empyrean | 6005cc0a1b142455d353a81341b81084b37693c669811cf420386af065793a73

Sharing

Copy URL

Twitter E-mail

General

Target

Inspected+X+l1nez.zip
Size

64.5MB
Sample

240814-zlzfzsycpl
MD5

840b82c21817bb62bd7d9bb39fd62fbb
SHA1

1082792d1c23cca4c37fec9dafb2c256d146f32e
SHA256

6005cc0a1b142455d353a81341b81084b37693c669811cf420386af065793a73
SHA512

1ee64b7425207089692e09a4caaf93cded975ec67916e9ff00946376f5a37551410ae6a5b6bedbb98c0e8c4b99aa3eb2b426c69d07a137ca721bb6364120f095
SSDEEP

1572864:7tnmcbbd1kaTv+dNp7hIJZAYrJDG2ribrGlrQTVkR4Xe:7tnmYd1fqlAZJS2ribSl/4Xe

Score

10^/10

Malware Config

Targets

- Target
  
  Inspected+X+l1nez.zip
- Size
  
  64.5MB
- MD5
  
  840b82c21817bb62bd7d9bb39fd62fbb
- SHA1
  
  1082792d1c23cca4c37fec9dafb2c256d146f32e
- SHA256
  
  6005cc0a1b142455d353a81341b81084b37693c669811cf420386af065793a73
- SHA512
  
  1ee64b7425207089692e09a4caaf93cded975ec67916e9ff00946376f5a37551410ae6a5b6bedbb98c0e8c4b99aa3eb2b426c69d07a137ca721bb6364120f095
- SSDEEP
  
  1572864:7tnmcbbd1kaTv+dNp7hIJZAYrJDG2ribrGlrQTVkR4Xe:7tnmYd1fqlAZJS2ribSl/4Xe
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1
- Target
  
  Inspected X l1nez/Install GIT.exe
- Size
  
  65.0MB
- MD5
  
  ceee36c1a922a546df83f5b8b225b6d6
- SHA1
  
  67a159a599b31cf5c46ae5287063ce103665321a
- SHA256
  
  ce022a6a19e58bbbd4823f51cf798b006b4a683b93b0616a7bb5beeee901da98
- SHA512
  
  eae0604b2ab823d7f9bd5b384420f0e1deafd3318f5d3a6d08b08d4482d34aaa7a2e418323d9707e962b5fcdcf4b26124cbe22d1f1ff6a9900bab02ad78a4bf9
- SSDEEP
  
  1572864:Bp3IOX9npCMJr7j5dXH+lbG+DH72eFy3vPjGtLOD6dU:Bp3IonpLb3qlHCeFy33P6dU
Score

4^/10

discovery
behavioral2
- Target
  
  Inspected X l1nez/build.bat
- Size
  
  660B
- MD5
  
  a1bb959efd31c4c1d4ce68e1d28dd965
- SHA1
  
  374aa46c384805d5713a52a07332f839fd88d3da
- SHA256
  
  157c8e2e156c5073ed6250c5c59a528615356d997bd5e9fc03ee3fb48bf46926
- SHA512
  
  ca20cde34f008850430f48e7b627c7ed3834467975bf6855ba4db2c1b73de7b19066c09475c8d0b88aaeefb057ccd71e54a680d8b034107cd7ab1b9b299b28a3
Score

1^/10
behavioral3
- Target
  
  Inspected X l1nez/builder/main.py
- Size
  
  2KB
- MD5
  
  16d62072241d9eb54f9c6c5ad238054f
- SHA1
  
  76e4560e74f2dd01ba1a6d0e40bd4d2e869bfe92
- SHA256
  
  0946e89be7496f4eb060e0ee4791eb54edd4eff89a235d8fbb2f515245897836
- SHA512
  
  606e20e75655ccd55ec9810b2df136b59112708a765c82a6a220c423b002ac6b45f3eac2d7ee9347cf09624b45dc5b7788e03e91cbf79a594efb61f98ed187d7
Score

3^/10
behavioral4
- Target
  
  Inspected X l1nez/builder/util/__pycache__/build.cpython-310.pyc
- Size
  
  2KB
- MD5
  
  5610437e35c3e836574c3ac3c5c464e2
- SHA1
  
  cd9cef7faa405bd50292d1b81199a4b9c23e9639
- SHA256
  
  3b96554931c2e3c5b0b2aa87a782e1d6c05d81a90c7c4579ca2334b7c5835762
- SHA512
  
  ffd88ea31c270a35fe736c2c49c29d309e5a544f778d37b78a991173fb2438c4bd41deff34bb45fbf8ddf90693061f678441961a66e0109ebd9f4eb7584f1deb
Score

3^/10
behavioral5
- Target
  
  Inspected X l1nez/builder/util/__pycache__/config.cpython-310.pyc
- Size
  
  1KB
- MD5
  
  fb2e69f706ae8b75ef8f0dc387bd1327
- SHA1
  
  76ea722a1bb35ba45b5b56d5f414f3581ab1d205
- SHA256
  
  feaa329da11869c24bbf56d46b1a210db6bfaa417d9b2d1325b40d2b67d95fb1
- SHA512
  
  cfa0e3aa2915005365326d1221ecfb08e4ad67e8f624e2cecfce3e3154bb5249d0d59dba0825f2ceccf3c47fafc47e56ec8a7f352b991a04b9db4ad2160afd22
Score

3^/10
behavioral6
- Target
  
  Inspected X l1nez/builder/util/__pycache__/makeenv.cpython-310.pyc
- Size
  
  1KB
- MD5
  
  e89fad302e91d6b4bc1b1fdfdb0c6941
- SHA1
  
  fbb8558150baf9c8a8286fdfe282d170809d3a9f
- SHA256
  
  3a2936ff2b439086171c1fd365f3c38db98c66c87cca4f94853dfe429b87dfef
- SHA512
  
  b15a61b3af4666a850e79c3cc16f42b945bbe4921c21333e3e500abe05b84c22ad57cea097a32c64f3514089ac6da769c2741e98ef4ed7908c0937f16a4a94ee
Score

3^/10
behavioral7
- Target
  
  Inspected X l1nez/builder/util/__pycache__/obfuscate.cpython-310.pyc
- Size
  
  1KB
- MD5
  
  76fd23b69f30ca7b07d307e54ff42435
- SHA1
  
  e3a45ee6ccefb770b29ba3d18d94a33844084ae7
- SHA256
  
  77703e16ee6b90fc254b5d52c78c224e8c7c6ac20ea7d8cdec56eb033b200bf6
- SHA512
  
  a44f139816177da17c6e7f84f37f77dbffb38bc313507ff55a936dfe327c008473ed76cc860bdf411a6667fbc6dc28887f14c161fdcb95f8ed1df9fd63e521a2
Score

3^/10
behavioral8
- Target
  
  Inspected X l1nez/builder/util/__pycache__/writeconfig.cpython-310.pyc
- Size
  
  1KB
- MD5
  
  8cef5bd5061c3861a805e12a07d7d068
- SHA1
  
  f1240f3b1f22c994005d242b7fd42014a4a1ff88
- SHA256
  
  4dfd2051a3fe875894402fbb1d9ce75d967e4c8a3962c438f2d30232f8dcb00b
- SHA512
  
  6fdcd3d2445692460496460b105d7b98a0f846894ff82cf5e99b06eb8417c4cfda2e7afb2caa20325d97f59e6846687ca9d59649562fc3368d5d545aa4628d96
Score

3^/10
behavioral9
- Target
  
  Inspected X l1nez/builder/util/build.py
- Size
  
  2KB
- MD5
  
  b972c3bd98189fef3649132428a6b5d5
- SHA1
  
  2f9a0e3bb364be7614062a716e97065df9d091c3
- SHA256
  
  ae2d7a498db4f1ea8d4cf1f71a9a60e0379a8b6e287d2c8b7cd2262f45b2d88c
- SHA512
  
  b9e9281168c684a8136f299e50293d2d0c0fc92c70ee482a7ed27f1340627c628c0347ab36ee33c72ace95595d2111ee103fbb1ead1e0dbe55a3e85dd2f644f8
Score

3^/10
behavioral10
- Target
  
  Inspected X l1nez/builder/util/config.py
- Size
  
  2KB
- MD5
  
  083bc8cc27286e50c08f0f53876f48a8
- SHA1
  
  2a1d0ade3e5b4abba267b9ccfeb2fee681a7f032
- SHA256
  
  b5f7ff2bfd9a7fc444076ac74dc7034d9d366152f4fb288eab481597bbf54672
- SHA512
  
  832bff211d5fff703c1cfe5b54777e5707c4e9703499edfdaa25865bacb7504bdfe41814033e6269537d692e0c53ee58f6c80184697564adf6969931370f50ca
Score

3^/10
behavioral11
- Target
  
  Inspected X l1nez/builder/util/makeenv.py
- Size
  
  616B
- MD5
  
  9636255856ad526bbc00457b24373c54
- SHA1
  
  6fba0fb49e9698f9e8a818dcd02f236f4b07a428
- SHA256
  
  210579537257392e13074d978b255c0e2313d9bd089c6e6635adbc0109a90789
- SHA512
  
  d29b68a830bbe0e8190243df51a88e883da75cacd5b9824ec98f63c34e07582b49d5281ee89569d00520b0e567eaeccefef60e223cde8de2b06a29ac710b23d9
Score

3^/10
behavioral12
- Target
  
  Inspected X l1nez/builder/util/obfuscate.py
- Size
  
  1KB
- MD5
  
  b5854b3148f23dbb9355d3a30e3315a8
- SHA1
  
  e4273fcdd3948fa75960af037bc9a916705c553c
- SHA256
  
  c9091f59845b3201e05e4294dd14c54ba77ba3e679998fb4b37ea204544a4650
- SHA512
  
  1179ac8391e9ec93c23704eaf3c630ce6fcd3dff5d372449addb7639e4bebb05328b1213b32ce99b37b0ec046b23488d9e0073b7de3129005c57d0056d49b126
Score

3^/10
behavioral13
- Target
  
  Inspected X l1nez/builder/util/writeconfig.py
- Size
  
  555B
- MD5
  
  2b14c9284e5337eb2af6359827b523e9
- SHA1
  
  74f35cae83f8830c181240d945c94c162160c331
- SHA256
  
  eb1007f66f1c665f2a05156e78df47b7386736c9cdc272dbcc114ab3291029f7
- SHA512
  
  264399eb65d810e47bdd85a4cea943ab06937f44cf6510b71f4202cc745d49b3087b369a64d34e9db5e16365defbfd8a45336b0fbd0dba1d3e1972093be94dec
Score

3^/10
behavioral14
- Target
  
  Inspected X l1nez/install_python.bat
- Size
  
  686B
- MD5
  
  f30718a354e7cc104ea553ce5ae2d486
- SHA1
  
  3876134e6b92da57a49d868013ed35b5d946f8fd
- SHA256
  
  94008c8135d149fecd29ca62aded487f0fbfa6af893596ffc3e4b621a0fe4966
- SHA512
  
  601b2256ea709a885741f1dec5c97dda6fb7fd4e485b4afac3503af1aefe73472e5bc5529c144814a3defbc0b51ac4b50e02a50dccc69b41ee5d87a3f4282874
Score

8^/10

discovery execution persistence privilege_escalation
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  
  Inspected X l1nez/src/components/antidebug.py
- Size
  
  11KB
- MD5
  
  47ae6ac6b52d97d6b952b140e82ff9cf
- SHA1
  
  eebba9b7e4dd198d4050e597bab281b87d5785da
- SHA256
  
  92e1b4427e17cc7ffcce8f62a3bba16455110086314577fa76ba87804dc6803c
- SHA512
  
  97bba85c42ba15f48f2c21843bbccc4af7a3b08bd93d44db5361458900c9e3a3d0607cff38e7b078883ffc6d8fad0dcb9a422015f1165442bd7ddeaa32707e5a
- SSDEEP
  
  192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/K/m:0ZTd+nJYJzrn+rgeeWaOJjd5vpVCH
Score

3^/10
behavioral16
- Target
  
  Inspected X l1nez/src/components/browsers.py
- Size
  
  12KB
- MD5
  
  b8600f25c52e297d804a92c33e251ea1
- SHA1
  
  b3dab1c4deaf44696298616b853f5cca15a6fadb
- SHA256
  
  e2e84efb58f9f3b9d4ae48750d3865ddc5e48f291de199d368d3394fba00f16f
- SHA512
  
  9893b60842ed80e06ba61fe624cc19f93da37724e73fccf497a8b014d64839d182deb8c36b97f44f998f3876a63d677f3e2a20139d8ae41c7a99996a77fec5ee
- SSDEEP
  
  192:Yo1etBr/e8k01PlE5YYul25ZXIbHYsq5w/wVbPRfwmbd5NcbtU03vbt2w79G+R5:gZPlEhFsq5w/wPfwCN903Uw73R5
Score

3^/10
behavioral17
- Target
  
  Inspected X l1nez/src/components/discordtoken.py
- Size
  
  17KB
- MD5
  
  63274719413421727b3ab2c9df8b9a09
- SHA1
  
  169aad0bd9640be8051178bda9b9dab2a6e0093d
- SHA256
  
  7651900ea4aae1395769698145c94d9b10aed19bd302e2dc697cd8ceaf62c88c
- SHA512
  
  e3504a5a938861162cfff984d1f26096673a3a207dbb862521449b0569e3e31decc6a6b85a809bc6674f06bd78d1d0047d3a0d2d6dd2612659f88040ce878244
- SSDEEP
  
  384:Cg9WPIDbhMUN7ir4hq4hM6vPhQ6pn3hRJPuEbq7rqLmBvSlPg:YIz704g4a6Xh5pn3hRrbcr8UKlI
Score

3^/10
behavioral18
- Target
  
  Inspected X l1nez/src/components/injection.py
- Size
  
  2KB
- MD5
  
  deaf00b5fa1e87d383d67653e7f9e632
- SHA1
  
  615abf76bcfbaf3249e65f5d764cbc8a9c457317
- SHA256
  
  9933b323c85c9bf087367660bacf9e5bf46c5e869688af46922560c9b710d9da
- SHA512
  
  255fc671802131cfa7bc498a0877116db35fd5b6380b630ccfda37f282956d8a1a6f65dd5414e84659970fa7f461c45ab1b7dedabef8f11beca2f121f8260e8a
Score

3^/10
behavioral19
- Target
  
  Inspected X l1nez/src/components/startup.py
- Size
  
  1KB
- MD5
  
  44831bd9c7a958ab12e92b866eb2b245
- SHA1
  
  b6b5ea7b224b6971da270615c184001133b903dc
- SHA256
  
  ce22516047464a292ccf0d41082ce14276bc24beb48e35fee1cb358baafd6975
- SHA512
  
  7be8fb29d96de25ae7345a3db58570e9a59bcfcd1b0de1e417b02227176d191c2804a42063f71ede26701bef629896140bd2484e0e6ed0259574137aa3eb29c2
Score

3^/10
behavioral20
- Target
  
  Inspected X l1nez/src/components/systeminfo.py
- Size
  
  6KB
- MD5
  
  cf20914f3887ea4997a40619f54d9e2b
- SHA1
  
  ae7022ea57201961108df9544c958ee3b57f0970
- SHA256
  
  5fe1b153071f76d1e2c611050fd315705fe4d65577e2dd339bee1e2268087fa5
- SHA512
  
  d50f5702de2ad7c6b0879b6eebd572a8b70853467b13b497196ed0b3baaed997f5aacbbd9a0760734d4879285a3d8c25ea91a168eb43b486c38ce40af84a5f1a
- SSDEEP
  
  96:o62a5QJPYtskjqXmBHyCOMHdpvlGa4sVV2iHhhrqZb+zadcTP9eTnSIf:sP5QRyGTka/T2oOZazaaL9erj
Score

3^/10
behavioral21
- Target
  
  Inspected X l1nez/src/config.py
- Size
  
  192B
- MD5
  
  36b6f6034baef719be778b89b1226a6e
- SHA1
  
  f02c63ff4ead4a66e375ae8145d409537b302d78
- SHA256
  
  70773b420265012d9e1cb9d9bc8a83d8a4ec055d3907bd85102cce4a1853abac
- SHA512
  
  67e3164601de145a4ee2888a1772aa8a12cfcc8a2edc995861fd316ab187d9ae3cb0ee36a9094fdb79db8c5d907f50b9dfe88828590285f02c7fd65b5cb6e129
Score

3^/10
behavioral22
- Target
  
  Inspected X l1nez/src/main.py
- Size
  
  1KB
- MD5
  
  db5386b5f9edfc7500d0508fc49a9a59
- SHA1
  
  4c79b803e2090d86dd38c7671b1a9b5322b3cf3a
- SHA256
  
  ddfbeb221f72eaa4c8e2e4dcdf604307dcfd0d9168c0837a10110cd809f82060
- SHA512
  
  a5c6435242930285e41e98e7284fdb0708f654b849e697bd10e8ad12631d5e83e647b775a1bf6d61b9a2958d4969c475055ff3071affcefceed3234b92d69634
Score

3^/10
behavioral23