ducktail | 03e127d17ac154b8924469f73832c96f5f5bd15a896b65722b2c5bfd8fb459f4

Sharing

Copy URL Twitter E-mail

General

Target
as.zip
Size 77.7MB
Sample260326-b26y1aev6l
SHA256 03e127d17ac154b8924469f73832c96f5f5bd15a896b65722b2c5bfd8fb459f4
MD5 f872ef2b1949189fad9cfc4b3704390c
SHA1 a3590be212fadc968ab18749ef0f0b9127cf1699
SHA512 7778865e63c67b7c0b43172f962c0e8701953c082750c11604bc7f50d3a97dc173680144b0c551eb5864137b530f5e813717ac109aac566e0ef1600a8d98d891
SSDEEP 1572864:KhA0y2xZyKVTTwiq8qm8Tx8KqXc8DJFZsQlu4n9NEUiMzaNabkMXuxJfdgQY+c+k:KlynSLKqT689O+z9oMyaT1q+kHM
TLSH
T1D10833D96867C1C6DC235F7AC8BF7C80639F39C3656059978225379820E3FA94E8F846
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  as.zip
- Size 77.7MB
- SHA256 03e127d17ac154b8924469f73832c96f5f5bd15a896b65722b2c5bfd8fb459f4
- MD5 f872ef2b1949189fad9cfc4b3704390c
- SHA1 a3590be212fadc968ab18749ef0f0b9127cf1699
- SHA512 7778865e63c67b7c0b43172f962c0e8701953c082750c11604bc7f50d3a97dc173680144b0c551eb5864137b530f5e813717ac109aac566e0ef1600a8d98d891
- SSDEEP 1572864:KhA0y2xZyKVTTwiq8qm8Tx8KqXc8DJFZsQlu4n9NEUiMzaNabkMXuxJfdgQY+c+k:KlynSLKqT689O+z9oMyaT1q+kHM
- TLSH
  T1D10833D96867C1C6DC235F7AC8BF7C80639F39C3656059978225379820E3FA94E8F846
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1
- Target
  as/NHelperV4.exe
- Size 194.2MB
- SHA256 fa80027283ad3a453c0ad58894913e2555f6ee71ad2f75c6bc11275dcbb8e51c
- MD5 85467abb5c8c62d1377494b922565f23
- SHA1 fa4f826ff0953e2015d85ba5e4033eb35c31dc43
- SHA512 249215eec471a599cd67be9989339e2c4bb3df5eb147bf10cfc7283ba3ae8978aea187fcb3190e5fa0eb2a06b888af76cb3eafd354285337e33ac6262266ef62
- SSDEEP 786432:MwHz3lDmtjw1rHi/PEEpjelfNTDA2y06OlgflKUsExM3RfbmYEyGUqzDTjzNiJIP:JHZDmyU/ComlUo9aYDGnzDTjzNQIP
- TLSH
  T1D8A89D0163E80A15E67F8678D6B24261DB75FC425711C2CF1098FA5D2FB3BC2AA36376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral2
- Target
  as/RemoveService.cmd
- Size 44B
- SHA256 c1b416561d470b8249419ff907c81de21c0c2cf085aa7c3fad9d979518ef9893
- MD5 b8beac96a1205923fa875a485f0a095c
- SHA1 57be1ffab6c1ff9ebb625d67cfa515f863294141
- SHA512 69037734a5b09ef61b905fc9e5689e4e6071d4ec2def639e54f38407e0c2ecb1a53e4f2a6b73a1a9a008607c6fc0d0470a6d1f166386609de92a54c47e9f5819
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral3
- Target
  as/UninstallToolHelper.exe
- Size 463KB
- SHA256 ba8d7b5662f85aa901fd6bcf86fc5989013577b18c81a91bffc1211fec31d6c8
- MD5 d82e0a3786dba17f88929d11d6b00b96
- SHA1 098f9b676677dc3a30530ad5254b7fb41e1391d9
- SHA512 4df64c5f421103fabf156342d41ff2cece82ce6b7015c454ac78680611d4ab64788c7ed50b0505edcd4cc704fdbe3c118370464c476f8047bd0e022ddbc3424d
- SSDEEP 12288:jDrJL3QCiSt7hMYDbInjPp7ormE3Lu4iPnOEAPiWTydl6:jDrpQCpXZbCj5Y3C4MXlbK
- TLSH
  T1CCA4C01679D284B3D67309302DE896A2B97DF93217304EFB67D416190FF06C07A36EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  as/UninstallToolPortable.exe
- Size 372KB
- SHA256 d03169d7d37f3bc3bf0de6371d9c847b1fec6ec68529e561023f4de60cfbbf93
- MD5 fcae773b59f17007e3f82d20d112701c
- SHA1 22114d6bdc4d58de3acebcca4050a77d38a70dbe
- SHA512 524146ea05e568fabaf5c0aaf6388f8bec921944cb7ffab1c5cd03ea22d8737597b8052da8e561f626f287621f72fea64d3ab22e94920bf813e6bd74849e1c2a
- SSDEEP 6144:oWNO+QqDjT/YeLsVFKzjNSkIiQp/7Kg+cxVAOVbEbF340zh5HdmBKKwkGwI:oLannoVmNSkI+6vEbF31dmBKFkZI
- TLSH
  T12584AE11B6928432D9B1017245A8AFB6997D7C300F6049EBB7E43E3DDD703C2A635B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  as/UninstallTool_x64.dat
- Size 5.8MB
- SHA256 3ed4d23131579a3ceb290d82547c09813dcdd23b63a45b52fe2d01a4aaeb04b7
- MD5 f68fb8cde81eddd14906eae5c59b59a3
- SHA1 120e5305eb658789886c6af9d496892beca64d17
- SHA512 5686a1bf4440831a5fd66660f6dd1387c4f1c6642878cc1bb9ab08d83fb2b257e379470a908661da0ba5ba3da11b47e83baf5ff87b172d530309012e74db045d
- SSDEEP 98304:5/yurgqBw+46PT+Tq6IX1RQcmQYbaM32yom:5/aMj46RlxLYMyom
- TLSH
  T12F567D8673B801E8D0BAC179C946890BE776BC1507719BDF05B06B5A1F3B6D1CE3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral6
- Target
  as/UninstallTool_x86.dat
- Size 4.7MB
- SHA256 a2fb8b6e01109451fd91acf1a5328752ef00f488ff35f31ba91d354799e56daa
- MD5 b765602b72cac931db4f7b63a39cae51
- SHA1 dc6699de900c4036da84ca2bb288393d11bc88f5
- SHA512 162e37b89dcd650fbaa79e60b07f7b9ce9df39194fe1131f96a55f280488f4f9e55a50638ab14378e278397e3726b8b38eb1451cf00ca508bfadb119fc76353f
- SSDEEP 98304:WyOm4xWGdzIm2X0Gv/6vM4pA8r8X5WXYyanbaM32yoN:W6wdzImc0Gv/6vY8r8X5W0MyoN
- TLSH
  T1C736AE21B654807AE56202B19A3D9BAD477CEE301B7141CB63C87F2E2E706C36B35B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7
- Target
  as/del.exe
- Size 7KB
- SHA256 cdfc82fe182ccbbe3b99db4b6b27c419732c8469dccf09c0ea550667cf1f4ee5
- MD5 0324b70e820d90acd2ce674d1812b2ed
- SHA1 5b3adc28a900d11edd4f9f33f07393ebba3a24cd
- SHA512 656ed98b690e124b7d0af88a920ee2e6b385c9d54aa2e2ac7c337fab40bdde6500d00eeaedd4dad45aebe25a913210a9de5fde3ee54a9126100ec4eec4959057
- SSDEEP 96:iU5YYeTJzTGwGVZHtOQpIw4gZ+y2+o9zc+oBIBM6f9pff+dgKBzNt:YYOJuwGV5tFpIwXZh215crB4MqXfXQ
- TLSH
  T198E1C825F394C676CD6A0F376E7221840676E745DDA7EE6EA888100B9E6330547E3F70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  as/languages/English.xml
- Size 39KB
- SHA256 63a657fe7cdde82230a124ea0f4bb4e36e1b1f95b89f14bc8c6877fbfda5f4b5
- MD5 966c81ac5e064a065b401b05c8fe851e
- SHA1 fc6f63274eab893bf5862ec0dad899c28c20b63c
- SHA512 62567bfc2af9e46f544058f0befdf141a84218f76f18e7515120d329cf83713133bf674705fa9ddbd0b962889d7861a1ad83e5e4aa8dd00cf44a4d1bba4b40d1
- SSDEEP 768:nXU+hDLBa55Jr7fbfgdVbTJupGGOr4yANcsVwEVVsGgsSb+Dtr:nXU+3arxfbcAGGOu9ICDtr
- TLSH
  T19E03FB666BF843F62DD203166A831961EFB48497E256412476CF850C1FDAE8D827F373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral9