808baee32f635ec2fa7d5b8061a41bbfd285702d568632ed3237a9caa9dd3051

Sharing

Copy URL Twitter E-mail

General

Target
Tomato-UI.zip
Size 16.6MB
Sample260503-trbdfsds7x
SHA256 808baee32f635ec2fa7d5b8061a41bbfd285702d568632ed3237a9caa9dd3051
MD5 8b26cf8d7e6a14c03cf05144fc102205
SHA1 84b2fe70e7be1b6db55176730156906f82f7fcaa
SHA512 47ba0f76fe11af874016e09b5244e6d04527c5bf5d9c18ae6a1f25fd32eac71ad2713f26a91acfb65255e3737f13b78c708022f9f415a5128cf203440aca958f
SSDEEP 393216:gUIsTi6ConHzgyINWOfFEie8aA96WtX3viUHBnmgnPhbELhVcDtcb:JIsTNConHUyINzdEi4+Z1hnBnPhYLnm6
TLSH
T13107337BC5B5864AC683C9AFA7E0B408723B6BCC0F2B55F9755E0B74F8226D4C6508D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Tomato-UI - Copy/Bin/TomatoModule.dll
- Size 13.2MB
- SHA256 e41369fdc485ab723262281494bb5f89dcb027633052dd73828fd5d6c3dcb0fb
- MD5 a399f063ba7f356fafbc5644ee604e35
- SHA1 76caa4b3c804a59fd7f731eab0be04e1f988b3b8
- SHA512 0e3e5d9f80e5842ff53d8c3729970918f577f7b1aa0d5a4bf1ef2900152889cb9d9e462eaf887850c5d559c59c5a42b83e071985b0c49c35ab23b6d927c1781c
- SSDEEP 393216:Sg+RCqB1qq62k2/mc7dLzgOiSQALizl6jw:Sg+Rdvqqqi5HgCvusw
- TLSH
  T150D623EA84D921F4EDE34B80338A57CE71D1715D4A6E6C2D36CB1C81AB32D9B4649E33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  Tomato-UI - Copy/Bin/blake3.dll
- Size 82KB
- SHA256 f781faa2530b4d96257fb8c3a5d1f53a74434b12fa785ce4022a8b5621cfa6ca
- MD5 8467cdbb3d3217ba90954eeac4b2236b
- SHA1 528271d454752132706632475d5806e682780bf4
- SHA512 353c1c945346d6b7fef5bfa4928c11ab0daf99a7c1c921ad39baf46b3b3d41768431327ea62aae86081f5c8ed2052131038aa2588a106521c94e09b00a8fb21e
- SSDEEP 768:9ozGuz/tpAQ0yrd5TdlLX5CgY5Y69/J/AZr3NxaHbvCrtd4nTyrQknlWwhBpC4:9szfplqtxFAB3NxzrrvBpC4
- TLSH
  T1C583096CB06B84D4C81375B9C27A9335EF28A7BC1248D7E9138B46D62E537E42E34DD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Tomato-UI - Copy/Bin/libcrypto-3-x64.dll
- Size 5.1MB
- SHA256 d5f896a1a943a36b0ffd387dd45b695800bad9f8d1018257318662635796e658
- MD5 310e8fd6eb4940bf12b0043bea62d78d
- SHA1 c355cfc27e9e4f0862b74aa59998809d49958f88
- SHA512 824efefb5aa7681214158caa20b71a7a1e92520a1274c69f6e711c9555acadf3ea3993344c5082e95078496f4f35912a4eb50def3455905111e4af5743d070e3
- SSDEEP 98304:09r78UJf7VMOdDcw92+N11CPwDvt3uFlxCsM:UrYUJf7VMOdD5Ag11CPwDvt3uFlxCs
- TLSH
  T1ED367B69B5BC0045D87A81BCC2936227E771B82657F057CF2A685AF90F23FD42A7E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Tomato-UI - Copy/Bin/libssl-3-x64.dll
- Size 851KB
- SHA256 9d728009d1be8f0d59696a9eed18a7f101f77981d10c026c565db46e49f69db4
- MD5 6dd67c2a2b41fb9d92b4812cbbfff9a4
- SHA1 07d3f29e4ee797dc41ab92988604fe0c33304664
- SHA512 860b320a8930cb64b0d5b9172e44b0c64ca4954a910e5600687ae40aab0264d737c86057006ac523698fb977dd932deabf1d96f8409acce2fe8f8711c577be1f
- SSDEEP 12288:h7nnpVLEReF3/MZtqiaaN9EMMi6TAB6JNrx2UYBs32NOUAm:RnXvStDE9sB6JNrx2UH2NOUA
- TLSH
  T17E054C65BBB8119CD862D17C86D34213E6B6F4173370ABDB0B648A792F63BE1223D354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Tomato-UI - Copy/Bin/lz4.dll
- Size 123KB
- SHA256 fa70fe1001d5d87f86e805da3c49ca116d28547563de674aa35cee50c0305b38
- MD5 87001994a77853232c8457b50ae44814
- SHA1 fb7f8f7e3913c1f2698d42ff1c86c946720442bc
- SHA512 df031e49bfea4f39c78a6e180cda8b5189ee142c43b3a10f17f9e286279631167492d5028e81af9ec4e932fdd13fb0181cc5f5f91c54ad97a7e4484070c498a4
- SSDEEP 3072:u0yLKnP2CNlM5h2abNGikOUtRWBuX98GRM:u0m5OM5h/bsOLBuX9xM
- TLSH
  T1B7C37B4BF3E515ACD152D0BEDA9B464BF6B8B8152301AFD743A8CE756E13E804E32352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Tomato-UI - Copy/Bin/xxhash.dll
- Size 46KB
- SHA256 841b7bc7571d88202963f8a2011f8974630c650c23a3f0888d3ac3fa9e91c713
- MD5 31913cbb1355ac9d338a023aff20f355
- SHA1 92330dd58358d17028676c6be93f21a09938e9b0
- SHA512 75e8312f388c077e60370bb0d42fa36f5e90f61765018dc167734af7d24ee6f71eb90b5c7e84c510a0a19361e142d8143737bc7eea6515481cddb8dac311d8a4
- SSDEEP 768:hvqoyOleS02mSyKWXvmu1xEycevadu9lXWXKtKCxl4w:QlOj7m5TmRycevn9ZWXKtKQl4w
- TLSH
  T1A2234A47ECA48AC8D567E77CC67B8ACBF5E93A1C631145E3D7A724A414A33C06737282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Tomato-UI - Copy/Bin/zstd.dll
- Size 643KB
- SHA256 5cd1790eac6a9e8792e4c8a6ecd6f856c0b433671a8e0facd4d4b12efca047fa
- MD5 3ed0936a01d8d6e188ee53030de9579e
- SHA1 cb696b6f4f892f37408fca69e975e4f836828a3c
- SHA512 dcc5bec8528e6d2ca552a8834784518a111be91cc6d351131f2939032274d2ef175ed6d1789f294f4105f6845d830ad1f1bc07de79be08072e48ae331d22afd6
- SSDEEP 12288:Rz7UEAKdgfa7MVE3QmBlJN/sDgNEYtbdDkaBrY1SrK4YA8jJR:RzQEAAgs/sDgNEYtbVko3K4oj7
- TLSH
  T1EEE48D83F29592EDD13FC178CA564363EBB2380613046AEB83A4DF652F13AE55B35385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Tomato-UI - Copy/CuoreUI.dll
- Size 544KB
- SHA256 7940375b2c2e4b65838e2c875f99b8593b0be4e4e6c7a3c9a948ac74e320717c
- MD5 28cd49775e83b7a3fc237b0a86d0417f
- SHA1 6d73def5f79e316ac6d577f55fece9c2d05e5d78
- SHA512 38b9eb7a5acd7c67b059c2b27864e35be8900f435a0d517a7a24380b9ae3d251afb413d9c3bcef5db7e0df93a8df0a22261dfdf21cbaf77810ab697cc8f3d9b3
- SSDEEP 6144:MWDAJHRiH+2dDztFrsRZwhC7UFmL4c6/M4pUsuJGOW8z/QafxGERONgjFeDgVgG/:IRE+IXHww87+tU7sXOz/RfxygTBl4k
- TLSH
  T17CC4BE3433588E2AE17E477C80AB99A1E7F59212B31FD79C5F81E0FC29A271696170D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Tomato-UI - Copy/DiscordRPC.dll
- Size 90KB
- SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
- MD5 9f747cc51687d853f92f70a537ff6ca6
- SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
- SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
- SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
- TLSH
  T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Tomato-UI - Copy/Microsoft.Bcl.AsyncInterfaces.dll
- Size 25KB
- SHA256 1c95b1a776931ca1c4f2911b2ae1cc99eb78f547cd5feeaf5cdbdf10cedad0db
- MD5 3dfd72446d541e04ace5716fd2052dc0
- SHA1 8b634cf88a10b5f6c1b9d1a34705d63fdf454a38
- SHA512 eb28d59ef60f588ee0be755ecec5ae845267653a85b4be3fa50fa28eace4862150ada4232e5fd70c56ffe64850bf1332e65dfa7657bb3ed22132f266f80c1986
- SSDEEP 384:vBOJWqnwGBbNAJTH0VES2j0cX6dAl+NW9DVzrdc1Wez/WAYA6VFHRN7wFEpcR9z0:JulwGBhMQVv2wK5TdcB3FClwFEpw9z/s
- TLSH
  T191C27C1A932C5327CFBE2EB5E57496862E35D78A2C12EB3F1188E2991D47385A730734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Tomato-UI - Copy/Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 50e9c2f516e2f05c4d8ee925018314353b5f8198795f2222a4d433bddfece078
- MD5 883f1efa99b9c89c97a8ab409fef0f23
- SHA1 5f0e7ea4febfe56702b0dac7533f8b22fc5bdd3e
- SHA512 4b53d66e1451d85e698e3cb0a6f31e4fc40fe61633620045722153fac4e550856139a6055637d34185236ad7cf4f411828869eb7b66c609212186bff7661e934
- SSDEEP 12288:EBfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRFrP322U:sQcl41OU
- TLSH
  T173D4522223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Tomato-UI - Copy/Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 e0032d422ab2ed28ce411ae00d27bf816d46c4c660b7b6d642ac420983e5bf33
- MD5 14df37de49b4d8a269de90e8c6e1eb7c
- SHA1 5e679a4cf80536ed0aa0202ed4fbe5c31bdfb864
- SHA512 f422efaa0a510add3d675655e19645804590c8a6294480259e23cfa0a54adf13881c317b285076f7b0af3a8c945c1531f23b430cc900825b97f46bfd59756263
- SSDEEP 768:0YQNb2vIYymJ22Mss+5JQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxH:0Pb2vLbJQ+ZDgcEST3p4JjrjaeFSUyaz
- TLSH
  T1E6032B4083ECC517E6EB1F78A5B491610BBABEC37DA1D3A81D84F2DA0C73B9055143AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Tomato-UI - Copy/Microsoft.Web.WebView2.Wpf.dll
- Size 80KB
- SHA256 d6d5e8142ca92fede970f132eb1ce8eff99225e5289989db0ab0aea83585d850
- MD5 b0f5101bda90048de2f7cdbad04403a7
- SHA1 61b4adb2a095886c991aac4e6f8bdb17874e4326
- SHA512 cec16974e9ad37fade59af5e5d43fa2855fb4e204d159d79e6b5cd9781dc29559772e42c31fb71e968050e40a292714961d7e88de7d87dae2a23fc8de4b547fa
- SSDEEP 1536:xU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udd:as+vLqrThx6spa8+DHfFy30bpc4Jjr47
- TLSH
  T134836C8193AC8923CAEF1FFD7C6050140FB8FA83B652C79929C5B5EC1DA379119197A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Tomato-UI - Copy/Newtonsoft.Json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Tomato-UI - Copy/System.IO.Pipelines.dll
- Size 82KB
- SHA256 d881b5e01c527bb7cafa3c2482f7cbfbf158fcbb6f93efb4381b638c2d4ea6f7
- MD5 6c1158f437026832e069e757e02030c4
- SHA1 e0f6e168f17ed935bc189edce13f15b77c12bab0
- SHA512 b0f6621b47f07b81d348c687221b86ce47f95bc79219365af3f2f628136dc7b16c2dd9909ba0de39fc55b1b39dd512f8ca645486ceccf2af86cbf5f0fa5b397e
- SSDEEP 1536:AOBEtNwWq02pH6ZafBzoGrriJNNjrgFX94bsAbYo4bgN0xeR5evOjvjDXT4Oe5Jt:3BSNTAl6ZcBzoGQ8XkJYo4bgN0xeR5e9
- TLSH
  T1EC836B6853BC472BEFDE1ABDA57096020FB7D7166913F34AAC4CB9ED188738046142B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Tomato-UI - Copy/System.Text.Encodings.Web.dll
- Size 77KB
- SHA256 ad6be4be7e0183f3eabac3f747b834c557156942c7d2ce12039477ad0874fbfb
- MD5 56a2b64c40502852dacef02240ad46bc
- SHA1 4019d0f80c83dedfea9820f91650bfae817451ba
- SHA512 19c5fa4a067332268b9043ee57c6e66a8692ee0d16d1c82d08de68eecca327886aaa2c69f179d60b1818acf079aecf961f6feea0234dbf4a75ab51f008b34490
- SSDEEP 1536:uOOUnOOOc++v9mBkdQ3IWIxL1HFkzoA4Vnrpwp77ojJjn7NoWgzInv:c+FmCQ3I077oljRoTEnv
- TLSH
  T1BC735C26A788872EC73E16305570857097B0BF9E1263F7825894B40F1B777CAA71D2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Tomato-UI - Copy/System.Text.Json.dll
- Size 947KB
- SHA256 01ee4e997839141be6b9f28401736286700fef4d0ce3b31f3103ccf9180c3960
- MD5 7fc3a2eac878bd5b77009c25e6d7121e
- SHA1 6930e366e0207d4e9cf83d405f220fdaab432dfe
- SHA512 2e2e824a679403faba3f0adfb145770f996d100939e2fcb0acc2dd30aa5ecbcb9ba2b253b0ac61f76cfcd765de66a68b0790a6044cfa34000a30dcb4c7c0d270
- SSDEEP 12288:Ot5CIBYtZN3lYQX/Qr/5ALzdT4qMZTZmYZfCzxnA:MCGYtZNVkQoRCzxA
- TLSH
  T1DE252A02FFEC9F2BC59F7374E8752101A774EC5A6796D30B161094BA2C63BE49E80366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Tomato-UI - Copy/System.ValueTuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH
  T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Tomato-UI - Copy/Tomato UI.exe
- Size 445KB
- SHA256 58df5162c3dbd843b1d85e1289682d4b29a53566277343547b5d042e2c64230f
- MD5 f316a339f166ac7ad69824d896d8923e
- SHA1 1a771a5673b60409871c335f5b766f06a694c029
- SHA512 80d4e23b1b4e382d553e7d7136f8012e96aede19ab5b05ec921a43ff4c3bf4b5dda4b113cf1db46aeb99a17c1c9e6c63d51ea9a77d552e126cebda4b69bac71d
- SSDEEP 6144:CXGje6hiPMiOlwX4J8pngzEg76u1Zbywk/IAAo1p4iAtdTcEwPG4rwGAw6j:qWBW4OxgzEE6u1Zfk/IG4jtxr4rHc
- TLSH
  T1B9A45A2961945E00D26C2E74C7A2D53007766EB93633DB092FEDFEBF3C722925961287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral19
- Target
  Tomato-UI - Copy/TomatoAPI.dll
- Size 306KB
- SHA256 77303e8d502293207b38b9be41b5e2b92f11e70a6a0bfea1f0b89378e973bf47
- MD5 9cd44c7b873e58a74c8da3b6f8719185
- SHA1 b7068516b55fa6221246f415bb3e3b245b868a00
- SHA512 1b645caa0a2898227fd33f7c8afc137d556e9e877d8f97900d50fc3cec60e5591a22eef36ee51a48841ecdfb6e57fb21b3bf4fe1f0638b9d510220d0dd4df5d3
- SSDEEP 6144:dnzInzOJW0bvscztws9ri+mj23zAixsjvGKYvH:dzQOZbsktL9W0LxsvOv
- TLSH
  T1AC64CF467392CA01C7951779E1A374A1A3A0F68323B7E75E3F4D9AB868433F4C9093D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Tomato-UI - Copy/runtimes/win-x64/native/WebView2Loader.dll
- Size 157KB
- SHA256 bf2fefaff7fd4775ea1e07328cc3142721943948f16d261fb82cbd978b7f99e2
- MD5 5525f542ef0aee3c546cd2a4cef5c9d6
- SHA1 3ece5714527a45cd43b429e66c24cf3e7150d907
- SHA512 ecf1922ea28d2cec125cc81c2254922a81d2bbb5ee05d546e929d1ceec747da6b7314fa2102e7bb1c398bc53c283d50f09b1aa6716869f79752405998dd1e733
- SSDEEP 3072:Q/2N6GchehS7YQGKTtXBJZi9JGfJT8AEtJZkYmRSI+H8qF:FNNq67KTtXBXzEtJc+Hb
- TLSH
  T1D2F34B5BB3E500BBE16BC278C5A74A06E772B81117509AEF036447791F237D0AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21