5a37abc48934ae4a4041dde2551ad36894997cdc912cbae28394d225df5b147e

General

Target
ContentWarning.rar
Size 20.3MB
Sample240615-tk35wszglm
SHA256 5a37abc48934ae4a4041dde2551ad36894997cdc912cbae28394d225df5b147e
MD5 75a5581550b14c5019e56c9df71a1e63
SHA1 72486bdffb654304a02c1e665738ca3a8fb4fe5e
SHA512 d29f7a7b3680ede13a44fc2e5670fb32b85484b47aab5b741a40ce3bda98cd7060d8b6cd4df9f89f75f9e5e375059ea53c8a70850f7d096b8c88b4cbfb439f34
SSDEEP 393216:GedMHlzaO5R5PtWajUVwV9lJHn/45uDTBDIuO2C8Rfy85TAfEj9inwYRg:HdMH55RRt/jUopBDE58Rfy89AMj9Lsg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

pyinstaller

Malware Config

Targets

- Target
  ContentWarning.rar
- Size 20.3MB
- SHA256 5a37abc48934ae4a4041dde2551ad36894997cdc912cbae28394d225df5b147e
- MD5 75a5581550b14c5019e56c9df71a1e63
- SHA1 72486bdffb654304a02c1e665738ca3a8fb4fe5e
- SHA512 d29f7a7b3680ede13a44fc2e5670fb32b85484b47aab5b741a40ce3bda98cd7060d8b6cd4df9f89f75f9e5e375059ea53c8a70850f7d096b8c88b4cbfb439f34
- SSDEEP 393216:GedMHlzaO5R5PtWajUVwV9lJHn/45uDTBDIuO2C8Rfy85TAfEj9inwYRg:HdMH55RRt/jUopBDE58Rfy89AMj9Lsg
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1
- Target
  games/ContentWarning.exe
- Size 20.3MB
- SHA256 4356dc595e7a949591e9d06f0f066437db9aaa4f8c2b4864f639547ec3eed2da
- MD5 5ed01ba06cd792b29b36a99af68ff31b
- SHA1 07c79cf62e13658ee512212efde629b5af2cc097
- SHA512 ae98d00260c4d65529c699883b80c0b67b25675eac39cc6d9f07a32a016b0f8461cf9c374ae048b83451b0e34fa72644173efe8eb366996f1ea19f3fef6df04a
- SSDEEP 393216:Au7L//LQfoSBfFZNRwSo68dQusl8l99oWOv+9fgxQS8rJGEvuz:ACLLQfZBfFXR668dQuxDorvSYxn2f
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Drops startup file
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral2
- Target
  xlbstealer.pyc
- Size 40KB
- SHA256 0ce3e0f5313f2e2cb9515d3c0a4307bde664e462420847bc53c7a9e5fc0aef45
- MD5 3b4c432fa2dfc65b09981803809fc084
- SHA1 e21d75052d34499a55b49dfd235a65cbbc8cb74f
- SHA512 0dfb8f9bd85547d27f472c36ee9bb3aa9e1f523266da898bf714c6f0972917976b8952942aa6b795a0fa7fa21434a84772f3f212f202f2557a465fb5884f192d
- SSDEEP 768:z8q+ewxN8RM4PjYHA1LgKoX3T5vqsmySr5VUIHrMeH53A2UcVAQnb0RwC:rKuRMIt20smywVlflUcOQQR9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  games/Mono.Cecil.dll
- Size 348KB
- SHA256 769a59793d4b8885bbbfbc5aee8f57a0d4e34d275c56c60c03994309b87f67e9
- MD5 7c40214d60b54749a1a7f79ea6f62bac
- SHA1 a240d705b52fb1a78cceedab268db42cbeb47512
- SHA512 66a489988d15f1c651061656703b6fb03c4c6ebe82bcb0d48246c760e3764e4a7f2ad8d1653c90401fba6aa9974586d36256ad3a47e1112c1f38488a8818ab92
- SSDEEP 6144:NimznQ2nMpRAX2diEIn5o4gcuomZSFrIb:XnB2EELcu0Fr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  games/MonoMod.Core.dll
- Size 213KB
- SHA256 7fafdd61712040dfdc6c6160f32a165084e24fb3a1f3466ab42a463f9b1324af
- MD5 3c7acfce818b5ef795f795d436d978d3
- SHA1 d7994e2082a7069a634638deffe64f1077b3343f
- SHA512 6ae623e710ae43f8b902a8580141ab93e85968852de0729671648e8edcaff69919793bbfa04cafe506d8ae359d709f5232b0d7fda3f048264600623a73c5063c
- SSDEEP 3072:meTaIQQ/OZRN0sUI5N9OPPv1tZ+S/cjrBlieAMqRz6lYEU:meUhdno/8SqfWMq6YE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  games/SkiaSharp.dll
- Size 422KB
- SHA256 460d0da07e2d1e5b70220c6f12f74c8c485d641a8bd6e4856d99f66dff4cc105
- MD5 ed17ceb7b96274d0aeee54e9b65a3ca4
- SHA1 22fa6143a806442f500b79a4193d7778445d12da
- SHA512 3c9fe78cdd0361fac097aee789afd7ff82112cf616613aa79b8034f326307d210a241d007a97674adde739ed02703facc27b3c7f2b3a3033dac36479a42a0f94
- SSDEEP 6144:icjafCcoFzL/6zZbkvVBeDwMKRuTAFicmKda/Mh+SbgbWrUfo0sSrF4mmh4mmSzZ:o06zZiAACrI50HzznoT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  games/contentmod.dll
- Size 63KB
- SHA256 09ecc2b85dc12b062df8b7dcd5ef2c3b3e50d04cbbfd8c7df92a6f799f34ecc8
- MD5 d145b9e038d5008d2495adec5686640d
- SHA1 0d0d3743190f7a6c7e0db8e0607a6f64de41fef1
- SHA512 b993fd3132dedaed8f16965ccf0c6efbd55fe811bbfe4ae55a8ad3a54a143a56c092313ffe9b8ae18bea00bf6be7ec343b509dbb3a674afb8f0061b1dd3c245d
- SSDEEP 768:tlylCrLKVElBjTCcYdSxCfY2Xw7jdhV9JHHxRM3iARkVMkgHS/BZrdA3jx5iaYTY:tQRACfY2avV9JHI3TRkVfv/nr4PRf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Loads dropped DLL

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7