e7658e6e5f7fe269ec3c9384aa62325e487bddb3834d38ee810ae052fef40380 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Scan_18441_spisok_peremeshcheniya.zip
Size 12.4MB
Sample260129-kx2cdsb19f
SHA256 e7658e6e5f7fe269ec3c9384aa62325e487bddb3834d38ee810ae052fef40380
MD5 5acf04b5e05a129f1b0d3e933c749c9a
SHA1 82a7a152bd6c50c0a457a23859940ba8ac5dcf32
SHA512 0dbe8585f432f7ec7f5f4dcee4932d3da458b66b57ca468d44fd4b2837492a21057e3bccc0b340f10469f3a2a5a2de42fa2ee93070a306b0329c57e7f45f7e80
SSDEEP 393216:yxOg/wAdefamdvcaBflqD26yu1PMEPWXx7IQLd0EItn:uOtXa5x6dEex8jtn
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware discovery execution pdf spyware

Malware Config

Targets

- Target
  Scan_18441_spisok_peremeshcheniya.pdf.lnk
- Size 2KB
- SHA256 76ac120de2a6892e7452684f39dd174b690c6b4d9828f580d255687b79aaee94
- MD5 fcec0662134454231793a5ef2f8791e6
- SHA1 a5908419f30444bff41aa776c78b0f0b2c5e3ef6
- SHA512 b3460f38a75856a3d3361dc13a548349e0e1e282f98569ea9f232d8f61597b7b9c122a099d43075210b546ae2fe1f8bfb51660944ce24d78c015487ea44e6502
- MD5 SHA1 SHA512
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Scan_18441_spisok_peremeshcheniya.pdf
- Size 254KB
- SHA256 d66bf17496a71f4c33aabf31524ec39aced2279ee06f2b93ec7f27504f87e517
- MD5 e4abaefce8570dbd79a1ead55bb8549e
- SHA1 baf28ea4dbb9bb3ec44f3747848e3c547dac378e
- SHA512 673ac754fe9db6667bd210a2ca34df02ee37f65486a9765eb88c721bf9cd81da955133ce0d0af246775c5b15ef1bee7191a1c4ae8ac8e7619eb1e4c572440453
- SSDEEP 6144:8rzXqlao31mFoq6pjkvioBJxKXVWoNU3FsxbXdE8pdf:8rzBo3k66pvxaWoe3FshXdEAf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  amazon.exe
- Size 1.3MB
- SHA256 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9
- MD5 6615ea2fa3b879d27687a7ce917e93b0
- SHA1 8d4f19b221751297b0c3a10f105772d7286c9411
- SHA512 7826211716f6cb9624d0b37c8dd3decf80f5f61f289d16c1ef4d977e4c37635314b3848859be6081c04297015c647cf3593fc2ee29bfd327aaa166fb9ca1e47a
- SSDEEP 24576:1FbpQCgnGN1o4w+fkWq8tRluDV7e1WFu+dVVv9m6octogu9RyH:1LQCgnGN1PfkkgVi1OuCQ6octm6
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  ebay.exe
- Size 375KB
- SHA256 a0eed0e1ef8fc4129f630e6f68c29c357c717df0fe352961e92e7f8c93e5371b
- MD5 37e83a8fc0e4e6ea5dab38b0b20f953b
- SHA1 3e7b02953ccaef1d63c4e1c4bc69daa1656e5ab0
- SHA512 b0716dd01c34a7587bd3bdae409f670d796c838ac048ba09cd3187bb7c7adeee35a2a94bfc7eb82a6eec226aa37cd42c09c3d3b8514b9a3850fa18ce7fdaa0fa
- SSDEEP 6144:vQn+mU3isQNjODH5am4rU5x31cMBZQIhH84efS4jQ:vH53fMmWMKMBTH84eFc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  githubdesktop.exe
- Size 9.9MB
- SHA256 f78d87ff967bbdebbc43c58c2b5376522d2bbc975c98727c75bf28e2eb23ffd0
- MD5 82710b81e610f074fe97a4f76e7f0843
- SHA1 eb73acce3e09b649b6d736e5bbcfeeb0a00a7490
- SHA512 20eefdd9538d1342df500cc7f83fa7637017d2122c0c217359c189abf9c7613bc9eae5da569666c939e22dbbe7576fb50ed7dd0b5f0a3a111918a13c642091f7
- SSDEEP 98304:WPhtxJn19KyRClWkOj8be1aEZvpc5Z/1ZyRuw7wldcJKBX6Nh+f:2TnR771a+G5p1ZyrO6X
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  libcrypto.dll
- Size 1.8MB
- SHA256 065d3a16b418dfe5647c56c8a1787ac540b13299bdf35f69e9980525804cb9ab
- MD5 bfb07109da9eef8ecb8e4360a56b1641
- SHA1 d71484f8f0b8fe26222677597d04ad61dd68291f
- SHA512 7b8a392e6e9f82c81d5b76e7a171ca4de133b417914dd8c5e21102764f61fc6da2901bdcc601cabf0ee2ddc242c9e0e40df90a94c5b403d0785d20efff6c9654
- SSDEEP 49152:RiYeMEx5Hn+aNK0bWPFTpU+ivStjRfTNOS/UzuDAPxzIbdbZnR1CPwDv3uFvXDRB:RJKx5KzU+JPR/UqkzIbdbVR1CPwDv3uF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  listLinkLog
- Size 4KB
- SHA256 073a022f2b2b58470d6724ebfd3278a2f8e1ff76329afbdbc344314ba4ef7a87
- MD5 ed88ce02a7a77be4916c8d77dbe077ec
- SHA1 6950c7eaea1c5bb76064d67d7284e229cfcfdba2
- SHA512 78f8305f1e19cfc1172beefc0dcd36455d74c4f95eb1966086fdff4fd386882ac562f98080d6c33ef4c87f0f49e2434d8cb713b9f9c6a891a533f1c2fe69afec
- SSDEEP 96:HfOD0Qbbj6uXRErRZOFHSYLXUkafLXawiW4wigdNasaYczfBidFOz:Hfc0UbGuhkABkNjKwiXwigNasU56g
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13 behavioral14
- Target
  projectObject.pub
- Size 81B
- SHA256 8f89b426cc751a9993c6da3a5e3ca16f1a9cfbd06a213b83bcdd426691706ea1
- MD5 2da45086bdf5d7e081f19bd36a686f81
- SHA1 c3e123d6dbe2815bd1b5709e697a5767994d2f75
- SHA512 f4fa72aa9ae6ab49701d61ebecfe6f2652197dd20fd09099ca398cecaa9ee0355c9a1e6616293b1b1182d93749f2b76ffddfb400f71064523e17c1cc6fe87c81
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16
- Target
  safari.exe
- Size 16.9MB
- SHA256 06845a04d2329ca39c8378cb83118f6ffd278805f5b229cb65c21c4ca989fd56
- MD5 8c0434571198367df2cd1344f2bdc0cb
- SHA1 76b45853917fe87b3dc82331d542d1a6ddde806c
- SHA512 cc425c0bf099d0afd9ad8c7b3969b41cad845aa943280f601a48964007021cd35fe008a308276cfa6cd41bfbeaf4a58afd46feee29cbb8b9c025dce79a827f7a
- SSDEEP 98304:YQdDmaIjFodwAtZLAcwIdoO5V92XDzGKNk/11VhFovYES:YQ1tIZod97Roq2eKNkqvRS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  ssh-shellhost.exe
- Size 184KB
- SHA256 feae0baf291ff54a1366f0cd628665d2b1c9fe279ce2544d4f84c7aa46064f3c
- MD5 6eafae19d2db29f70fa24a95cf71a19d
- SHA1 b6d7215f6336c1f2873006cc38c7babc0b56f1d1
- SHA512 eae08959125f766a1a29798508c950f25b00b5896aa99420cc1773a78ba2e645eedbe222560de59e10e82f19de664a8ed1a4be0af53d76723342e4ad22ad8c80
- SSDEEP 3072:82Q0NG/TvIOa6Pircz/sG9fver+Uh+77/evGeTgCu:86G/Tvo3wN9fGrmwGYgJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

adwarediscoveryspyware

behavioral4

adwarediscoveryspyware

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20