ac24f66a0841d72fb38b0083fd6c487a007d05a6618c7a86ae7c32f3903f2e6b

Sharing

Copy URL Twitter E-mail

General

Target
LiW.zip
Size 771.0MB
Sample260501-e8ttssgs4k
SHA256 ac24f66a0841d72fb38b0083fd6c487a007d05a6618c7a86ae7c32f3903f2e6b
MD5 27b7cecabcdcc62b6c6a0ada20696ac6
SHA1 3ac5e9590d8a3496218d0815b379521e800b5ffe
SHA512 196cabe6b576cbfcc7537eca05353a0d86b79eb26ef500b878b8dc4d89be355306a35529af38d0aeef926f325be2b7200e152560b88191a6a7a97dbb18294cb3
SSDEEP 25165824:fIKcSq8BA2yHC49wsgAO9KudrcGtYMw+een89K0w85y:fIAHBB49Jgv0udrcG28nQKL85y
TLSH
T1FC8933EE607640C2E853F97374CE0682DEADD2485AE3E6DFBFE2512A8C414644F66317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/GMLive/gcmt-dll.dll
- Size 113KB
- SHA256 949aab9b66c34093f025362044cd7c3a79940ca570794b6ada0cdef54875aba7
- MD5 6bfef8aa4e5b7e35b50e9cb22390d661
- SHA1 f06482e39c351699270ef984f649a3e4cb4318de
- SHA512 5ef9ed5a3317bb9ebac965bf2e9f7e350254c8df818796bb2c0ce1f928c137c44e54c3a7c832ca9204c3e28deaf4da68213968ead0a1674e613aaa9e204610c5
- SSDEEP 3072:0hcR6FWMcTAktCg1t1lP1XPT+XnelP6k:ucRrMne1lP1/OelP6k
- TLSH
  T1F2B3394936AA10B8D6EB82BDC9A79653D3B374101320A7DF477053A92F33BD95E3A305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/GMLive/gmlive-server.exe
- Size 303KB
- SHA256 965529589ba6f460b529e648f72241291a8197f6fae8958a1bef6c9950b101df
- MD5 20aeefa57593d6b0bdc57e3010994f6b
- SHA1 048ed00d72c1479c15ec42946c2d54f250ba3f25
- SHA512 89a34244ee1eaf0f8b3f28214318a2a42ad50c09ff52742d57396175fcb8d921fd6b6c725c8c7fa4ecd18c792ae14a209dd9a7861008a3c03050539e3e5ee509
- SSDEEP 6144:YctRxkbcH0bkrb9zYv3BD1772vM+5BLCOl5sZf7yOT:5Rx+c9zYvLPpfT
- TLSH
  T1E164A0B89425FC16CB05E2B4118680078D75C8A7DBB607EB0DEFFC769A761C76436A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/GMLive/gmlive.html
- Size 59KB
- SHA256 6cc6a758c4cf5415d1d6a3b0a404d30819063b33ab4f0066c37ae0d69a6d23ba
- MD5 36cd08edf22b53e93c36df03f3e897ab
- SHA1 1c8bd083d497eb8917d14b01f97f9689123cade7
- SHA512 dc9c68b15f892c954f94eb262e5cfda3f319146372ea22e2f363f2fa965f5ce9858b78188043e35c0ee32fcaf2231aab572813c533fc3fd8dd139cf97d7589b8
- SSDEEP 1536:PFtP7lH67OevgYIugaWGr285MQwPbYsLW:PFtTlHvkWYmQwPbYZ
- TLSH
  T1C653739AD2F92B77413BA1D7A6EE37A161E58428D2210D00B1FC86BF47EDC05B4178DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/GMLive/neko.dll
- Size 82KB
- SHA256 4e73fbaf2658c849a336f5d320e6bd9f1937e6eaf2f0b797fed7eb1fe3868a97
- MD5 c43744be3a1316dce5140124d4f2bf3c
- SHA1 c495d73c08f2822e43077e144c5fc57fbfb3dd9c
- SHA512 4d1fa3c27fbf620efba6817a72c31e0a4541dfae89ce6e1b420b69605014488f2c9ed809cd7f0ef908064b6e136f940d85ed2782ef639fdce7990f5a8f8de2f2
- SSDEEP 1536:Gsl1veJPOjuM1oDg4hVdQAEfuvWnMFiH2M9lF6F:Ge1veJ0og4OAOuaMQH2WL6F
- TLSH
  T1C0833A1A229101B9D9BF9138C6F2A117DBF2B4105BB0E7DF07A087650F375C46E7AB86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/GMLive/regexp.ndll
- Size 202KB
- SHA256 dd0131b4bbebfc1b1292efcc48704e806aea8dc2f067c21568adcd8d7b820105
- MD5 852b578c5632d5241546a3bafd42a732
- SHA1 49820c13ed88f9dcce113f0d62c5fc4aaa5bb08d
- SHA512 2b2a8f25c59bc83b296fe233448ffa6417573296c883cdc3753db3de14afe63e8bac6e8668fd471a119b409c9dfd43e0d321d4385d3e2aed806edcaa0383b782
- SSDEEP 1536:lJHhF1hQHTluAAEgZjuTYso9AVaEzhMrLcwwF6nc6/J0Rez6LRaAwuWP8S:lXhIA/ZaTvoyV4LcZF6VKRq69aAtWP8
- TLSH
  T19F141801633586B5FFDAE13B4352C61687BB2AAE435382BF2060B6B5BC32376077E551
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/GMLive/std.ndll
- Size 145KB
- SHA256 b82a1320d111959d85cb6c19b869ee6694b82223aca40971e3f512f51046bb03
- MD5 12f41a5e9127a83ea1feea912baacb96
- SHA1 89d8ac625aa4f6fe3786053b8a95dbde5aa25475
- SHA512 95b0727882722cbbe0bf69957b65c97b4c4a6f6c9fa2cd558c6e77671b6c8ddbc04489a6b057cb976a7c24920ab2a7a5e0290eca26217a174702a6995ee746e9
- SSDEEP 1536:rQ1VYdilZ5odmIFA8QwKz5JSCZPNyQb+KqhCk++5i0wfYOahJqdN/9tbLP3:hdy6SXW6kQb+KqhCk+mwwOamdVrr3
- TLSH
  T1A6E34B15AB9D5054CDE56278889F0217D2A2672C07D093CB06F0B55BEE2E7FB2EF624C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/LifeinWoodchester.exe
- Size 6.1MB
- SHA256 3a0155a45e6fd184552da27f1c9e43c5abf3dba0e468cbf331e69461278f2aa9
- MD5 fbd3e30bb75953fd23841a911a0affb8
- SHA1 14ab56f0f03b8f1db305a246b190bb6144ea2195
- SHA512 c1cb229c5b01619e7b8f1ae91603c89b7f8b9ecb7bffd5d5aaf5f79120965fa8048945621a064957d9a26f894aefb5da3cb9cf992582ee28e1c019ce29ce38f7
- SSDEEP 196608:gLg3qjRl0tHTfFYThk7uoLaFxORPW41sgVy6E4enC:+Rl7xOTHEnM
- TLSH
  T1F3565A8672A1C19DD127903CC55696FAE2B13C45CF5097CB26A47F6D3F33AD80ABB212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral13 behavioral14
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/extract_strings.ps1
- Size 6KB
- SHA256 6289b14637673d27370a2a36590e48b2afe821543022c19fe767b61cdb92729b
- MD5 75321eceeb9a3a2519ac78f447240538
- SHA1 b18d89acf8bed99353854bc12ffc7094e2777416
- SHA512 57d11b026e69428cd94963e5a6cbb0839bed0918e4570d23fe3ad896f422fc160e4680187db2cfa16c8fad219770655b0ecf2d3b1509e14db6ce5164f1cd3004
- SSDEEP 192:619IK8RKFqveWHGejf7DPYX0l5aj/eBoWHMki:61DwzNFeLki
- TLSH
  T1E9D17626B983541D10B323B658C26528EE05813F52E518ECF8AC905F2FFA42C49F8FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/fix_all_strings.ps1
- Size 13KB
- SHA256 495ca74415fb3a02e8edbd38ff356cf92dcca3dd5c0f3cf71cdf8f7b33c3cea0
- MD5 c74e8a10fc8caed5e22d852bf90dd682
- SHA1 0f0c9077f7e2d7a67512197e0a32257977da1387
- SHA512 7473f2c8040609a386e408e74e29205f52741b57c067e3c59e28f58c71caed27486bf2e9f273b970b285d461ed28c82fe163d2fed54937062b69bbaa72c5312b
- SSDEEP 384:zf4scaHNOp5rIZNmq9Ea2qOHkhUsQFEg+e0dSAnHS+AFP3l0dr9c1IKN0qmm+qus:au4f8a
- TLSH
  T1915255D749A709EB48A673B1BE6944518835027B025C06C2F76CA0527FFF3DC82A7D7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/replace_all_strings.ps1
- Size 12KB
- SHA256 e11f584e61061704de5bf032ed423bdfc92bdbca16b789b79fbbb409de6fcef9
- MD5 fac508d1aacd95a2327e7459d7918376
- SHA1 1f370b28b2c7e9e19a6fec71c10d343815adbe8a
- SHA512 8a15c74f7d1c5ff60f327f7b2890efcf62d1b1a95186e93b08eca3339c894167ca05c4814b8b946d0298bb75af00dae81f1ab9686f2807f001764870feea00ba
- SSDEEP 384:cMH7rlGCFfaKnYsm0uENl1pWjcXDDEat+lOOh7OesjjsqukXgRucEntM3FmFoVg4:lP5sVlF
- TLSH
  T1E84205E38C531F7B9C7667F66C2D5401947802BB12A893C5BB1D60163FFB2AC0647AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral19 behavioral20
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/replace_strings.ps1
- Size 13KB
- SHA256 c34a0bd886d047c6b12282676513e311b7c1a19b6adc8b60ea991b5b25e7e53d
- MD5 2fcd83ac09cdc759e4915facff1b052a
- SHA1 0a950733bfc11d289c532756381719066ce3157e
- SHA512 bef83d5ddd41132a05000d40ba87254844815477265f1b4f93d717dab179294b36f309cf7dc8ecfbc8a0799b9a2e2ad4140586645ec374e94015b5e822e2699f
- SSDEEP 384:ES/HDpOoRfaKnYsm0uENl1pWjcXDDEat+lOOh7OesjjsqukXgRucEntM3FmFoVg5:hPMxq
- TLSH
  T19E5246E3CC579EB79C7A66B72C2C4400D56403BF02AC9686FB6D60553FBB29C0607A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral21 behavioral22
- Target
  Life_In_Woodchester_WIN_64BIT_v15_1_DELUXE/rtl_preprocess.py
- Size 5KB
- SHA256 ec7d05038cbad04f39a2d4b967938e5a1cc0783be472ccea0babeb160c3200d3
- MD5 ad70c9df76b52d0f2f09c6d9d95e045b
- SHA1 c9a58cb071cd0a201befd1fb82002cb251c7b60e
- SHA512 b434d5440ce0f0d5e008018d83de3ec5253ea643493428107fc0932036986e5618dd172df2f06a9bb1ea7af535276e8465d3bfb1b5b19d21ed52ebbdec4dca2a
- SSDEEP 96:oWSXNb+SMFJCRlQxCB9cpehmgac/YTU/v0HwVN0:QZMFQpYetp/awVN0
- TLSH
  T1F8B13109DC2A560992B2994DBDC1F817EB4943470B203656BBECD3296FB2414C3B666E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24