37b0f3799af9587c2d14dec3bb3da3ce60b6ae57472a82bf9a6dca9569b9c63c

General

Target
sad.zip
Size 23KB
Sample260522-ezxt4ahs31
SHA256 37b0f3799af9587c2d14dec3bb3da3ce60b6ae57472a82bf9a6dca9569b9c63c
MD5 38bdf29a2c9275fb68ae37771ac6b6cd
SHA1 b6b944585bbd359bf798dc7b386a73bf3606790f
SHA512 f101865ee644b5ba538caf9ab6810713a8d33d40495a1d1b6255ff8d9d7683709193c319c7cd5c680f2afb9eac8f846b33c35fe8dddef169c44911dad300e966
SSDEEP 384:Q5OkPtEuYgunMgP4nJ8xev8F411zQ7GVpp+dRl7ueZohv/5Le4jIyZuizHWYgHlH:Q5D/yfP4nmxev8FoQ7E+dRlqeZoR/UO8
TLSH
T195B2E0049D1F259DFFA6D67DAEF3595F060805AA0EA0766E521563FB0C18BC1CD32884
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  sad.zip
- Size 23KB
- SHA256 37b0f3799af9587c2d14dec3bb3da3ce60b6ae57472a82bf9a6dca9569b9c63c
- MD5 38bdf29a2c9275fb68ae37771ac6b6cd
- SHA1 b6b944585bbd359bf798dc7b386a73bf3606790f
- SHA512 f101865ee644b5ba538caf9ab6810713a8d33d40495a1d1b6255ff8d9d7683709193c319c7cd5c680f2afb9eac8f846b33c35fe8dddef169c44911dad300e966
- SSDEEP 384:Q5OkPtEuYgunMgP4nJ8xev8F411zQ7GVpp+dRl7ueZohv/5Le4jIyZuizHWYgHlH:Q5D/yfP4nmxev8FoQ7E+dRlqeZoR/UO8
- TLSH
  T195B2E0049D1F259DFFA6D67DAEF3595F060805AA0EA0766E521563FB0C18BC1CD32884
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  sad/blood-mapper.exe
- Size 40KB
- SHA256 94b43f93ed9527f309693a893e7f57898b70ec738e7b3cdd4cda052866138ced
- MD5 80031aa94d8eea5116a3f4220efb8b3d
- SHA1 6790527dc4d5eb0ca5c7f1d1d7f8398d30ed6c30
- SHA512 514da0429023c6a1fe2e1d7df4a88e297802857ee9ff1015491b235f55a5f682cf89130dfd65d34ded89da51059402159c7f61e5613df04ac78f003813b95b59
- SSDEEP 768:Y14k2pToB3qF5kGm2E4s5XymstdUF273CSL:BpTKY5kBb47tdoRQ
- TLSH
  T14C132A57574500E8D066A2FCD9A3472AD7B27C4207B2A3CF62D9C2194F223D5B4BFE62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  sad/bypass-b.sys
- Size 12KB
- SHA256 bb1739d53b56d81e5707ff0588d98577f2fbddb6ad7c611c4773884a2092e505
- MD5 9f208e3ad011e4cae1b6a7a432ac523a
- SHA1 6585fa752406ba7cf92f32fc4f64bb9abead7bad
- SHA512 f13a593d2be96f54aeedab3a0853cf02d900f8ddd84382337fb83c609ee8d2f720b685db19a0a82b130e95ef0c6c38af8bdd11e3ce4258ee49f64582b6e3d734
- SSDEEP 192:l7s3NzC+Oyi402lkZiyidEO4cKRhp6sjH/8nWONlWP:luN3Q2lkTFwskPO
- TLSH
  T1A9422A99B25128E7C58A813DC0964617A3F4B540336607CF3AB690370FFBED9693A74A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5