c8a9098dfb21852636417cf016c06764b9ccec096754edd75ce6519afc61a73c

Sharing

Copy URL Twitter E-mail

General

Target
PHANTOM-Metin2-AI-Bot-main.zip
Size 22.0MB
Sample261013-w2sftscf64
SHA256 c8a9098dfb21852636417cf016c06764b9ccec096754edd75ce6519afc61a73c
MD5 93d91377175e3ca29c51db6b189bc9a4
SHA1 d1ce9e3b540ac7a024cd7fe3cf517b33426e678d
SHA512 75bf4bfa0663a1a82f3e9f7e390804c3352675cba36cd0ff7bb2dc606952fb66d5a7dea11f24685ba5fbd9af2a4931265913419e97f17f16b0c16249b3055d44
SSDEEP 393216:iysJ4FrcX6ow1snK6ZZ08ITo1TbZFKXF7Zs3bGNfezyhgyXM8r75KPDJnTWW:iya4FWw1l62ohZFKXI3IeuhgAM8rclyW
TLSH
T1DD373355C4387E8FD1BCAEBC60CE52D81A76E14042FB1FD5F8913E69CD2D48891AD22E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PHANTOM-Metin2-AI-Bot-main/PHANTOM.bat
- Size 3KB
- SHA256 1d789df8df27ab5b42ab78169e3daa25f75f7adf0d8f58f2cbe0f33716efd93e
- MD5 1cddc525078e3dc03b7849c39a169b72
- SHA1 ceb5c72a3b5a8ebe3420856c9dfc1f1c2286b477
- SHA512 7510e8e67c8a33831d7b49f85ab78eba4ba6cf94e852bf8cf13cd7b2d3e79e0532c10807a8f4ebe4fd4f61814b098916a1f8fe97362a2fd8b60994f6d097fd62
- TLSH
  T18A719500650D9EF3806B95C99F9E10A223AFE6F31238ADCD7028C65CAF0C96586FF740
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  PHANTOM-Metin2-AI-Bot-main/captcha_solver.py
- Size 143B
- SHA256 e830eb899fa56e29183188260fc3370fa1577746011f9b2a86e197b0f7f6c49a
- MD5 a66def15420dcda9639e4177f10fed29
- SHA1 a4e96bdc6d01f4558c7e381e45a21bc82b5d8a10
- SHA512 23f8cedb4df849c6825d67103d87fbcc059134eeb42b23a1630f36e0c12df160071af45474960b8b8d2311f09237fdad81a39ae30171af9ee99b8c0945c54c58
- TLSH
  T15AC09B3294146D15481E8AAB464751B5C6576530FF651205A49D791C07DF1D21145C14
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  PHANTOM-Metin2-AI-Bot-main/index.html
- Size 51KB
- SHA256 c1e07c43ffca37438bf54464e1ac1b6209340fe4e6e88da5db158920a787ed17
- MD5 49e6d7fedbfae853dc881cb2c67da31d
- SHA1 e92a3816b51b7422f61d94d413a7265c73a3f496
- SHA512 040abf3a2ae21e5ed8d4496894c630e260f8bc8cdfd95b619d321da1ebfd365fd203e0352faae9b7771ce266fde506f2cfd50be47fcd1a66c2e4046d998e8abf
- SSDEEP 384:trpiIHt+jFllOB9NV6z/hKHE9R96RXn6Be3OAN54HkOZPUKS5SRjX2Yhjj73G6IJ:XiIHt+jFu9NQz/hKZn6Be3OZM6SJd
- TLSH
  T1A533A46665F32172682371FA6BEB575A3B30A103D90BCD087EDC53548FC6EA09A5378C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  PHANTOM-Metin2-AI-Bot-main/interception.dll
- Size 11KB
- SHA256 ab88164c11b1b48488772d4c3bfaa4509d5b0ae9dbc5a691dc4f96f0260443c8
- MD5 fe8b2a022297aa36a3546391221f635a
- SHA1 346e04907eb628372f459fbbf109b6cff57cac13
- SHA512 fa203db607cb1154f7ac84e64b236b19ff29abab1b443609648ee3fafa53581c22420edd1f5ed2c522ab7f3c2577c73822eafbf143a8c80914a3061193b10a1c
- SSDEEP 192:wBKz1mGyRWIddjlkuSCqPDKSyFVzhveZhAk3M+j4sreC:EKsGyRhdtlkuSCLS8VcZhP344
- TLSH
  T14F320856EBBD107DF497D1F89AE61606E9713A00076563CF01709AAC18A3BD6D73B312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  PHANTOM-Metin2-AI-Bot-main/kurulum.bat
- Size 13KB
- SHA256 7a7c583ec1367dfe01d4fa49238624de635ac5a54190cae770ed3beb5feb70dd
- MD5 d97fee5001907fe1559d2bd81783a6aa
- SHA1 3c50995ded5317fba6d071ce8944480a7034674e
- SHA512 9ce25af31c76f697fb8c28d9b6f0d7bcd25987c1fd28987d6dcb7360357d8b6929e7e5f153a07281930623853990348f2b29f40c9c6d9b3ae009c0c48ff19034
- SSDEEP 384:x9LoT4TJA3VZSmnANVxN+/bQclNKSFlzAp6ZOZGpTP:xpoT4TJA3VZSmnARfclASnzhP
- TLSH
  T17A52961930081AF24669AAE95B2E51913376D2EF1224FDC870BED56F5B1C78309FFE90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution discovery ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9
- Target
  PHANTOM-Metin2-AI-Bot-main/lib/interception/install-interception.exe
- Size 459KB
- SHA256 e137863a79da797f08e7a137280ff2a123809044a888fd75ce9c973198915abe
- MD5 0f0b50d92e030b8965ce669c8058fa6e
- SHA1 257b3f0402285a29f4618b32958c208b3e9d4c4d
- SHA512 fc7c384fd6f682ad01b598abf87c522b38068f4488cea6dc7bd6dedd66e995e4d8fb583c54c6afed0c4c7a9a2318bb6ed257bb3cbd0e48fae83a7819d1167d79
- SSDEEP 6144:+sglhAWORQG8O1dMDmJPjQy4xZWLUKc2:+s4LjGvMk74+B
- TLSH
  T1AFA45B031F98E96BDB5A077441FB472A6BB5F5E12B2297CF012143692E437D06F3872A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  PHANTOM-Metin2-AI-Bot-main/lib/interception/x64/interception.dll
- Size 11KB
- SHA256 ab88164c11b1b48488772d4c3bfaa4509d5b0ae9dbc5a691dc4f96f0260443c8
- MD5 fe8b2a022297aa36a3546391221f635a
- SHA1 346e04907eb628372f459fbbf109b6cff57cac13
- SHA512 fa203db607cb1154f7ac84e64b236b19ff29abab1b443609648ee3fafa53581c22420edd1f5ed2c522ab7f3c2577c73822eafbf143a8c80914a3061193b10a1c
- SSDEEP 192:wBKz1mGyRWIddjlkuSCqPDKSyFVzhveZhAk3M+j4sreC:EKsGyRhdtlkuSCLS8VcZhP344
- TLSH
  T14F320856EBBD107DF497D1F89AE61606E9713A00076563CF01709AAC18A3BD6D73B312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  PHANTOM-Metin2-AI-Bot-main/lib/interception/x86/interception.dll
- Size 10KB
- SHA256 9e1def27b804df9ba97fd07f9de835c70660ae568c00950102f70034e293a684
- MD5 f90b05d294f094a122c6b99b5a820cb8
- SHA1 757803f0e58269ac37ff81489465f80108032636
- SHA512 84165cd9d27fb269411399b4a8b8e4e08279487324d840c52d46b552c427853e57b2007424f070f92c4f38b0c3632eab7710516768ac8670e01a413c38fe648a
- SSDEEP 192:PEH6lRLkQel2t06XKAITvGKTNFqXJNr68JAI/sr0Ib/dk:PrL6w07AIDXqf68JlGZ
- TLSH
  T127223C9AB79846FDE4DF16F817BD2E26142E7E500B9011DF59A304DC98A87C0DE33366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  PHANTOM-Metin2-AI-Bot-main/metin_bot_webview.py
- Size 1KB
- SHA256 cb17a5c25dd9b86d3ebe75e00cb3f48a11f1839b18fe42eefd437acc6c648fa1
- MD5 77e8522fd8f2d7ddb7925bf95db29a06
- SHA1 49b976d425e1b567230a3bed6456d108a2a85031
- SHA512 8690f28afa99df6c4dad589754b3429a975640b9d0ed986cfd3a0754aa9336e17f8d93d446deffe332e74d3354a1322cd06237d8c0701dd5e6cafd383f9a187c
- TLSH
  T12811EF01945D28218383E79FBE1189DE0AEA74539A3B9C30BDCEC6D42FD5431A5A10F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  best/data/222
- Size 48KB
- SHA256 57999a54e56a56423ba10fca12ddcbd819f802966f4cacd5b810f30b6601cf56
- MD5 e254e5515a94e9241338276277e0c1e3
- SHA1 a28525568b6329e7c5fca346b2c28f55d695fbf4
- SHA512 0703f8d80d2d3c33aab65c9af85bf581b5f746bb0605b4e31e7c7dd4802adc7a48ec3482672b0585190980a492602a58f749c86fff219406e7939d94eb30efa2
- SSDEEP 768:ZduRrV1qTe7ltnmFnFVvxME7Hr/Jvo9g5IUhzftaBp6ximdXPD5GO1gNvrGrzvBL:cr+Te7lNm/F5LhzftaLUdXdN1gpGrzvV
- TLSH
  T1D023F1B16600E84C8551DE6B73F6A8BC9AA7CEB30427BD01DC8D5F4CD1685AC5B0F93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  PHANTOM-Metin2-AI-Bot-main/src/__init__.py
- Size 39B
- SHA256 a18f7295c85414e9b7e0fcb3804fcb39eab34bfa16f8f2cd67947a2e40dcd5df
- MD5 28f51666a9f1877d05b394ca013ff3a1
- SHA1 27c6a770c9ceb5bfa893849f02a4425215e9c0f1
- SHA512 ebc661bb67b41e44d0d673bb1da3750ca83b9f4a081f039d35df17b798d771fef778c72c55023ec726d7e11c9fa5ad356794f543292eca9505a65a481c65b67d
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21 behavioral22
- Target
  PHANTOM-Metin2-AI-Bot-main/src/phantom/__init__.py
- Size 27B
- SHA256 f517e596c45ec67b402d628f96b33043e0d21461292cc1e165807b5e730fd2fe
- MD5 ced9a6e79122f8ca5446fe485e2a612c
- SHA1 998eeb361e60289abefe75f254436e55557be6d3
- SHA512 8277b241f90ed8e9b500eb8b17bf91ac2adca4683468880685681bddd171137757b75af93962a8674ef22c20fc12b4101b3b65e6bef0b010113579c7336f6e60
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23 behavioral24
- Target
  PHANTOM-Metin2-AI-Bot-main/src/phantom/app/__init__.py
- Size 55B
- SHA256 ff8adfdfc13917a7046eb80d7e9f33209ae09c8b973d708eeb281efaaa1ecca0
- MD5 cf513f41b855fe7b886d33dd8c347e49
- SHA1 1fc10051cb87ca465e2cf7be31916d0ae4965987
- SHA512 b26adb6d99cf8b0592a07dd05612b710756c2a331ba2e3bd494a54b0c63a8612735b1068a42a4625601c5a9b3f4248a2314dfcc35d6ab1fa5c689970d0acedf1
- TLSH
  T1A49002C32120805195575C628228B1406876A42D39D11559B82CC4110385578831A610
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  PHANTOM-Metin2-AI-Bot-main/src/phantom/app/main.py
- Size 160KB
- SHA256 0ddce65049b92df20458f173ef5c44c4d9c56cf595e348e8ce4632818fc12649
- MD5 7863a90e52f5ac4d507599f2662cdd1a
- SHA1 7a3999e7cfe70164e8db16c8fc1484c50b323f64
- SHA512 54850a6714407ce026082d4d8139e649393bea86741bfc41d95cb89a4bef7b74ce490edd99bc36320b021c5eb56545b6a1fdd27f793d7871990afb81cea0665b
- SSDEEP 3072:eUCAGPUn/hW7dZ7kh9LarG1L0zPXmsPVsJEMJ7799yBj:etAGPQ/hW7dZ7kh9LarG1L0zPXm/JEMs
- TLSH
  T1E0F3B761982B5879CFE3C81A8883E453771AB9476D0C242A7D7C41682F24A774BF5FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  PHANTOM-Metin2-AI-Bot-main/src/phantom/automation/__init__.py
- Size 42B
- SHA256 5ad001a7cf98155e5b864d7d1c02916f85c28ff9f32251681f50adbc99725781
- MD5 bb0420747bd3ffe4bf52dad40773e959
- SHA1 87c8178aed4223dd11ecd3d85be329be454db4c3
- SHA512 f4f283b78ea54ce8a3f99fcd2708eddc88d67a446c8208fc75613d0ad6b3009adeb2c60988b0aa3cca83c0a3064b7382a0774167a571ae8589e759de8ac1f81e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral29 behavioral30
- Target
  PHANTOM-Metin2-AI-Bot-main/src/phantom/captcha/__init__.py
- Size 104B
- SHA256 8b070b566c29950852439993094794346b6721204b2df7519a3f70ece0307c8d
- MD5 3b7f6d34df92ccb9da72285aec1005df
- SHA1 ec3d77da0a6749ce884ccb37981dd4889ebe2622
- SHA512 5201e226e14705996e9c4cb310fa04f4c4dc56eac66b583c37dc5e1d0ec1944e0b5616933c20bfc1cacb3c560da0e884b935fda18ca987f4613ae23b0e92163a
- TLSH
  T110B0123710143D10EC6DC2B380C75041C213A130FE40051840286424139D0514425815
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32