E0588D8EF06E3B9F7B97
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    MASK HİLE/settings.xml
  • Size 4KB
  • SHA256 a69c2d9070942a2c91042969877adf7feae9556e293702d36f8ccaeee79c5d25
  • MD5 84480fb93f1fd3bc7fbb3caa987d967b
  • SHA1 49a0f34c8a5ddb0d403b95fd54ee330a9c896e47
  • SHA512 a0c7954c7b1ee0b18d4eb8ec72afe4130b522fc08933ef6b72ff9c5c4c4cbaf60e7cce615b1b369aaacdb13ef53d4cf5dfad7dab6328a309ac48ca649666bff6
  • SSDEEP 96:zMaOpD0KapW/9Fz9KapW/9CKapW/9FuKapW/9CKapW/9FuKapW/9LxQxJjy3u8Xm:staNzcJjv8XhS+vcL
  • TLSH
    T1B6A16ED06BCB350CF6EF629F5339A607C96C4092833238E0B46C521A6F2B0576B63C32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral5behavioral6