4829226d61849279ee5e2b683550146c485309a117687e8f3c0ee082404ccf46

General

Target
unlocked_chatgpt_premium_enterprise_1.9.zip
Size 480KB
Sample260309-2tkc5sgv7n
SHA256 4829226d61849279ee5e2b683550146c485309a117687e8f3c0ee082404ccf46
MD5 df14af3926f6cbd3d2529dff5feca2da
SHA1 e2a81fd944d46b98dd4f61557eac79c5e38333f8
SHA512 5d689607572b65d2a2b2544c0aa36f0dc3cac7e5193413e83eb23c507bc84242ef7286be837c3a349667d075e3add390cd4db5e348bb89f22d969c32f0c47a69
SSDEEP 12288:isS5lyFd6C+6sVXkvgSe5yAqr++rVOje+yH5Y:isgxj6sSvP3y+6eTH5Y
TLSH
T17EA42397E39996EC8CC47ABA8B2C0D08B27CE7745CCF06A8537E5735D1688A39E0351D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Launcher.bat
- Size 26B
- SHA256 e1e6e28bc665b242fd4b496caf2542042d5720e87ea74551735664c202c486c7
- MD5 aae2b25db42573f9004af139d7dec051
- SHA1 d55d712837f4b5ab48faed80b8df47022231171e
- SHA512 df646dbaed6e06a5a7fbe1744c38f22bf6f4b376cf20b95340302ca1dd4712cf0b75ff17707f218f7e65cfc4dd2f7a272ae11849f2f3da291611fbe258f42c7e
- MD5 SHA1 SHA512
Score

7^/10

discovery execution persistence
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  loader.exe
- Size 282KB
- SHA256 fad3d429172932b72e50f52af169a80439464e3538d97810509090e2e6cdf32a
- MD5 efaf7d26f15af0d930ec9f5809d781e7
- SHA1 ba7b3181156d9dcd2634e077d2a81dc425282f90
- SHA512 383fe057716f0220dbf9e46561b23e752a9ac97eea5f626d496a9eb9f4092a241af32dcf440eba76475450db6d2989fdedadb7aec982fa537a428da25ff7a540
- SSDEEP 3072:ABtvGBhKWwaMfiBy/bgh+SLPs4TUfamFgtIqvtCui8wyK+tnxOt+Xfe0N:W7aaJERPs4TcaUgxcuiXe9j
- TLSH
  T1EB549D54B3A014F6DDBB823D8D168987EBF2B8060764E74F03A046A77F177605E2E726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  lua51.dll
- Size 381KB
- SHA256 440ceb0dc5911faca54ed9a4dd186dad3d006ae4f52d0bb7d1e4b4edd8c3693a
- MD5 ca9a5f85ee1449c731b6d30aa958c982
- SHA1 b4f561add9ad0e57f0a56b0e490f782df4a1a48d
- SHA512 d27c9c8b55cc3ca39c996923057b281605e130458d3656d2a6bfc9beedd0c45b39f27feeb34c89e182904195e8c0f0be1613816370243bc45e69ed3ac523fc41
- SSDEEP 6144:J/aQQeHuezLr8tmq6IV9y8kNY1AS0cfDFC/gGIFZ4O9f/eewsUZVFDPVpr4opQzv:xaKamDIVwybsIXUZVH9vUSj/TBM3
- TLSH
  T18E848D0AE770017AD9678174CA279E0FCBF6BC4913209A4F47A57E976F37B21190B329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  proto.txt
- Size 301KB
- SHA256 e450152d8dd9f7d2d92dbd53461a38ee8f154b69b2558ed43b5d3f603a43240a
- MD5 5dc3da9ee501b139b6cb591d2d0d77ee
- SHA1 5525d91b549dec1f286aa696f92b4b14264af33c
- SHA512 660a0e77111d0fa50e246afcebe38cf05308a8def17aa9eab72e2b980c9c463b68c63bac8ddf34e2eddd3ab09f3b61d062ac8e8a773a00e80fca4098b4f20592
- SSDEEP 6144:Xprk2sJatoXNKiAl19CaCwLnh5rzUucctaYYh4:ZrgJ2SNxKN3rzUucWw4
- TLSH
  T1566409D161C918D1DBAB9E92EC63996E21FB18F1CF0A168E4E0EF4E037D1A81D5CDC16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4