4548b36f0689eb5efece558cd509f1e08f20f9b402f3f9925820ab6532630e53

General

Target
IdiotScripts.zip
Size 125KB
Sample260419-tekflaet5p
SHA256 4548b36f0689eb5efece558cd509f1e08f20f9b402f3f9925820ab6532630e53
MD5 5b3d8058e539f878bec804b187633c9e
SHA1 e42416f664b25fb667f2bc04d87fdfc160132eef
SHA512 f2298ea696c9822657a0553c1c315165a0a9b4546dfd550534be0cb368aa9daeb7a8065fbc98049fec45ff876221a59549fe8575020859b6cce1a56e4df1957d
SSDEEP 3072:q0gZotlhmxa0rNt/aqcSHxiWYS4NpqcMpaIc9psBF7o9K:daoDhmQ0rNTcyiWL4959psBJo0
TLSH
T1E5C312E49FC7888DF5D4197AB5341CF8A1B8469C2D10AA13606387941FA70F35E3BEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  IdiotScripts/aimbotscript‮txt..scr
- Size 131KB
- SHA256 dbd321922007a534ef6148eb047d066b482a1387c3b2dad6990b148256780bc1
- MD5 ecb1f84255c9cab0172ceeb187e80caa
- SHA1 821e2233f36f051f05fa02e3b78559080ba9a5a0
- SHA512 c24b6720c8269cca73bac9fcb7c159cdc55273b1ba0679341ae311fc6f64411b70781c92b0e8d6cd86808ce1a3c61fbd4b41490c34475b3be40df9f15f5bd490
- SSDEEP 3072:MV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPiX:ht5hBPi0BW69hd1MMdxPe9N9uA069TBk
- TLSH
  T133D33896B2E05088DBF681F2D8520746EB7034755724A3EB2B7863B31B2B4C69F3D394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence pyinstaller
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2 behavioral3
- Target
  IdiotScripts/harkedv‮txt.1.scr
- Size 131KB
- SHA256 fa8c817c131103b5dd313b81b070eba2be9a21ede4845f81738229e3d5c97161
- MD5 ed873ee6efd525295563e3977b9b2fa7
- SHA1 dcd2bf741c2197ce50c7f6b7a2c22696480666cd
- SHA512 487a876c7563c006af8cfaa10aedcd91f74d2998b205ee4cd0bde45a87a83add9205d66402519f7c6764713f09e642dd99cefefe6cc63885e9fe1f999756192b
- SSDEEP 3072:IV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnP64:lt5hBPi0BW69hd1MMdxPe9N9uA069TBn
- TLSH
  T1FCD33856B2E05088DBF681F2D8520742EB7074765724A3EB2B7863B31B6B4C69F3D394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence pyinstaller
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral4 behavioral5 behavioral6