c8b8f99fdb51793cba9e020468b2b25ae6ac16f54f5a5787820ff76dc49f80a4

Sharing

Copy URL Twitter E-mail

General

Target
SecroKit v2.0.rar
Size 26.5MB
Sample261017-wap7dsbs31
SHA256 c8b8f99fdb51793cba9e020468b2b25ae6ac16f54f5a5787820ff76dc49f80a4
MD5 1f6111fab48758ff8d6dd396228eda02
SHA1 bb26c383472196c068b0316a9998bb451d565dc5
SHA512 25b5dd65242eb855a13fe773a5e35c3c297720a69f6dee4c7c791bae39c1fdb982665193259a9f5f2b551b29c905130a7a8aa322694ca95d685871305ca9fc0d
SSDEEP 786432:ZMSi/Z2azPqRWZG0AsP5ksr+pW0TVv2+moXI52/0:Gj0abqRWwwpcfTV++mBk/0
TLSH
T17957339A5DB0C7B7F8CBD004E85ECAEC44589F3C06DCDA2A2475252B606DE3161FECA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  SecroKit v2.0.rar
- Size 26.5MB
- SHA256 c8b8f99fdb51793cba9e020468b2b25ae6ac16f54f5a5787820ff76dc49f80a4
- MD5 1f6111fab48758ff8d6dd396228eda02
- SHA1 bb26c383472196c068b0316a9998bb451d565dc5
- SHA512 25b5dd65242eb855a13fe773a5e35c3c297720a69f6dee4c7c791bae39c1fdb982665193259a9f5f2b551b29c905130a7a8aa322694ca95d685871305ca9fc0d
- SSDEEP 786432:ZMSi/Z2azPqRWZG0AsP5ksr+pW0TVv2+moXI52/0:Gj0abqRWwwpcfTV++mBk/0
- TLSH
  T17957339A5DB0C7B7F8CBD004E85ECAEC44589F3C06DCDA2A2475252B606DE3161FECA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  SecroKit v2.0/Secrokit.exe
- Size 26.3MB
- SHA256 3e95fc8aeb8a25fdb0c997ae271057f2f9c51fa116c541c78bb6649d6213feb4
- MD5 82d355ee4763a47bcf0729395d68ce0f
- SHA1 19ec967c7fff7aa69e71142899950c1f5ac67808
- SHA512 98b195369b29dca7cf0b3eeed631006c63824f9e4af5fadd60873f5951fa28688e14092235ce1163c8695bb47a9d6ca0153751ddf5891bd2cf0084180be8d6b4
- SSDEEP 786432:iMhPWAA22Fg1NvW1edhyxUr4EXKXina/xEqGW9b:iMhPd2FgjAxUMEax/Gv2
- TLSH
  T1EC5733BCC1F79539C60E9432C7F70E69DB11BCFC7620740321252A2656956F20B67FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4
- Target
  SecroKit v2.0/img/BulidFile.png
- Size 763B
- SHA256 03adf3ed3633b1872f074f1d1cfb5f6bb1db30fd9bc90fece77ac2acb643ce60
- MD5 8a9a2e5365a726d77bd4c809280df27d
- SHA1 5b5736c59fabae38a7bb4af45252a27b6ff0906a
- SHA512 9b6a0baf3ce6072b1c9713e4f9a801bacee355a051357915f5a966f67d0649c0eb136563953dd19357265e7b15c2f95d23084e7f666120714b05805ca289338d
- TLSH
  T1E00126FE8F8C4EA3D6845DCC041533E9D8315C5469E05048D089B1752431ED4A4A16C7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SecroKit v2.0/img/Down.png
- Size 516B
- SHA256 7f143b7a986432d69e6e251d24cdae2e1c1fa11aedd111d959ef008630c58290
- MD5 12692bb8299eb379cf8751d44f764fa8
- SHA1 7c6c61332d7f6cefa69d720dd0557431fbf091d2
- SHA512 128dd48af8a0ddfbc026700554a4ac9fab51ef7b8610cd11f701fb4c79d4bf81cbe6eca603b2478c15d181348a64673a0473e8ec97fec483a037d340184945a1
- TLSH
  T177F0C0F5A30EB82ED860AC75449B05F050CB16DA4123349E68A4A9795A67A6D8F06E18
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  SecroKit v2.0/img/Filename.png
- Size 7KB
- SHA256 a3960b022f51c6dfaebc559c55bc56f1b5d13cbeb14ab6d5e7cb138dc6b393cf
- MD5 a1d0e196911d0a2aaaa7a60e39965a7d
- SHA1 c2dbaef7828cd05eed27695136c077d5928d2c91
- SHA512 9bd65cf88918cc19d917f293438939d6dbf680407f393578e0701b4683ea08586ff76962c31676d5ff4938dec61d7f3eede4b17ea38f56f8f83d40402094cd83
- SSDEEP 192:yS9KjBuyd0EejtsnWiKYYH7ywYaMG3NjVYMekbh8:Nwjwyd0ftsWHYYDrBdeeh8
- TLSH
  T17EF15B809CA1AF5FD14F9B51E2C091CBA9254D5B8275F20A6F4339AC6BFEC38172E115
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  SecroKit v2.0/img/HideFile.png
- Size 1KB
- SHA256 981303841303c990c123dcb9b797a33898fdf1c33365b1c2fd5cc688e53a11c5
- MD5 41e13ebfd3d7edae7fd5ce8c12b59e5c
- SHA1 51d2fe1df68523337a21490fff19fd4b2c0e900a
- SHA512 4c65c59661719b382f09b410f6ba0fe56e96faf01b0e20f0dbfd17d38bc7747aca0d57508a14d63815d89f6ac4905fe4c13b023eb46407546c4a4defb13d7b66
- TLSH
  T1D921EBCF183E9A1FF5755303A2170B064DD9CFCB14608800FACBFCAB157C888519526B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  SecroKit v2.0/img/Obfuscate.png
- Size 876B
- SHA256 bc87a1b6a4b182a197db242eca8f45b6023927f79b742cb411cecbd93bc0145b
- MD5 e5244139e3f0e2db6643a99cb420053b
- SHA1 3d68a60a088fd68c80915ba9e61bd7d50acf0616
- SHA512 4bc26a073d9641d92295f119a1ce6f925472de0a834c3217d732be44ece297707f090f6800c18f17820408785ef67d934b084d8a6b656aa5a015e6dfef54b2a6
- TLSH
  T1611168A6B343CC3C916935654605CC25E6F9ED4C5F235021C440F96A5E7007651C4639
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  SecroKit v2.0/img/Short.png
- Size 886B
- SHA256 0f80a1796cbbacbdccb75b888fd252350c9c2bc659a6a53f1651fb7d54e49e0f
- MD5 03f841ac95a559e46156d67ab2a06fae
- SHA1 449232ecddd954901a4edcabe541087ac3df00dc
- SHA512 9aafe82a84deeef9497609bdcdb52a92e587ffef578ea986c676b25d521e2de40d6922531edc114b0a9143f260a9a06f9898078698bead319bd9015d1e730293
- TLSH
  T16E1188FD57E10CBEC2A8905D623C366494171F6C042258655C52F0B52F3315834E8578
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  SecroKit v2.0/img/Start.png
- Size 15KB
- SHA256 e28c20bdc60bdbca9ecd1092b321e438185f677ce5a1d67f12510c223c2174dd
- MD5 c02425e6d4ce9d867586729accbc570a
- SHA1 a154712f29231b6e63bcdb82ea8cbc27e4a8c0f4
- SHA512 4731db417d37a8e56f1594e61592f233aa354c3551639b7b396ff0c2f5bd2198e52014e2a3704c215c776090e5d0c697e43c11f0ea38c3f8b763ccc179f1a8d5
- SSDEEP 384:N+Vy9wXdxprSEg4/7cdXvYHbvfGTuBBpQgEiNuwix9:UTl/7cdWbGepqiut
- TLSH
  T16A62D0484425D1DBE2CB279CCA7D9837B2440CDA6FC6484897F0B73AA8FB50B95F2127
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  SecroKit v2.0/img/UAC.png
- Size 1KB
- SHA256 a19555c0bf4e7177787ffcb42e88d133067ad893b4d0f482fba8adbb45e2c010
- MD5 ae2fed11af4e0eadffae07703758000b
- SHA1 b02c236fe353f2d16787185ede8f95cae9fb05b2
- SHA512 b2932310c5ffa6ab4dcf0569ec19b88536bf1b480cfd0b3f3183f9fca11a0d57f921a862217641b213c3d661f89cdc7f129a92144893b64b528d84d9d04f238a
- TLSH
  T1061160F76901AC308B8C62A2D32D8F26A99BCF8E6C842304C0AF34E81D309301AC07A4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  SecroKit v2.0/img/Upload.png
- Size 4KB
- SHA256 df796de383b2b389d569ca72618ec6aba9276906755a79a27fb194a670f43d28
- MD5 5e002d9ec65aabaca996980193904f3b
- SHA1 af501c84382a8630a1f66f6938af5e46e1b70177
- SHA512 8f6c39c82b2fc29e5ee2b4e20ce3c902d8cc1a671c65ca2eaa9a6357fadc994907c9fa81acaf44e456417ad7a901db611f36af0b9d36e96a0acdd9efdf79dd23
- SSDEEP 96:ySWXZlEDeSHYmUxmuT42L4VwvctmXxxx/ETnhu0JJ3AVVD66sumdqOlc:ySaEtv2LwGctmXxxxMbhTpATD66B6qOG
- TLSH
  T14EA194BC0C16F6ADC07E24B03C16A53469773F925CC8C5A4A6F877752CB4AB3624320C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  SecroKit v2.0/img/back2.jpeg
- Size 192KB
- SHA256 b7b1282f94c608bfb513703018f3a3f013288d68d5655ee78ead6f46986910d8
- MD5 95228b175245d4ca42dd1509e206c1b8
- SHA1 c8f1cedfd091bde6b968c8e292563d9e13679673
- SHA512 c40aaf0aabe8d177b7be73c7f83d0e3ac9c7a6162b8748f94f8645e6e99733bbbfc05cd31107dec04900f24d8e22b032ff7c310378b93b2ab3ccf6668278aca3
- SSDEEP 6144:Zak1tqgiHiOR0q5+TXocK2v8BxrNRTDZhTq:Zf1gHiORh5+TXL1vGF7DZhe
- TLSH
  T1C71412D0299AFAE1169A387DEA0E75258FC73272DDD074C42D0CADB42D276EC1822E59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  SecroKit v2.0/img/discord.png
- Size 1KB
- SHA256 75afcb6915ec395d9f5140b50f4975b57e293fdef71fc14c1f113ee45b01c76a
- MD5 e433eb3a318da39de8422e488873ad56
- SHA1 11ed2a52f91512a8e3d826e3e784dbf9657a9051
- SHA512 922ca50d8f15c285182f5f7e2fdac091b9aa3a2436b64b6743b26890790a9427b00ae66abb0f58751d214626f03d80210d33622ddfcbda7b9b6ad0dfbf08398e
- TLSH
  T1CE31C98210769957DF0A4999B7520669DD798E56000304C4B3F25A28ED1FE2D2F4F76F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  SecroKit v2.0/img/telegram.png
- Size 10KB
- SHA256 ba9e8c9171a46c757bc55938cb3c4bf9327ff1c4bd62a39b14def67917135625
- MD5 4f4648cb0b30d3c940ddebd003466938
- SHA1 109662fe434cd283672931bf5798ebd71b3a4b7c
- SHA512 7f23fe80fcaa7bb0bedf9bac7e850b1ffd2c349e2176a58ae4cb3c7a948e81aa054844cdc60a040438f15c04dedc9b56d121dc955d3385fd86ba699c9c9c5891
- SSDEEP 192:nSWOlZCt55nzGubbz3kGKdsnqGxfMzS3e7U4NHt0Yj7nRIQCjiYYQoZq:SWyCxTbz3k+FfMeO7UwN0YJEjiScq
- TLSH
  T10832AEBBF530F61E8F451E0D422158D17C1950BFEB674FEAD0B28C2D059AD4A8AA80E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28