9230dc547285af2af891ce0d8fc6b899f4c3d56b78593570d056e45e1e0cb44c

Sharing

Copy URL Twitter E-mail

General

Target
TheExecutor.zip
Size 7.4MB
Sample260522-rb7evac19k
SHA256 9230dc547285af2af891ce0d8fc6b899f4c3d56b78593570d056e45e1e0cb44c
MD5 5addb81d05d37fc0a6d482a841a475e7
SHA1 8229fb135095bc22bccec80a19a056c4dafdee49
SHA512 27213749b714e63284fc6042f1df21a8fb7db0f63c31087bb044c442ae3925e3d8bedce9b0b2079f933f8d43c8a2dda752591fa58a8e8d5d8a6b74376a299373
SSDEEP 196608:ie4Ri8fFuxSV0cn4w1jSb/n4D+q0tHwVCY1YS:x4HcAnnl1je/ni0dwIY1/
TLSH
T16A7633201FF6D9E8D12C562D0172AF6CDB9E8AAC05E5BB15BB90CD728631FEB3360514
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Targets

- Target
  System.ComponentModel.Primitives.dll
- Size 68KB
- SHA256 7b235d877f3ea1d8c9e4fe05ffd6d3e50dd3f0fad7d1f176c97fa74837bdf956
- MD5 891787a87f8b747a4b1cbc7b6949af89
- SHA1 17d7af5353aad66082638de3f01ae28e09dd0744
- SHA512 31dc7195d219754659c4eeb3c4c1961e87b13e3f8722d89f386f4962975d82c0db2eb2e222367ecd275c1931c5960dcf7557dec931e2245c803876a391deb078
- SSDEEP 1536:X9v7P/RGGjnj4n5pnd2sbnVGXXsGko0wrral5AC2oKQXgyKs9jeqg2L7S:XRD/8GSkXXsGH0+GlH2o3XgO9aqZfS
- TLSH
  T1B2632A117BA4133AFA854A7C79F7EE1107B6AB862722DCCB4C56D48D06523C266312FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  System.Console.dll
- Size 141KB
- SHA256 d42c3432273df74d4d446d338926c3eb4da6fb8c423f1c59c38dab6261719b1c
- MD5 d6c0fba44102e9b9818985808ad37324
- SHA1 b7ca3a94efccd0d3445a26a4f235a3d97e3a310a
- SHA512 460c255ee2ef374b9b9009f54974d24201a5b1798528fcd93d57e7b6de2e14c72a2165d430aec34838d0d33dc3f920ed224bada485e38b58f4989804e983c124
- SSDEEP 1536:/umZmkFQRf8+ZzEgWIFIqFJ+7VDFPfespWhKgr1gCuToGcjqPrQ+99kcZwg2L7S:/dAIiyea0ybKKUyX6IrQdcZwZfS
- TLSH
  T12BE36C2B7BDC5822F67B09B68CE3DB904236BC72031AD7CB9556EAC41C45FE94A305D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  System.Diagnostics.Process.dll
- Size 257KB
- SHA256 f471fb86db2fced1c33040a42d71dc6338d5d5bb51d2fa333af46a0d1ee9a04c
- MD5 8427b8e10e2576d369a8bf59b3a4a1d3
- SHA1 ed142990aa982275923ce22ece408de9c7b54093
- SHA512 a2443ab57ed87335b60014eeb31926ce621a8716b9a265086556947884e8e23da49ac21f98ff1776b02f7700491988824ed3d6adae9c5835d0a68df0197f8e74
- SSDEEP 6144:DJmMzsAHUIj35mswWkajuUFXxs9b3NX1Pkx3q1vmhPDPyYQj:w/of35mONjuURjJQvSTyp
- TLSH
  T16B448E326B9C4D29F6D69F7A405596838E7AD7D11F2AD7C700A4FDEC28623C28C31267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  System.Private.CoreLib.dll
- Size 9.5MB
- SHA256 b7aebbe8ea1993d48688e5541ebede63012021b27e633e783900d7998aaff9af
- MD5 c60219cc8a4b526e23b7e5e1e9eb6da4
- SHA1 73c81595aafaa78990c6c0196c071f4994505394
- SHA512 c4b1abafb3f8c02f9228a6e0ceb8cac9586cfc27d2a719cad59c3becb6b0133e761f1e39583dc0f1a9ca565df638bc7c3a5032d93fe06b6b597199f4ef24bb80
- SSDEEP 196608:W0QzMnkcbfKqhaaKAU+OigSxdINaNtp5s3zPmP:W0QzOrvNtp63bC
- TLSH
  T1D7A6AE12E7CDDF2BED89067381ABEB1992FDDA451326EBC72118D99D14227C88C712D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  System.Runtime.dll
- Size 41KB
- SHA256 1cb7640be0cd2f0f97d3b76e89de44f06e6ffaef1940c639e8734bb8e5a59399
- MD5 1e4df2bbee0eb38eead003d87e0e0862
- SHA1 9b6af9918f1c754f6dc82eed6ed64624d7a5e546
- SHA512 501ae7f6dc7096e8972efff545ac00e383dd6e55ea9708b6144f55f7d343b236cb4b4776b38764437ab9485ed9c105926568acc829cec2ea30960be84fabab47
- SSDEEP 768:KBV0jdpFKYl5f4bGRi2xVbcVT4pphNyPhX6Lm5rR8vSoQuSOI:OedGYl5f4bGR3G0bhNMwLg2L7S
- TLSH
  T1F813F570AE4A1273CD8A877288B3A4C109F633CF64B6CDBA541E8596298F355D3B3359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 e64b14c9531b94db14be07a1e4424a136467d3f71ab635cbf09cca803f86d42a
- MD5 6add0aca4c3c3510d59f1f97d9df6a64
- SHA1 39efd3a8cd5d0f3b00de700eeeec07cadcf47acb
- SHA512 cac84cf1701722675f7edaff251a054fbaf353cccd49162523b7e6472f7e293b33781f1d9560f46bcc9fc292a96d5a10e21c3b864af77cf1fe4881ddc55efc15
- SSDEEP 384:4zvwX2BfW6UJWaGV35O02mNDG7I/cj5rR8vSofousWu43ai:PuyNyrh80/m5rR8vSoQuS/
- TLSH
  T1FC723A7A8F5486B7FE26CF31E9DD86559E71AAC0AC429A4B308D01C92E433956F3073D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  System.Threading.Thread.dll
- Size 15KB
- SHA256 b8f8d7cf2fa067c16e957fb1ef14b6f9a4d742bd81c2d839d1f2a747e8245e0a
- MD5 6ccc7c69fa23ccbbadca8e2a31599343
- SHA1 079628db65eb69c6c4d99e293e0e8a7f2086fd17
- SHA512 9613553160a14b1aa9d4591e6152a87049718bf216eaba1bcaf450fa4eaca9a3bfc58d3570cd69fad1545375314f4b5a0f7bedf26d18d987ad96179969459dea
- SSDEEP 384:Zz2EuZV2dDKWca7WaGVEIO02mNDimwcj5rR8vSofousWu4M:9mcfyphJwm5rR8vSoQuS
- TLSH
  T16B723A754F2946F3FD178F7098E986959DB2B6D09C51CA0F205984CA2E03798AF3077D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  System.Threading.dll
- Size 75KB
- SHA256 0a490e32c228d12005fbffa3e9b4239d3e5576c1ac95841a5e8ed97ee2804f4b
- MD5 78bf90d7f501058ec6bc69b9174f8319
- SHA1 67c7c79d30a92ca34c0cef09b1b3292bfc90082d
- SHA512 db8c28ebd0500fdac1ed13d0cd1e97b061550cc06c776618b415b58d2ee110de573359cf8e8c9b2b7bd22a364d71f1f60914b44b1a182d3756c792aa33cc5611
- SSDEEP 1536:oXbM79S1nflDZeA9DwubEGxdhJC/aV0sqfAg2L7S:o4YflDZeA9DwAVxdhMaqfAZfS
- TLSH
  T197736B42F7E94235F69E07B6A8F5E66441BABAB03721D9DF104FC08D146A7C09A713B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  TheExecutor.exe
- Size 135KB
- SHA256 2b3f8e41e6c75111089e122ede703a998a133bb0191d64179dc4d1fa561ac213
- MD5 d4aed0886c8541a40000b13772917814
- SHA1 27678d3a924b6d19509bea05b7614cea9d6619fd
- SHA512 434bb99cc0358722a7d6624191fd3a5eb374297f908c8063def5dcb1dac48065c3b7895c63736e1cd4526f62d34782b5040b113b092de798c53c66874ca25c86
- SSDEEP 3072:45KS66wPh5FXLbHoBqgzCMQ94W5jZS9UH0oQa8NZfS:4s6wP5q7zNmBo9e0oQaE
- TLSH
  T1DFD307207AD7B670E5613670497FEAB68169EC294F7102DB23884D3B2DE06D31A33B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  WinUpdateHelper.dll
- Size 93KB
- SHA256 fd519d2a5feeb123fad20068cc1bda70dcfea7bde3d98e7adbcc1bada0d08af7
- MD5 c43a142bee928a400ebcb37bef163c32
- SHA1 6a45f7ff7b0ea224b9378955a267d4daae68fbb3
- SHA512 4242d591342df2242603bb49407ca8ae2f73a323bf2354fe555f0480b979036a731028576a0dc2b9acb4a19a69d8963952e0d54dc21f6daf547a0a0bbc58302e
- SSDEEP 1536:S/0e3ME4yVhTRTewBeEyKsqFSSWWpK1iyyg0Bc5g2L7S:SD3ME4CRRTenD2Myg0B+ZfS
- TLSH
  T10193654126FBB215F6B73B705EBFD5644A3A7CD5A87AC61D1280047F1EE1A008EA3736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  clrjit.dll
- Size 1.2MB
- SHA256 bbb9a5c39bde4d2f331ad462ab7b97b082dcf09050d2eaed29fa0220f8246265
- MD5 5398edd2e5aaafebaaeb972a7ae85660
- SHA1 5e57b6ec392dc118b24ddfe9272b7c52c9f3f7bc
- SHA512 8542aa897f51906e81fb9257c46c3c167570c6c4f06fe0e9a18fc1a6f27d046d046ee0f66e86e2a80f2e26d4b2085ef3dd697e7f0a6169f53dc2660a77854bfd
- SSDEEP 24576:6LahvSnoliMCnn5EaWc2rywumsTIw8ULc7n0SW6F+X/GP8:8bolen5enmwumL7QPGP
- TLSH
  T14045A0A2E98240FBDC8A0230446F77566B7C963117768FC763F41969FA706C22719BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  coreclr.dll
- Size 4.1MB
- SHA256 40888f1299596b2c7ea2e4a6b669a4292ea59977a8231cf2172d184017a458c5
- MD5 5525e1d348f1fb563261accb1cf464df
- SHA1 5297c15274d58fb22f20b4fcac5f2197b5aac918
- SHA512 ab03e95fd9001aad5fc895ce32764f8c26f7b88338402ade656a9969c76ce6d7fa5dc3ddfbf713ef6235e9b6334671a20cbd8a23aab312d5b68e9a56087b6114
- SSDEEP 98304:I7zXEtznDMYWgBYAC8sJNlKHGRJaTM6a7lPB+II7l/MUwNnW:YzXEzwY5Yb8qv+AJSMtlPUBh/MUz
- TLSH
  T11816AE32B6168836DA1E0234551EBBDA85BDA771477200C7B7B47BCD6EB04D223B6723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  hostfxr.dll
- Size 303KB
- SHA256 0cde7a5e20c92c31b1b9e6c40704efb67c7b13a4c78cb5b792605c43bf39cfc7
- MD5 53250ff4dd4cb579be655e9e27a8460f
- SHA1 ec5e263aec9ab805ee2108f5de3fbb5977a8c0cf
- SHA512 916114baa49f8cb95a5f8e073edb2ca3ac7643b02f46e269bdf1d5805bbd62fa06a51298c79cdfe42b9fbf1c497591df31edc6d84c14be7db5c4c6748fc7f077
- SSDEEP 6144:wUrFIqYA5rCxCmgStCYEnOqQP3waqDJRCh6Gmq65STK3dvaidPym:wUZfYA5uxCmgSMYEnOqQPgaq+mqOhRa3
- TLSH
  T1C6643B21B69E8239F5B6577069786FB690BE7C189FF0C1CF5340492E59226C26B30F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  hostpolicy.dll
- Size 319KB
- SHA256 5596a6b909f75fc76ec793389a030d5d4cacbb2165b634e4b2fb7f88bf7b584b
- MD5 1d68f37254a7bc3b2c522cb7d2d4dae1
- SHA1 f0aed3b194dcf76ea410a84b2f56c720a0403d1b
- SHA512 a6e0ae0dd7f8b4d6c9221dec303f11419a1a47d98a357dd6a564884edfb80f8f5dc57079a940e15f126a3d4a792eaa20ed2b25fe12a2a7fcf1638c49ef1a962d
- SSDEEP 6144:tRwrkfcXu6zMcLLP/BxDQf7FCX8+MKujdE7t/JN+mvYsm:srKmMWTZxEDFCWGtOmAs
- TLSH
  T1CC646D21B6AEC231E5B55670597D6FA694BD7C289FF081CF63804D2E58226C36E30F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14