d1733adec47f7ce9b0b8fed3c6450a3b4a58850221f582e70a5867676531be7d

Sharing

Copy URL Twitter E-mail

General

Target
d1733adec47f7ce9b0b8fed3c6450a3b4a58850221f582e70a5867676531be7d
Size 13.7MB
Sample260421-eahc4sbs6v
SHA256 d1733adec47f7ce9b0b8fed3c6450a3b4a58850221f582e70a5867676531be7d
MD5 013150dd1420e6239d6379c4db4369b8
SHA1 70a2e91f5814fe9575215b4268922a66a0e1d3ba
SHA512 6109d6d01645833139d2224df47173b93ab31620e6b046e39f4d8c0d7c31c758ed5ba18f701ace4cdababc05611e218d70e15238145b081567ff4b393607f8ac
SSDEEP 196608:v+ZVb9BMVp0F3usLeWzcYHHmHCg8cGI3uzW5A4cECXeZKa4Ov/oMKV:vWZup0FeYzcYogcGI+aV1CXeMHOXoMKV
TLSH
T12FE633C161209189E9F4B77EF59A1758D0F4F2EE34B76402DDCC8C86491BA784E4EED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DotNetZip.dll
- Size 461KB
- SHA256 8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3
- MD5 a999d7f3807564cc816c16f862a60bbe
- SHA1 1ee724daaf70c6b0083bf589674b6f6d8427544f
- SHA512 6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414
- SSDEEP 6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW
- TLSH
  T180A4AE0427EC4B57E1EF5BB5D0B2A5A2C3B1B462693EEB8F5D4024EE2C17354C911BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  LESLIE NOTE.exe
- Size 5.6MB
- SHA256 f2867bbe82532fd268ea9ad20a83724700168f45d2017bd56e27f8b72c6450fe
- MD5 9661701f20619680593e02a1f6483611
- SHA1 4e57932d66a0b70dfb6c14f52711ca1b2662f12f
- SHA512 bb47a353082091141621ee4e01ccd9be144ad6c09105c598d624195b02b47971b269759f48867d3fd7439919510c56ba2bd58f6109547d65dab14145e8452555
- SSDEEP 98304:OD6tR37BaTM+NOK2TWKJXKss0u+XZluTt6yYjxJH8ru2oHFBd:g6tR3d3+Nt2TTuelW6hIuf/
- TLSH
  T1CE562244B31C609ED54F933F859AC86C9413BDAA707774169E07BBAA4F0BEF14A580F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4
- Target
  LNEditorManager.exe
- Size 1.4MB
- SHA256 685b8aab21a8ce55abc8b2587a444c68945f37dfe792f96cb6feaf2b5a6eb021
- MD5 651cf478f933d25607c7f61a4836c637
- SHA1 2dc601336a964db7ebd3b5e572306a0ab2098bfa
- SHA512 0146c39fb54160da9970f6745548bf8282ba3964875e4e755ab1c8d2490fceae8c8d1e58d866193ae33715e1f25f5ccd8973668aa2d34692e3a311837c5525ff
- SSDEEP 24576:mn6wj9T2GvNdPElI+pyOdqS1VO4XC4GOhzNyCss62uBFGGbQOPlJKAa:XwRcVdZ3uYNv9MzGUQOjKA
- TLSH
  T1A665EF81774C819AE19F833F498AC96D0897FD967477761A4D433B281F07EF00A662FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral5 behavioral6
- Target
  LNInterface.dll
- Size 10KB
- SHA256 20f7bbe8fdfd113a468574f0b1d30b5d66828966bc1fe46ae35144529c27024c
- MD5 8dfbd6401407d33c06fdf0c72a5017b3
- SHA1 9b2a6f0bcafab74458b7a4bdb71eb668ffe7ea6a
- SHA512 3d190c588760ca1946098b53d9d76fdda0cd2cb94206315943d2eef63f26c4f2264517b3ae21487f60e18b31c65fe9e424a6365a43c2b640b7a197e4a829470b
- SSDEEP 192:5kuUOdYJOevTHzJS46vxMt+9AatU0+C2PK73VoQn6:5klJPuvxMtlatU0+nKCw
- TLSH
  T19222D815ABA4D27FCC6A077DB461038A0ABDE7047A13C72E46CC7C8E5D4BB4D9D506B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  LNLoading.exe
- Size 1.2MB
- SHA256 6dbed1ac49416c74c3f73bd4da5ec9d78c0120a27136c92095c09d0307620222
- MD5 50a98beb3f9e7a34558982832628f159
- SHA1 3b38b4ba01ffe6dafacb84cdbe811871ce59f614
- SHA512 cb4efbe0f921baede83f01291c91a40236f8ac3540b429648074705b326ed27c2b1c8d4e20d4cdfcf1d5d52f8b1a7f75d95691867f0424313d21331d89e1792e
- SSDEEP 24576:Qp9R4eMkacjAK7Vlz9gfJzFGuDiMCBvkF0tmkKAa:uR4eMop7V9sX7skgTKA
- TLSH
  T17E55EF84770C16AAC95F833F4A0AD99C4883FE5631337A469D433B292F47EF14A295F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral10 behavioral9
- Target
  LNMemoStart.exe
- Size 2.3MB
- SHA256 f958f101f710616cc0caa6da6ca6c230910065f8c7f0314c44625d73c7b41ade
- MD5 3fc025135a58c3061b60cd0c5d06fe30
- SHA1 0c639d012c342a7f40ab40f6aad1817c45578817
- SHA512 afae46a521c8ce69256c9dd7e0c7264606504def6f2848a034f2b955aa465387526fd25405e635a90b7a89d1c19861dc3449b9d4b710bd2aa20f337cef111903
- SSDEEP 49152:nRjFRaWcRRPoDsusqnNw34ExBPasrmXEBbBgst:RjF9mRPoDsuH04E/PdmXSbBgU
- TLSH
  T1EEB523877B1D1284E86F8A33598BCF1C8A57AC153667950E284BFF1D13B7E30562ABC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Drops startup file
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral11 behavioral12
- Target
  LNSafe.exe
- Size 299KB
- SHA256 d276fa9b15cad2118ab2555b0ce8e6d01c5e9d40a8009f91e6e1d8d585c4f797
- MD5 ef5f20d5398c294a48bd0d601a9d22fb
- SHA1 5e39f15779eab1bb7098f3efd9a60aed7bae2877
- SHA512 654e324ee23631f05ae048e272e2a8350eba78aa130062e8a610926a223a83054d5d33b91707f9127e9aedc9a9234e2eb77497f329f69c7779dd7c6c93322755
- SSDEEP 3072:ZodsIeClANbtu7GuqFiMRCXcPoNAgFvga/lA6z:ZCs5Clgbo7GuqFiMRCXcPoNAagkA6
- TLSH
  T17D64FA84770C219EC84F873F4A4AD86C5943BD667237B6168D033B695F0BDF28A251EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  LNUpdate.exe
- Size 1.3MB
- SHA256 b9dc33eb01af82328376773eec977e5817a4c560de9aee822175f7e13feb65f5
- MD5 dc4d9f44b582f65c87b6b785676edb3e
- SHA1 44f02a7e19e8890e5e338afc4dd46cc1e3d4d0c9
- SHA512 599521e3ec886abafce5660fafcc1a3a320ee7fe51cb6198f34615359e3ebd6d331fc47f36a1d05033501457411ec0fd012a02018804e59a546000fa61fecea0
- SSDEEP 24576:0TD4bMUVUZivWOtf2gz4YUtApGNHhjxhowtb26KAa:iDlUFvW2f2gz4YUtAUNHFxhBb26KA
- TLSH
  T1A055EF80B70C05AAD84F833F864AD99C5A47FD6235737A695E077B291F43EF006216FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral15 behavioral16
- Target
  LumiSoft.Net.dll
- Size 1.1MB
- SHA256 abbd6270d229dcdd725c446c85e75bf6d77801c890667b9fb5abe796712af525
- MD5 e41dc8566e838e70391f91574900fcd6
- SHA1 0de3549e51e020279c8bfb62e9dbd5bc2c010ecc
- SHA512 29479c2d86c50ef78075101d085e2f4de78ced4684373dd5310eee77231186f6d11fd8b25f185de6abbeeeecbaf9a892bb2c25e0de19b073fdd0d2df36e0245a
- SSDEEP 12288:PJVLjiYSz0T2vJ1oRUMHVYYo+LO85kMhWGm1T84mgYzN:PXLS0T2vJ1AUMnyGD35N
- TLSH
  T1EF352A1137E84A1AE2BF5B74E579152843F6F8C57AA2EB5F4DC190AE0C62F548C21B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 50e9c2f516e2f05c4d8ee925018314353b5f8198795f2222a4d433bddfece078
- MD5 883f1efa99b9c89c97a8ab409fef0f23
- SHA1 5f0e7ea4febfe56702b0dac7533f8b22fc5bdd3e
- SHA512 4b53d66e1451d85e698e3cb0a6f31e4fc40fe61633620045722153fac4e550856139a6055637d34185236ad7cf4f411828869eb7b66c609212186bff7661e934
- SSDEEP 12288:EBfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRFrP322U:sQcl41OU
- TLSH
  T173D4522223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 e0032d422ab2ed28ce411ae00d27bf816d46c4c660b7b6d642ac420983e5bf33
- MD5 14df37de49b4d8a269de90e8c6e1eb7c
- SHA1 5e679a4cf80536ed0aa0202ed4fbe5c31bdfb864
- SHA512 f422efaa0a510add3d675655e19645804590c8a6294480259e23cfa0a54adf13881c317b285076f7b0af3a8c945c1531f23b430cc900825b97f46bfd59756263
- SSDEEP 768:0YQNb2vIYymJ22Mss+5JQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxH:0Pb2vLbJQ+ZDgcEST3p4JjrjaeFSUyaz
- TLSH
  T1E6032B4083ECC517E6EB1F78A5B491610BBABEC37DA1D3A81D84F2DA0C73B9055143AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Microsoft.Xaml.Behaviors.dll
- Size 142KB
- SHA256 8e77a1dd5e2df4d4af801376cc3428b082eb49fcb6e647b933967fae12ad9d5d
- MD5 95f46f34c099421d917d5feadbb33edb
- SHA1 3d1cb9cf59000012734901a35baeb3d9c1dd5db3
- SHA512 c9c9f72980316c68ad2a8dbe2c6c563c0deddfc9e845674d0e2f5313a0ae285d60a755e2ca04164f78b37a36521259307b3eb7d43f5ec9a9de5507bda7e4c1b8
- SSDEEP 3072:lN+EM1X0WlL9JAn11M1dXcGkOsizI35rCj8SIP:v+ll79in1h6
- TLSH
  T10DE35BA553FC8A2AD7FF0636E0B011144631F797B923EF4D1EC4A1BD09A378166126BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Newtonsoft.Json.dll
- Size 683KB
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH
  T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  System.Data.SQLite.dll
- Size 355KB
- SHA256 7fdc71cef0c2dd4a5619b0191617453188b7d38f23317b639befc765161b37c4
- MD5 f47aebbd45675ebe86d15e4cad763d81
- SHA1 5a9cfd0b619bb771ed93c09970103eec8656e07b
- SHA512 ba433bfb2d71aac456982b6dbcc74f3296394164d2e97a160c04e73d635cbf56a78250a42c9b10476959078477f257ba9802d7b24f7e616c3e7e9bc57e66d1b4
- SSDEEP 6144:7hyPltgBtbhGtJnUu5ICkU32S4TbFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcB:uEWoFNFaFeFOFwcGF6cmFWc0FWc8cIcb
- TLSH
  T1BC744A8027DC261AE6FF9778E4B115448775F4626A6BE30EBCC150BE1D6AB00AD83773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  WeifenLuo.WinFormsUI.Docking.ThemeVS2015.dll
- Size 219KB
- SHA256 fb38f59936625f36a453e7dff017b67f90985f3828dbc43cdad870dc3e925cfe
- MD5 2db920343093460bc0b22ba2f7fc2272
- SHA1 58c8682ffbda3135f33a6125848855a780b62c75
- SHA512 c3705bce944ee27bbeeaca2142245d8ae03ea7127b2cfb3e7e0dd747eb5e16afa680baede815257b29c8f023a35fd29793be7afa84bb1007994f690f4a1d2fe5
- SSDEEP 6144:wJIFK3LIRBRbQtiCZyvZUnnBW91If2D6T:cLIhQtghoBYIf2D6T
- TLSH
  T18524AF9022F98D2EF2FF1B7566B410A086F27BD36661C25D3DC064CD2D63BD246913AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  WeifenLuo.WinFormsUI.Docking.dll
- Size 239KB
- SHA256 17e231968f81de9c179250cb7e01563f0b3859c9d6f983907426d3ff417de239
- MD5 ce82a0e9cdbe3997c691beeff8ce9008
- SHA1 d27229b913d61ccec7396e00c4935badbaea6c77
- SHA512 04d687472c5e89a13e7faa3dceb7e511af248fad3ac08d58b427b03d889091ba132a3d9f852dcd88516fa0c53010128144f73e684a0d143feffc012a3a4d7660
- SSDEEP 3072:8USwEKBSLhNusu/Iva2l65AvXtuPsNBbKShW6ymxl1nfoUbBJCF7IGx7nV+:8wEKBWu/usdPqTyuUd
- TLSH
  T136343950077D877EEAEF877AE1390020C7F4BE92B651EBAD6E4854AC6C53B90C4513A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

ConfuserEx .NET packer

ConfuserEx .NET packer

ConfuserEx .NET packer

Drops startup file

ConfuserEx .NET packer

ConfuserEx .NET packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32