2a3c721eb8e2e7c358839e4d4f5323a1e02bf050ad9229f4734771a50f0ad824

Sharing

Copy URL Twitter E-mail

General

Target
Volt-Cracked.zip
Size 166.5MB
Sample261107-xryqjaev61
SHA256 2a3c721eb8e2e7c358839e4d4f5323a1e02bf050ad9229f4734771a50f0ad824
MD5 dfb946c8de43a8ef8d13d7212bb56139
SHA1 17a047dd73f7d655cb425adaf704e0336c0e9c1b
SHA512 7f7ee7a91caf180fa3d34b0eaf9980cc2c28e08aa1bd2b51807499ff2446eb2d73aed09e9b0cb17944badfa8f34263ac212038537c052b999c3ba32da7a2cdbf
SSDEEP 3145728:aHDGEbbrHkBkP+lMAkGq+vO1BHg2ehLhbluk6bd/VTPW9GAk5v4R74Ui0Y538hd5:aGEnh+kLxrg2WbuzrCk5v6sS6U
TLSH
T1A28833E1D30DF1593765DF8188960F29931823A27F2236DC7F0963A65091BE968F6C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Emulator.dll
- Size 16.9MB
- SHA256 9c849d1bd8b048bc11c2912d407770c54a71dae918c7f65770edc0c5ea87927f
- MD5 a2d80dba54c777b9a6a0c0a9f24e3db4
- SHA1 0a01f9ab3034570940375f377694c8c8639f1fff
- SHA512 821f9070d497336a2b96bee1f507cce668e93bd6afdbc5e60b4865a719c725e8e8541f9d700c7f14e0bdb4e5a020fdc475022684873659ea748b2a2e59a27492
- SSDEEP 196608:hnPxAwKeSgjyKVDXUNDX/zODOhcjRQhywjxft/zTz/MVePbHf:pxU9XbOCuRdwlfdz/TbH
- TLSH
  T177079E1FE5531C1CDBB58B709A1E0BA3E0E1B5880AF86E7D02D855217B233D8D75AE87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Executor.dll
- Size 30.2MB
- SHA256 de90e442bf381d0c3ad09c9b9480805591d8d7ecb036fca875e7a0bb72d357ed
- MD5 db50c601acb31a895c6e565d908715a5
- SHA1 677c99e7a95bb42cf5c96e973251f23202536abf
- SHA512 a1d3d6457d8d377ba4400ff522eb79054454c705538896f0088a67fd614af3b5e97d2fabc8d6dd8171023936e53ed671bf509ad4a6437a9a18414075d2177e64
- SSDEEP 786432:zphiq7xHTXJLsuFiyFM0rTlY9AmKEcxTlkQpf:zpsqtHVLsuFTv0hcxTT
- TLSH
  T108672302FD42C9A3DE6292348CA70B176372DEA25B83930F7788321D6D777DD0E9A549
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Volt\lsp\luau-lsp.exe
- Size 6.0MB
- SHA256 43dc7a51985872f83cd2f644cabf251023158b432a7cdcc795ac1b36dab3462a
- MD5 e44b9ebe7211e3aa6ff3bab4f8c8451a
- SHA1 4d0406042cf46fb776eea8645635d21f8cc50308
- SHA512 ce57f9592ec2086a1ddad05d6e0edc4a13f243e47ccb12cab5bfe3939ce4565a8a360c55992afd3799af7bd50d992309d4ca565462bbfde6b60e10713a0a99c5
- SSDEEP 49152:NsY0bbZDDDDDD7H5c7G9or26czNvOgPQqWv9UHtS3XLZvdfEfPgp1LY078qWcHGy:Pifc7GXCn+361QjvQfyom/BOa
- TLSH
  T112565C3B629801FCE0BBC179CB5A9953D772300A0331AAFF05E145A66F57AF45E7A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Volt\uninstall.exe
- Size 77KB
- SHA256 bad113335da7f608ef20eacbd4c0d3f8a57eeab092263f01a256e785ce089948
- MD5 97cf23ea89caf74d69dba375d58a7aa1
- SHA1 ddc8b72275d220c4f97d7b8ae5e594577eab0b33
- SHA512 3a325e35f7636dd008b5d4f6d7c1df68f4828f49566eee260d5e40cb800542bc5b7343eee9a59992b2884347ff0a1e37ecf7b4f8c2e62842f98d3c9bb83fd828
- SSDEEP 1536:krX4tpfcUjrwLxZYE8ksuOgdLeAyNx0HocAmviVqH3Kn9y4C:+X47fcIrwR8ksuOceABHzvoqHYU4C
- TLSH
  T18D73DF0467E0C8B3D67207311E7B5B776FF9A42212A89B1B1700579E7D72A81EE0E363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral7 behavioral8
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  install.ps1
- Size 6KB
- SHA256 cbfa648d368b2f54c0feb7bf9272ce73caba53912cc0cc64c17aff9a7be234e7
- MD5 685023dd427c3c5876eeba3cf7353f35
- SHA1 0b95bb665860fe019ef38150698043af3505908b
- SHA512 b7ff4e88d0d94bd98692f7c5159f802618a5ca41068abbef324b7b0944918e90678621c869b2cf0e9ce763775a28170a64cb5a9fdf604ef4aa52e0fe4edccde5
- SSDEEP 96:MvTpJMEalr9kTjycbHIfZSvI1BSExapvtQIj+cFE5TZNhTtJn6WsW6PovHqkr:4TpJMEToLSExap07XMWsW6PovHqkr
- TLSH
  T10DE1303984142E3EAB530E5BA9766DEDB4278536C1864DC0720C99E43FF232CCF654B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  setup.ps1
- Size 1KB
- SHA256 a9b698f3ad763c484a990bdd96aaba65de689cc2b1e7f90694890b289a643fb5
- MD5 bec671c0cc6eaac2b1d14f1e4c326595
- SHA1 c5ab45af46dfd0452768f5b32c135537f249f794
- SHA512 e459b88d0c7e8c0b778df22b1e5490848d710352b29744defd348b4cbd9b95cf6c17a4cc999acd41b070cb478491b64f15cd18a51d47c88c009444f901a8cecf
- TLSH
  T1E541F0284464375BE993012FF0A6EBED794BA83685460DD4764E05E938E313CCFB28F5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Drops file in Drivers directory
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral17 behavioral18
- Target
  tauri-app.exe
- Size 14.5MB
- SHA256 1010ae9bf0c27cc65f88ac3014b344c99aa4524166c1eb9ede2c84be7c0bf958
- MD5 07c0de36ac490a0964790a8c11407050
- SHA1 d7e67b49c6322b3e5c38da8cccf5b1e1e7d4b367
- SHA512 aea251561003eeb2501bf04dfb5ec4980a6ac93651cce3a6ef0c221c4ab6f8f66f8b57ea559d59c21192b56264deb29903e04edf9e2f0e8a16d1f8c2fe71b64a
- SSDEEP 196608:IR35yu2XGRFvRpxyxHeXtUh9grGn0MNBp5qddpSiZWTYE+u:cVzFvL4xH2ihKKnxBrqdrjZWsE+
- TLSH
  T196E6AE03F39581E9C0AEC578C31AA637EB72B88D4521B29B5BE44F112F26F506F1D35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral19 behavioral20
- Target
  volt-installer.exe
- Size 11.1MB
- SHA256 69f1ca991564395011ed56712271cfe8f57e2cf7c82cf186a1c45a6496da0a79
- MD5 75bdfc13b09dbf0600746edddc83353c
- SHA1 0f41b9b35a7abbaba867bb81230013dc326422f6
- SHA512 47aed221de2ad2cb4c928f230a981a3d9cd369bbfbb4319cc2c68c512871e4547a6d2dd6a6f384865a8a3bb16351a17b10981bd5b335acb1ceaa6217d134da01
- SSDEEP 196608:tpGo/ZpFCGuQk5WHREe7vwl535dds/T+IfTMLnKG3NvB2uKBCG2EUjHnUueA0:t0oRHYwR7Dod5P2T+GYL3NJ2XBL4HUuu
- TLSH
  T1C2C63373AE30C9EAEB4C3E738E544A56DA7D763744CC8D840615EABD705C1D82AFA8C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Checks whether UAC is enabled

Network Share Discovery

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32