Overview

overview

8

Static

static

3

tor-browse....5.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    tor-browser-windows-x86_64-portable-13.5.5.exe

  • Size

    100.6MB

  • Sample

    240930-lq97dsshjb

  • MD5

    36a40aee3e6d6593fadca9045667c90f

  • SHA1

    60afa4dfc903e70fc8565e6bac27d9531ef02056

  • SHA256

    90b6356f6a01735efd303d36083cfeaac276f1528177328e71a941255b2c133b

  • SHA512

    0a2b945ad620bd1c849b8ba5d2f617cdafedd02b76e5c982cc1d2603093c0572ab27190c7b0781f06e8810ee6f3f30543a6713d2466d907fc24956004180cf17

  • SSDEEP

    3145728:Kbo9rYX+vF1hWIaeQRht9HKIJoo7qfSHL1:Kb2cutfWIKntpKImo+SHZ

Score
8/10
discoveryevasionmotwphishingtrojan

Malware Config

Targets

    • Target

      tor-browser-windows-x86_64-portable-13.5.5.exe

    • Size

      100.6MB

    • MD5

      36a40aee3e6d6593fadca9045667c90f

    • SHA1

      60afa4dfc903e70fc8565e6bac27d9531ef02056

    • SHA256

      90b6356f6a01735efd303d36083cfeaac276f1528177328e71a941255b2c133b

    • SHA512

      0a2b945ad620bd1c849b8ba5d2f617cdafedd02b76e5c982cc1d2603093c0572ab27190c7b0781f06e8810ee6f3f30543a6713d2466d907fc24956004180cf17

    • SSDEEP

      3145728:Kbo9rYX+vF1hWIaeQRht9HKIJoo7qfSHL1:Kb2cutfWIKntpKImo+SHZ

    Score
    8/10
    discoveryevasionmotwphishingtrojan

    • Contacts a large (527) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks