34c034c2a5aa79afe6f518fb9faa53b815e26ff9a3e73d2838e5a58581129605

Sharing

Copy URL Twitter E-mail

General

Target
ms_by_np hackvshack.net.rar
Size 32.9MB
Sample261006-wv3m8ast5l
SHA256 34c034c2a5aa79afe6f518fb9faa53b815e26ff9a3e73d2838e5a58581129605
MD5 ec3bdb68eae29c2ef9948dc4dbd18f10
SHA1 60d0a65d3cdb9f5c3cb7c9b7d3e77f27ed3742b8
SHA512 e1753231091b20d23be78f4d40f8cf72f36b1b85e436a2da0deb01ce5087eeeb2c8321eb8f982431f2297d5bd24516c570fcfd498a1dc2eced95f6794a0a4706
SSDEEP 786432:Jx2JYtxbX9FN1bL3cOx0FMmxiuaIxje4qqlSF/ctAU3lKO1:Jx2JYtV9poFxJaIde4NVKo
TLSH
T1D27733D7ADFC518CAD6D9261F8CAC1CB5DD7A501623371686AC7C3209D8783BBF82528
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ms_by_np/CRACK.bat
- Size 1KB
- SHA256 85a6dac3e8832ac3ff9d870894088201d68ea879fc670fc6d2a60f2247ffaedc
- MD5 5f4b2bb70209c4aab78336e894fc50bc
- SHA1 00e7fdfbb952f925dd338fb1d55e54acc6eb5538
- SHA512 0b17aa73e4bfb97ba0d22b0ded87d4e9bf4d7b5ab07cfa670520b37810c532b960dc4f9ccbdaca70c722cf15f1a73c714ee1d0a4d10a6223e2c1a98f5d96259b
- TLSH
  T188311E5B311C0C66999AC2928C923251B68EC25F51182CCD74CFD1B82FAB7C46AFD0C6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  ms_by_np/MemeSense/bin/win64/xldr.dll
- Size 6.2MB
- SHA256 1fed79b8c6c32db84f12a0600f40e9ebf001470fc009831cb65addf75a02e178
- MD5 03e7b71a7cabed7b7f19a57b481a95da
- SHA1 69a81a2026b06c9609722a6a6096b3c56253533c
- SHA512 e582be83f663be1ba9c24c2026a19c0273ce2a07fd175058e372f266b84a346bceb76fded39fb02088ee7953c4481c3c76d143320da797ab63bf5861bca2b9b3
- SSDEEP 98304:FYwlmPwWHtNuJKIrugWUYCUEBL2uu5R6Q4eUamwHBRqZIA96SDo3xGjr:/MHzY7rHWU5L2uk56LwTQ5gSUAj
- TLSH
  T1C05623803CD9527CF6A74A72D1491EEEFC8035C9AE7A680E6FC6039C2531D57CEC6A25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral3 behavioral4
- Target
  ms_by_np/MemeSense/cs2/vpks/game.vpk
- Size 336KB
- SHA256 455e43352863e4e4478e365e11e3cf66de60df63eb3b026bfd9e419e9ae361d1
- MD5 b5a3ee9c095fd07738b438e71987d81c
- SHA1 7ec8a38680fb6c731af57b2adbfed7f411ccae93
- SHA512 e81f01cdfb09a42b0342995e7b8e18023f52c6bfd347c1f775c16ea43295e39739e37188d364490f7e97fb9dde0b560ef682326d2aa0f8538ab5fc76093544b8
- SSDEEP 3072:SCaVS9H4QiZ3oifq6bUqd4LRoUyBCjpBPzdaYBoL74A602kJb:NaVS963ob6bXUyBCjrPzDI7430r
- TLSH
  T1D074185820F711A6E56B71BCA7CB4111377050032509EE78FD8DE229AF9A5ED13F2B8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  ms_by_np/memesense.dll
- Size 3.0MB
- SHA256 3f9ec74d56b69e327bebabf69098d0b6139916c1d5b4bcb6a424ee17b8e67950
- MD5 6b4f26ddb0a70fd3154b20de70c534c3
- SHA1 d4892750a486da0257a433cb541cc8f1473e2d20
- SHA512 1703ddeb28273a1880d7394ba3ce1a2bceb5c0b2a50e24f8652b282491a889b1662eaafca9e4545a74875d2a0fc7f09f062d4b7e842efecbeb6970902deda647
- SSDEEP 49152:k1xKKKKKKKoqIrFAW/vst/4pl9YjWdCzMJDJkjca/MT7d70NbaGWxHYwS73MI:yxKKKKKKKoq4Ot/4VYjW2/MviNaRyQI
- TLSH
  T1B3E5BF43E2D2147EC41EC138535FAA25FA2578889F746CE76600F6352AF1A91FD7E328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ms_by_np/ms_inject.exe
- Size 9.0MB
- SHA256 a953d2994598d6a3c39fa44ea8e8ce28f90c05b3e21e5372f7e89cf3e75e7e1a
- MD5 bc2a40015a343eb86bbc98ecf91bb389
- SHA1 9f774fa93de17ea897a37259783fa8f21c1c4aec
- SHA512 63c99f1d10398c30954e4386261a3be433c45a7ae96388cfbc197318bb3727f1a86af2856724668f9b76c29b74d7fde5bcfe46b1dd3be11c11851b8ba656acd3
- SSDEEP 196608:KJoC+tbW897GXPHMe81SF2RPUewq97BtKZ2xHsMRqabRgFgDU:Au1wPsZg2KezxK4xHsMRqabYgw
- TLSH
  T17C963399D3B009EAE4779A3F5DA59062D3B1B8250760C4DF1AD0872B3F5B2EE6C39341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral10 behavioral9
- Target
  ms_by_np/ms_inject.exe.bak
- Size 9.0MB
- SHA256 fa381021430e1aac11c8250f86744acb0d25d902f637de65995f24e72c40e8b8
- MD5 197a898d08329f5489af433494427eb6
- SHA1 07dfeb1297fe883f8c2249a5376365a9fe0f4f5d
- SHA512 960338d1f6396ba50016e27126e60521127d69cc95988c35a4f0c2d559183a5378dcaf2db7a973748723c98b66d266eeb4b7bed9af722347c808f6cae5f9fe0e
- SSDEEP 196608:JoCw4FNPtbW897GXPHMe81SF2RPUewq97BtKZ2xHsMRqabRgFgDU:JFfP1wPsZg2KezxK4xHsMRqabYgw
- TLSH
  T1EC9633A9D3F409EBD8A7653F5DA52093D3E1B42507A1C5DF1B90432A3FA72EE2839350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral11 behavioral12
- Target
  ms_by_np/ms_server.exe
- Size 7.9MB
- SHA256 54c24a4dfbd1c8e90e734252799c6d3bd52296d00ede775baad5f0695d36930c
- MD5 0c2d9efdc3773448e75988e776f5edfe
- SHA1 16d449ef0bdb1278a01479b742d30ffc1e903d01
- SHA512 08e3b4aee7c70d407ed56dbb86c12dc8dc7ff777d7990eb4d84902b35df42d0a1f2da90faf9f4e3d8b124aa2eb5a323944958a006ef394b5bc49938871e262ff
- SSDEEP 196608:AYr2eBNTwhLCxdRurHSuhHToAUPNfGU5vXvPk0ax8lLDdIOZ+:LsLCxruXhHTodRGkXNaxI/PA
- TLSH
  T1F38633A6A3C049F9FDB7E6388A539129D7B63C051321C5E702D48A937E275F42A39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral13 behavioral14
- Target
  ms_by_np/remove_redirect.bat
- Size 346B
- SHA256 ab5ffd668507ab0770bd249556776fa1e53f6e03fa03bf29a5306f93d60e0348
- MD5 688da05b95698cf12b90769ccda1ac07
- SHA1 af8158fc842ca9945cb328fd5450d4d3366b8e14
- SHA512 83580905d6b5794e93ee5cf6742470f0b9583132d7b25d910cb4daa1b6d25e905e0c69543277d4c70f9cfdd1dce771fdb102eb5d0eff5fd8a948263ff0f979d3
- TLSH
  T186E0C003358F3C2B485896C554E24342AFCCC2CB002D68CDE0E862522D80BC4CBC5886
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution persistence privilege_escalation
behavioral15 behavioral16
- Target
  ms_by_np/src/__pycache__/inject.cpython-314.pyc
- Size 23KB
- SHA256 00b9c24e18700a6dc9693058ff7c9e8f3c835a69472b7aa802508dbe6352e650
- MD5 b5ca338eb226ea3286a0d9f237fef966
- SHA1 0231773383c208cff766d62fbd7ddbd85f5742ec
- SHA512 f4a38d4820266635f2502654d4dca43013c77658e8a6b107c8ff6b918e2b008a4bcffcf5690d3368b54c3938186b0fcbbaf6748ac6ca95fda089c2ce35e48404
- SSDEEP 384:bx5Rt/V8iWroOhRLIMLmtx/f1MzkTcayycD+Bc/:Ftt8iWjRL+3f1TgycP
- TLSH
  T163B2D5F8CAA05877FED9F87A74DA2546F3338085A585DB03F85C8D3A7F8A26AD54110C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  ms_by_np/src/inject.py
- Size 12KB
- SHA256 aa5ae2aa483b9f35041127167b2373bfe551e3b449f29aa1545cd0a63390b734
- MD5 453fe341388f3c7d8bc1b1606d276992
- SHA1 1e1d8c7887ab718343a8bd4f0dfe83c97427fa3c
- SHA512 151ffe64b1e8af532f105a0e4c2006c71187b6f5aff3ce808e6f0a6c7ab9b3beefd9848784809023ef8405931ea90fa6ddd7925fc6d275e29db7eba8a9792b69
- SSDEEP 192:k7Qb+fBy6gIZEgyngDx2XgOHAjl4H++ZiqLUrcXoelb0EvRI5HIT0qm3026oPERf:k77KnuAXNp3vRIRezdJAUL
- TLSH
  T17652D6491A6C9150D793548ACA178C497E49B8171A381E343F5D8AB3BF2E43DE7B0BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  ms_by_np/src/localserver.py
- Size 1KB
- SHA256 810143fceb1c025b2dcba84cee61e928f8321ae0da4061d56ef568cc9aaa9282
- MD5 e8cfbe8a00b2223284c19948525c46bd
- SHA1 572586e23d7b9309e00898900ee8d85e7abf56db
- SHA512 c92f73e918f7cb8f4d7622aefe6d08c2f7afa08b27c0d6e9ec154e0869eade97503f8fda277c243ed0ff00493f98f086053b7c8d30e158618b6c1b98a7017870
- TLSH
  T17531AA99CD6942A3D7A3867D166BC1405357B873168981B8BBCCE7803FC61B8E0F56AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22