620c31929c15f76b3399ec1851fd0b1b0c340358108a418ba768db0e35180851

Sharing

Copy URL Twitter E-mail

General

Target
net8.0-windows.rar
Size 22.6MB
Sample261018-1eptmsts3j
SHA256 620c31929c15f76b3399ec1851fd0b1b0c340358108a418ba768db0e35180851
MD5 d5bdd875ad1fb369cae3266d9feee949
SHA1 a6e366382024eb5f10a9e6068c4ca20e28130ddc
SHA512 e7e6ab408321f60c7bff9cf6416e88cfd99a66f06f80cd5074c342bea9d1b5b07df2c739bb8cd5eaf5d96e056e5c5f16e946bcc849e5afa2e1e418705d407d40
SSDEEP 393216:vV+kSMR+xYw9gPe+wQhBUYWZH8hvhlr4Bg7KC87nJS5/TQbGb10J9dTTeW6qCFkc:tOI+Kw98/L6CjrogF87nJiC810VTTwtx
TLSH
T128373329FB8B2D77E587C6013E3615F89A70FA1F841274F85EA56A2485BFB72017007B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  net8.0-windows/Spoof resources/NetFixer.bat
- Size 1KB
- SHA256 e8a9cc601499831a4403a657e9abdf9183ecae81dfa2533a64fb22afdba2bbb0
- MD5 347b92301d09c37047bf6b9252dfeade
- SHA1 a824e1fa36c96256fba93e76e36738a30aeecca3
- SHA512 2782c58c1ddebc3cb85c8fe843b00b978a9e97f3f390d0774d81d668a5a7ad94f0ebadb9de7e98b4105504c3ac7f50126f7a65fbecded1957bcc3d03fa507a64
- TLSH
  T16341230258901770C983811C1B9FC980C920B09E669759B9386C729E1FD7FC992FFDDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral1 behavioral2
- Target
  net8.0-windows/Spoof resources/Network Settings.bat
- Size 2KB
- SHA256 065b5e379f5a2e4d1ec34d2f6306b3f390b45e9d84220ebb0dd8e6c668821dd9
- MD5 e0903e5c9b9ab16d166b4add792268aa
- SHA1 784805f1ecc2b9e7a6181dc46da4c90ea12bb573
- SHA512 5275a7a147afc451a458be25bb870334263a27b8f54db5cf3b5156d6271c437efbd374c08fb5f4893109ee9cf4afd60804274454ad101ab5c8bc93373fd0d6cf
- TLSH
  T14B41BE47B845847641CDD610DCB1F0967E56824F33265CDCF0AF81A897843D2B9FE6D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution persistence privilege_escalation
behavioral3 behavioral4
- Target
  net8.0-windows/Spoof resources/Spoofer/AMIFLDRV64.SYS
- Size 29KB
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH
  T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  net8.0-windows/Spoof resources/Spoofer/amigendrv64.sys
- Size 36KB
- SHA256 811e5d65df60dfb8c6e1713da708be16d9a13ef8dfcd1022d8d1dda52ed057b2
- MD5 9accebd928a8926fecf317f53cd1c44e
- SHA1 d7d71135cc3cf7320f8e63cefb6298dd44e5b1d4
- SHA512 2563402cc8e1402d9ac3a76a72b7dab0baa4ecd03629cc350e7199c7e1e1da4000e665bd02ac3a75fd9883fa678b924c8b73d88d8c50bf9d2ae59254a057911e
- SSDEEP 768:cBOmh786zi+NqkO8Ouwn3uivOyiRZSFInq1os29zjTUD:cXi+NXwnecOyiaFInq1lCz+
- TLSH
  T1F6F27CC25B7824C6ED97993082E8D673BC71F6A61B1083EB01B0D0251E93FD16B3922F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  net8.0-windows/System.Management.dll
- Size 71KB
- SHA256 c5f69a258fc609d42e6d50903e9b4449027f4d332faa8daec04bdc3cb9286d4b
- MD5 bfce986befff53f3270f1476bcb11c54
- SHA1 98f67b72cb9c3943c390ca2c00addfe291f1c25b
- SHA512 8e4a59352284f2fa15b6aa7e3af26314569f70245ab7fd3e347b299719f62fbca712b214e2955f1c50ad80d7e0136f08b3230f7f25f462da0e2b16dfdc956b05
- SSDEEP 768:xtppppIpppp4ppppXSsZPk7kUTAvA3DZUm8CT/1dB8eVE9hoQD1kiSLJKdbYx6/H:xhPknOHCT9xK2QD1xS9ycxyiKzR
- TLSH
  T15F63A411E7E883FCC9E70671B4F287710E74BAC52D21EE5D2E1A2219286BFC05761E76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  net8.0-windows/Warframe AIO Tool.dll
- Size 23.9MB
- SHA256 84f94baa116c30b3057042029c0e851add9c1d6e50e2960e673cce1bfd7f3bba
- MD5 b67a9e0489543203bd3e351380fdc90b
- SHA1 a8fcd8e036b1f911a72832e96faad3039e8d44be
- SHA512 49cd054022f365971c107dbd70b7b10376672746149d59853437d09ba503cfb8da2a4b68e1ecafafad06e0c1232947b87bc00e4c84a414c3eec1d29a257bf3d7
- SSDEEP 393216:LElupeJ6FuO38woCePPMWdKy4JqOOWY+FD7kuzs2QH1zDWr9Zg4X52:LElKeJ6d8wO3MYG8i/k0Cg9+
- TLSH
  T14E47128B623136EDF0136A796DFB65A0CA667E1D683591C8D830FFA2357BD012F1710A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  net8.0-windows/Warframe AIO Tool.exe
- Size 188KB
- SHA256 ede849402926b7683f0f7cac07327952cb56292a314c8a565915d14229cc9641
- MD5 55fce6fd28eab84f62151247a5909cb6
- SHA1 0dc0c5a6e469478505d3b7b8387d4df7c999df36
- SHA512 2817aeea2b9434516a80bcfe48e05788c54190b8f7ced4e8bb1476b295b812db9e953ea846a8b9b6d2f5b030f247db164edc8ff41ca8100692a85eb1817e66b0
- SSDEEP 3072:FAqeXA/4yIg9vkNPNu6H6xCYOikUE265gJWG:+vgvkNFNaxmcEAJW
- TLSH
  T1F7140907B69891BEE1A29578CD92C841FB723C154F7166CF73807B7E1E72690AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  net8.0-windows/runtimes/win/lib/net8.0/System.Management.dll
- Size 304KB
- SHA256 b2d6e7e991dc9ef154b29f4966f04fd8ed4ebb2c1d1242ea1d5f3e90f8ae5143
- MD5 e1422b4c04b923dcfe00a55290dc18a6
- SHA1 0609ecde6bc8a87f88bc32b98d19800ff19529b6
- SHA512 297f54fceeb0cde17745323e7c41fea830a376fe9c3cf92a692c48199c0a05f1533a3045fd9c6d21352d084aa9ccec7b6cf630c7df49b52ed4025ae156509a7c
- SSDEEP 6144:9q4+FutZbJcMFEG3LbPhmlmsUwHdYhJkXUXewcn:j+FutZbJcMFEG3/KmFwHdKIUXmn
- TLSH
  T19764386033F84645E1BF4BB6A0711491CFB2B72B6A0EDB6C0D617CAD18B175186A733B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15