5a607965caac6829cf9327c795fb18ae6a318e687a2fdc922222f3c0de167cbf

Sharing

Copy URL Twitter E-mail

General

Target
ishod_6726_dolzhnost.zip
Size 12.1MB
Sample260423-rbhrgset4j
SHA256 5a607965caac6829cf9327c795fb18ae6a318e687a2fdc922222f3c0de167cbf
MD5 04211efadec71f50f7b33026d7d301b5
SHA1 4fcfbef356590b1796ba9f5662deb5e1909ddb48
SHA512 c4c96924138fda3317a58c5336d192a5b3563e263eed77f745fdda7243a0abb6ff260ed784dc140e6dc65c37d23ba1ab30ae85f3aaf6ac24aac29d0e506ea465
SSDEEP 393216:6oq22f5BFLDQSv+nSAKV0VMvVt8iHK9m2/8rzk:6YAFbG9Y0uVq9nkHk
TLSH
T181D6332C75A62847A7E821BB74A44FE4B23440713F59C053AA53CB99F2A70E58F53C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  detailInstance.pub
- Size 81B
- SHA256 daca918c334c6fd81c83081726c7218396efe8447a1970f94ecd411175102cd0
- MD5 ae233db708e49e989a1e32e7867b2c91
- SHA1 42b70e9e72f9d930aea413daa190d9a55837738c
- SHA512 e67aea031dbe9678f906856fe7919f6b0d7efc554166ef3181f18b8c9ed760191b9fa32fa78db35dc1c9c14f9adb525e5e2d80403d607bceb98125a72feb9683
- TLSH
  T1D8A024310440010D01050CD003D45475FC103501D7F10DD055CD435101CCDC01504C1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  eventFunction
- Size 5KB
- SHA256 7e397735bd33e4c50d11cea49f10c00a439c8619d36443c16d53e24ab7ade502
- MD5 fbeed5c6c22935795543d0b364953276
- SHA1 a76a739aa4ca8fdc20b065cb3e7406e6c88bf6eb
- SHA512 42e0b7b0e6a0bdb96bb7d204345f99c715b2768e5ef206a8a9b5b865783e316aac21834ac2f616664963051f7c7add3cd882ab7382733e71ea71af08f7b6e471
- SSDEEP 96:6Q4uxOD0QFjfX/csmV9IRCfso2zFd6Kru+RmmKFAWcIh388zGv1E+ACEvi7EUq9Y:3fc0Ir/y8Cfso2mdh3886leqnQGzNj8w
- TLSH
  T122C109506BF90208F5F7AF88AEBF5451883BBD6A2E32D81D0115958E0AB1E40D973F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  goland.exe
- Size 16.9MB
- SHA256 06845a04d2329ca39c8378cb83118f6ffd278805f5b229cb65c21c4ca989fd56
- MD5 8c0434571198367df2cd1344f2bdc0cb
- SHA1 76b45853917fe87b3dc82331d542d1a6ddde806c
- SHA512 cc425c0bf099d0afd9ad8c7b3969b41cad845aa943280f601a48964007021cd35fe008a308276cfa6cd41bfbeaf4a58afd46feee29cbb8b9c025dce79a827f7a
- SSDEEP 98304:YQdDmaIjFodwAtZLAcwIdoO5V92XDzGKNk/11VhFovYES:YQ1tIZod97Roq2eKNkqvRS
- TLSH
  T127076C43E86501E8C6ADE630C6729223FB717C495B3127D76B50F7682F72BC0A6B9B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ishod_6726_dolzhnost.pdf
- Size 169KB
- SHA256 f7c03336235bc751636950a4a29b3dba1558e7859436c85c5210fcad1be36645
- MD5 047af69b17b9315eb8f2fe8ba9bf4f3e
- SHA1 494336fe213ca00bcef179fefc451d5d8a97cb24
- SHA512 0d677063edcdd6b5bd455cb090b3adaf99c1c3dce87bf9515d9d2ac30122aeac514e11f878ac98e50e7887abefcd102a350bd2ada214fd959fe88eb618e88527
- SSDEEP 3072:Vugxu9djK1jecuJ7SvcvLTGax7LUY3XBcUg/52NA+52/4LAzoa0x+7zzuABcvAk:5xuXojeC0vLTRL/nGD5us/aAzL0x+/St
- TLSH
  T1AB041259EC757E29DCA18CD0FE8E1777D8ECC992ABA148DFC81B4048C10689D6D17EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  libcrypto.dll
- Size 1.8MB
- SHA256 065d3a16b418dfe5647c56c8a1787ac540b13299bdf35f69e9980525804cb9ab
- MD5 bfb07109da9eef8ecb8e4360a56b1641
- SHA1 d71484f8f0b8fe26222677597d04ad61dd68291f
- SHA512 7b8a392e6e9f82c81d5b76e7a171ca4de133b417914dd8c5e21102764f61fc6da2901bdcc601cabf0ee2ddc242c9e0e40df90a94c5b403d0785d20efff6c9654
- SSDEEP 49152:RiYeMEx5Hn+aNK0bWPFTpU+ivStjRfTNOS/UzuDAPxzIbdbZnR1CPwDv3uFvXDRB:RJKx5KzU+JPR/UqkzIbdbVR1CPwDv3uF
- TLSH
  T1B0958D25A6A904E9DDBBD23CC567951BD7B2B4100370EFDF06A14BA91F13BDA673A300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  ssh-shellhost.exe
- Size 184KB
- SHA256 feae0baf291ff54a1366f0cd628665d2b1c9fe279ce2544d4f84c7aa46064f3c
- MD5 6eafae19d2db29f70fa24a95cf71a19d
- SHA1 b6d7215f6336c1f2873006cc38c7babc0b56f1d1
- SHA512 eae08959125f766a1a29798508c950f25b00b5896aa99420cc1773a78ba2e645eedbe222560de59e10e82f19de664a8ed1a4be0af53d76723342e4ad22ad8c80
- SSDEEP 3072:82Q0NG/TvIOa6Pircz/sG9fver+Uh+77/evGeTgCu:86G/Tvo3wN9fGrmwGYgJ
- TLSH
  T14F049E55B3A110FAE1B79234C8905A06F77378320764AB9F03A447B5AF377D19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  sublimetext.exe
- Size 1.3MB
- SHA256 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9
- MD5 6615ea2fa3b879d27687a7ce917e93b0
- SHA1 8d4f19b221751297b0c3a10f105772d7286c9411
- SHA512 7826211716f6cb9624d0b37c8dd3decf80f5f61f289d16c1ef4d977e4c37635314b3848859be6081c04297015c647cf3593fc2ee29bfd327aaa166fb9ca1e47a
- SSDEEP 24576:1FbpQCgnGN1o4w+fkWq8tRluDV7e1WFu+dVVv9m6octogu9RyH:1LQCgnGN1PfkkgVi1OuCQ6octm6
- TLSH
  T17D559E6566E500E8D5B7D074C68666A7FAF1B42013747EEF0DA89A222F33EE0133E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  trello.exe
- Size 375KB
- SHA256 a0eed0e1ef8fc4129f630e6f68c29c357c717df0fe352961e92e7f8c93e5371b
- MD5 37e83a8fc0e4e6ea5dab38b0b20f953b
- SHA1 3e7b02953ccaef1d63c4e1c4bc69daa1656e5ab0
- SHA512 b0716dd01c34a7587bd3bdae409f670d796c838ac048ba09cd3187bb7c7adeee35a2a94bfc7eb82a6eec226aa37cd42c09c3d3b8514b9a3850fa18ce7fdaa0fa
- SSDEEP 6144:vQn+mU3isQNjODH5am4rU5x31cMBZQIhH84efS4jQ:vH53fMmWMKMBTH84eFc
- TLSH
  T1EE849E15FB9100F5D877A038CA525643FAB1BC690374EBDF1BA88A561F336E11A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  twitter.exe
- Size 9.9MB
- SHA256 f78d87ff967bbdebbc43c58c2b5376522d2bbc975c98727c75bf28e2eb23ffd0
- MD5 82710b81e610f074fe97a4f76e7f0843
- SHA1 eb73acce3e09b649b6d736e5bbcfeeb0a00a7490
- SHA512 20eefdd9538d1342df500cc7f83fa7637017d2122c0c217359c189abf9c7613bc9eae5da569666c939e22dbbe7576fb50ed7dd0b5f0a3a111918a13c642091f7
- SSDEEP 98304:WPhtxJn19KyRClWkOj8be1aEZvpc5Z/1ZyRuw7wldcJKBX6Nh+f:2TnR771a+G5p1ZyrO6X
- TLSH
  T141A62A47F27710DDC5BAC17992177223F9B03C8C81346B6B599097A22B74B68AF3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  ishod_6726_dolzhnost.‍pdf‌.lnk
- Size 2KB
- SHA256 5a78a1f7884f810bd515e2b73e9858dcc44087f7777072a14555589550955c6d
- MD5 8c7dacd0f13f7297d8ac5123820cc4ba
- SHA1 1e8adedc6aa963dec1bc59c22c871b53966c296b
- SHA512 e2b1dcaba0038de5f008e91af603ffa8f97a6e9c476ef6b11ae1da8de6626d7c272047c065a0dcadad4fd6c6f88d2a5928f6a024797dc247eba6926b9956f0a7
- TLSH
  T10B41631427F90714F6B78B385A3EA320483F7D4EDE76DA4C1286908C0A3462498BAF37
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20