General
-
Target
ZaraPerm.rar
-
Size
1.1MB
-
Sample
240910-lbhtlaxhpc
-
MD5
3b88224ed4c01ad4629519dd69998dbd
-
SHA1
6b557109a6aa1b7fac1850daa4d3b9d60d704f3c
-
SHA256
c82bbaafb44f7529b19744c88c66ae4b4dda06c10c681a1a0868b37405a61986
-
SHA512
225200808218afb1d25272234701443881c0b781ba2ddcd78bbb6c1a2709a20f48793c9e52b6c925fa76bbb27902367a7e953a4a82f034f6dddce8d1412c96ed
-
SSDEEP
24576:f6DigmGOzDrHzUYvlksRWGgSpsnnpEK2SQPwlQd+sFtkGrkW:cxm/zDrTUwjzNpueKn6wlQ4alrkW
Behavioral task
behavioral1
Sample
Bunifu.UI.WinForms.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bunifu.UI.WinForms.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Lucky.exe
Resource
win7-20240708-en
Malware Config
Targets
-
-
Target
Bunifu.UI.WinForms.dll
-
Size
1.3MB
-
MD5
7bbf428fb683748a73594b9791a39f96
-
SHA1
341d30a12cbbd2e8c654fb1ddc382017ac83b2c2
-
SHA256
a870923034e7f135a4e34a3192c39fea8bf2f8f6a82e700b547101245e5f9de9
-
SHA512
1770ee20d88f83cfe343800a4dbc95eff0c9c253e2f42cd4d52baac959e1c8385c1c208610b10eeb96782283010ecc36d51ecce9bb815d3ee480024936327c58
-
SSDEEP
12288:FGixaz9472cwOIqgDGKyB0s2nCgtXcMrtObY18mdXQPGdc/Cs7R9LVyoasofOMKs:FFGdc/r/LjedWVhHc5zmr+udY/VrJ
Score1/10 -
-
-
Target
Guna.UI2.dll
-
Size
2.1MB
-
MD5
278752062981db6fe27ba55f5099b8ae
-
SHA1
8446637986cf4a24e9135ee5c54f3170600e1e83
-
SHA256
538e6ca6001d609e251f88243409a2cbc9bc0517751843e76485a2c335e7829b
-
SHA512
142ff82ca90ca63a6a854e866615d742b585c102e8c4de5c773edeb1ac30c2cc2f6bcb190da394e4aadb4ef9518d194d99904463d6e952170d2924b16fcb00a5
-
SSDEEP
49152:PQNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckFjvkoEFB:PAhck1
Score1/10 -
-
-
Target
Lucky.exe
-
Size
74KB
-
MD5
6800fb9f7e466760a1a6c9375ad279b5
-
SHA1
92493bd8e395e13c08ee501c7d7863528669912b
-
SHA256
b53db1f081bac1af022f6a84fb5ad147f031b5db21f562cd5555f86a2ac4b96e
-
SHA512
a68ba7706c52d3bcb2d504a4d5a753a4949c236afb4a412c218874a60ee00717159a4e33948e8fa72988ef9d853735257ba87981f0c22e0727bd5b3cccc4050e
-
SSDEEP
1536:xgBZUu1Q3BOxx/bCyB2xHbeK2IuswNsYlW/1WDkB1l/qTpa9t1I6:uzUu1Q3ubl2xHbeK2ILwSUy1WDkBbM0p
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-