5afd45ac84838b38445cbbb0fdeb4ae178cf24f1ef096f53a9553fb8c6676368

Sharing

Copy URL Twitter E-mail

General

Target
công việc.rar
Size 17.6MB
Sample260422-r4e63acz71
SHA256 5afd45ac84838b38445cbbb0fdeb4ae178cf24f1ef096f53a9553fb8c6676368
MD5 6a11cbe2b7158db969566da4350abe19
SHA1 db066fa03c9f482f95c65c92b38da67c74bde5b1
SHA512 7669e82b301f60424dd788b1fb0b4d90aec2ca07acc4e98b676c0ba28f75a0f4d78398e7ef5034852028823b79a81ef4abe7e0947a2f5ba895bbc7debe4bc22f
SSDEEP 393216:MKZKZN2jYNItXjv6KZKc2jYNItXjvedj/A:jONstjtxstj2drA
TLSH
T1FB1733FC4F1D139CFA4E52B41FD7C51E94290A78CA0E57164A33E376ACE68C1692ABC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Targets

- Target
  công việc.rar
- Size 17.6MB
- SHA256 5afd45ac84838b38445cbbb0fdeb4ae178cf24f1ef096f53a9553fb8c6676368
- MD5 6a11cbe2b7158db969566da4350abe19
- SHA1 db066fa03c9f482f95c65c92b38da67c74bde5b1
- SHA512 7669e82b301f60424dd788b1fb0b4d90aec2ca07acc4e98b676c0ba28f75a0f4d78398e7ef5034852028823b79a81ef4abe7e0947a2f5ba895bbc7debe4bc22f
- SSDEEP 393216:MKZKZN2jYNItXjv6KZKc2jYNItXjvedj/A:jONstjtxstj2drA
- TLSH
  T1FB1733FC4F1D139CFA4E52B41FD7C51E94290A78CA0E57164A33E376ACE68C1692ABC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  công việc/Công việc.exe
- Size 19.3MB
- SHA256 c5d24aa361bdd9945d529e461bc4ad0bb4a28f3fff493be6f915c6d93f9b16b0
- MD5 fb8b2cb67cf0e7e2a96c43f474b93dd3
- SHA1 adfeffdf28833aab12cfdc82ff3ca65d638a5777
- SHA512 5d0e5065362dc07358dd6535b16e94737f0ba85fc2aed0946b477b15776ea5b40c1da39251485fead1a7ca5e2cb089978859cd662c9b2238710424431007a97b
- SSDEEP 393216:XcsP52fq9/jXmUZ08RBCxXJq3o4I5yzAuuAP:z9/jXmUZ08RBCxXJxd5yzAuuAP
- TLSH
  T1B717BE96B2949AB8D542FA3CC911836EF229FC1C5B61834741E97D747E733680C29FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  công việc/demo.exe
- Size 19.3MB
- SHA256 c5d24aa361bdd9945d529e461bc4ad0bb4a28f3fff493be6f915c6d93f9b16b0
- MD5 fb8b2cb67cf0e7e2a96c43f474b93dd3
- SHA1 adfeffdf28833aab12cfdc82ff3ca65d638a5777
- SHA512 5d0e5065362dc07358dd6535b16e94737f0ba85fc2aed0946b477b15776ea5b40c1da39251485fead1a7ca5e2cb089978859cd662c9b2238710424431007a97b
- SSDEEP 393216:XcsP52fq9/jXmUZ08RBCxXJq3o4I5yzAuuAP:z9/jXmUZ08RBCxXJxd5yzAuuAP
- TLSH
  T1B717BE96B2949AB8D542FA3CC911836EF229FC1C5B61834741E97D747E733680C29FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  công việc/msimg32.dlI
- Size 119KB
- SHA256 2d672722c248df8c989a6ee6b691154a3bd86f5047b353f5b0b42dc4744689fa
- MD5 e34538b053741f92c1e7edb798e9df1f
- SHA1 3eac7b52f824870498116d4282338a29da12e6a6
- SHA512 112e6ab49b9acfffc52c7434a11634a765300c87d2159265fcd5c35e9b79e7dcbfef1d4eaa912a4564bbf30952f240daa080b1300095f02f35fd6d4d04478cc6
- SSDEEP 3072:PZHWtDiXeY0dW9CEUyrC/AsSlnQ8yDM0sazsblLA4XM:PExjY0dW9/Uj/yi8pczsp048
- TLSH
  T15BC31232DC79E61015A6BEA93AF7E40C1FE5CA71E048A729158ED43BEC5CB4462A0CDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  công việc/msimg32.dll
- Size 1.3MB
- SHA256 03a7e8a3ce20810ddfc2e03a3c80e87da614bb506d809cecc3f6877e77cb0275
- MD5 cc6d41c65467fdddacce548644392dd7
- SHA1 9b52700a67c55adc1fdca0325c2b37ef691de2e4
- SHA512 be195588c1c1a6a2917459f764c740ed171301eed00bddcb2a716eee733b186bbe36563c0f6f94c710ff6f4a977bef8ec29b7484ffdbc1efad7d6d77189341f6
- SSDEEP 24576:GYRG9gnQZj5Nperds2/kbr0tGPLQnUU2M6NQAwgl7STgi0Pwb0RQj6vyU:v2ZjgD/oXknUU2M+vlez8wb02uvz
- TLSH
  T1645533C7C0E96D605E4F87B6B9DEC15880BBF79646090697E4206ED3F5E7007F63A0A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  công việc/netutils.dll
- Size 30KB
- SHA256 e9ce2e2c668eeeea2f7b810b432f6727add3b6f7d97b02903568c2104f840f04
- MD5 d5a6b56d163074ead0894a3b9ab6d410
- SHA1 885d41ddafba103f12577b0ccdfaafa9724ddfe8
- SHA512 19425982ce40acba6551d90f72790380709c1b78ef856d22a4268d7abbea0ec768c7c5e37f7b07d96521bfdb15f73948460140763779381f9a12c063df3dbf32
- SSDEEP 384:OFNQClXcr6A1eZdc+XnHnp75kVyHhfBHXVMF8Eg/5LzzI3DxmrUdDpq:sNO6hy+XnHp75kVyBfB//BLzz5S
- TLSH
  T1D8D2815A676281BCC808C474C27D5A13F172F8860724B6FBBB2D57549EA52E4B33E0F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

Suspicious use of SetThreadContext

Looks up external IP address via web service

Suspicious use of SetThreadContext

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12