7e190e48165cf7c72173ce84e0f0b164fbe794d3e45069408055ba7496da1497

Sharing

Copy URL Twitter E-mail

General

Target
FastAimX64.exe
Size 36.9MB
Sample240701-gseq2s1ejn
SHA256 7e190e48165cf7c72173ce84e0f0b164fbe794d3e45069408055ba7496da1497
MD5 132db3303d3b0cfbc12a578688c581fd
SHA1 198d5010e04c9ad0670c7a54a942cf4eba416aee
SHA512 f2c2568745a46920453ba6b500e02e078bc4fc45264dbb3df8451b38524f2765465a4cdc6a70b61dce554c1d3b41c44b32934d9a1f8a87109a0223ae1af7ae57
SSDEEP 786432:FYpCWvC8TK4HxoCoZjzlBeTV+WreWniTuzVVqGlQdEon/x3Ol5IPEWz:FhWvC8wrJBmV1eWniTmVV9lcLx3u5I8M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  FastAimX64.exe
- Size 36.9MB
- SHA256 7e190e48165cf7c72173ce84e0f0b164fbe794d3e45069408055ba7496da1497
- MD5 132db3303d3b0cfbc12a578688c581fd
- SHA1 198d5010e04c9ad0670c7a54a942cf4eba416aee
- SHA512 f2c2568745a46920453ba6b500e02e078bc4fc45264dbb3df8451b38524f2765465a4cdc6a70b61dce554c1d3b41c44b32934d9a1f8a87109a0223ae1af7ae57
- SSDEEP 786432:FYpCWvC8TK4HxoCoZjzlBeTV+WreWniTuzVVqGlQdEon/x3Ol5IPEWz:FhWvC8wrJBmV1eWniTmVV9lcLx3u5I8M
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

execution pyinstaller discovery persistence
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Automatic_converter_rff_to_mp4.exe
- Size 322KB
- SHA256 d4c83205cf6f3098ab6a757312525f4d14a57a819306eeea5c0d022b00b38cf3
- MD5 1b4f89bdb12a349de92ca7f1261e67a0
- SHA1 f368916850332757d7ed2f0ee335c16b9c9fc95b
- SHA512 f2f7985fbf462bc35e099b58308ddef91320d3d81040f77e7c1c0a3cfc3a4da50c849efd0f063c839848a80927398cc24bc8368d5b0b92014abe2ea7bdc2ddeb
- SSDEEP 6144:iibVlHNEHBpDDf2vfQ21NV0zUiCqWjH6YPON9q:igtCpPfGfZSWPf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery evasion exploit persistence
- Modifies WinLogon for persistence
  persistence
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  install.bat
- Size 527B
- SHA256 a67aeedd2738732a462eb4fb998d1f937aebd1fdc68072539a4774c0a5af1350
- MD5 c8774911b9bddd3fccb91264d715c7ba
- SHA1 132c223574d1d947ef259238ffc3820ddb525492
- SHA512 9bb3ae0d4762c1aee9c5d0b67702854a51d75a3a28ab8eed41c4b62006d6e3168ef80dcfac8167113f22760f7309d45e0277081f6b2a22a31dbc3102216f781d
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  install_python.bat
- Size 686B
- SHA256 94008c8135d149fecd29ca62aded487f0fbfa6af893596ffc3e4b621a0fe4966
- MD5 f30718a354e7cc104ea553ce5ae2d486
- SHA1 3876134e6b92da57a49d868013ed35b5d946f8fd
- SHA512 601b2256ea709a885741f1dec5c97dda6fb7fd4e485b4afac3503af1aefe73472e5bc5529c144814a3defbc0b51ac4b50e02a50dccc69b41ee5d87a3f4282874
- MD5 SHA1 SHA512
Score

8^/10

execution discovery persistence privilege_escalation
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8