c3b2bf0a9ac207d45ebcad20d7c8a4c3cf26990ef0d49cbf1a4dbe7a9900ba76

Sharing

Copy URL Twitter E-mail

General

Target
SomalifuscatorV2-main.zip
Size 8.6MB
Sample260603-pd1c7set4s
SHA256 c3b2bf0a9ac207d45ebcad20d7c8a4c3cf26990ef0d49cbf1a4dbe7a9900ba76
MD5 32b25315d718debd3ee336b8d5bb2afb
SHA1 52d43ffad20c0b4673fa4b41d42b2c7466e7d07d
SHA512 a9fb7aec235ebc75aa36ba4789bcc57d1c92517c19a19b1ce8e645381c3db077a9dc2d9d5923a9bf7245e1df08f11a062ca608954ac202c71cb40a8743c4d030
SSDEEP 196608:ajtfm/Vtiyz1W7FZBfCEU4O64nzPdVM+LPLF4My:iNyFz1UoEbONNZ4My
TLSH
T1439633839723AF6CF0F1E9AC6560E671B8620485EE8D97CE3D386C5940590F1CF5A7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://raw.githubusercontent.com/KDot227/PythonPathFixer/main/main.ps1

Targets

- Target
  SomalifuscatorV2-main/setup.bat
- Size 1014B
- SHA256 4fda49d1081f1f553508a41bfd90c686018d3e44885b5d589b64c45bb4624caf
- MD5 23ade71bd852b1cb393f33b816c5cd15
- SHA1 8180e7276ae0dc16403c5a1b3699e735a778d72f
- SHA512 968ac2be1611ed1346375bd83195c1421eb9351fe290b054c6a5dbe6004fff9d251faabf055ca17a01490dda4df01243b688b4e213da3596e1fe2316e0d03b79
- TLSH
  T15511253AFF31A4E012BEB41999B42C1B20B58253DB542FD9E6D011D24D9D510CF1BF6C
- MD5 SHA1 SHA512 TLSH
Score

10^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  SomalifuscatorV2-main/src/main.py
- Size 5KB
- SHA256 c0dbd66bc58c728d0bd476d85e9cb2ef09421fd3a4fc687dd30d141ea2894dd3
- MD5 41504aa7ab52a5d5339e74623ef057ba
- SHA1 6a11697580fd92ae61e44dd0d20d04636e138f82
- SHA512 f9ecde97b091b9b895bc8ce96bf3a2cfad2171744b38b4e611741d73eb937c8aa220d62c00a2e3b402e97877e29adf342736e7e5122b8f80d926fc30e39fc321
- SSDEEP 96:Za/mk1DDWkhBtJqUqDbg3sUFQTQ1nfbQJQU7Ryd2KRNRub:ZOpOkhBtkLDbg3sUG8hMp7o2eNkb
- TLSH
  T179C1D701084A2C6683F7C9ADDD0ED662931D905F0F98B4383EECA7609F9E735D0E69E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  SomalifuscatorV2-main/src/util/auto_updating/updater.py
- Size 1KB
- SHA256 84714cead76806a1940c925c37411961afa4988aa3003322600fb8569c5cb41d
- MD5 c6c50d136cef899ca2482c482e243113
- SHA1 58e39e786a9e8a996c653fc8687cc24111222c4e
- SHA512 2af6989b98d2b84d249a22a7595fec50c7c75a514b37ff70b78ed51cb277aea77024a1e4f574cdbefa1ccf7d61a926a48c189d1fbd512b3109197c4a0d93032b
- TLSH
  T11B1144475C43DA7BCBA7865DAC0C40322338148B6B1C6821B63DA3041F5227AC3FC5EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  SomalifuscatorV2-main/src/util/methods/anti_methods/anti_changes.py
- Size 4KB
- SHA256 427f9fc22d20ddb4dc6c27d9bfc3f9f18a03536570bfdf27a3e71cff11fe186a
- MD5 5b82b6679cfc434917e98554419cfbde
- SHA1 e2ba7a4ab265837873a6f71cf5911a1f895f28f1
- SHA512 a2dc377ae98c70385aee6bde955efe4c4594fbb21afa8328687885a21fd3d2ac0fc8fc75ccc3580bea2c1da219955fe720a955db9fb8c51a32468b01d7bb9099
- SSDEEP 96:XwTCQvtScvc3Gw4RYFtVDCYdawOO2XXCevKoF+EL8Cn3:aVxvYV3uXSe58C3
- TLSH
  T13F91635BA5EEA82E8193846AA1C7C1D5F319906B05615E3C78FFC630AF6095883F39E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  SomalifuscatorV2-main/src/util/methods/anti_methods/anti_console.py
- Size 695B
- SHA256 a78ffb23931f6f7a14176578d3a40c96e46d53de3015c633ccd4f508f35035ec
- MD5 dec290f51805da0a2acfaea32815f842
- SHA1 7f4b5450c62d90ba739a4252be19f7c49acf4042
- SHA512 5add4dc50307bfaa8c0146cb3fd7faa32158a86f6ed93d62ac6e64a3bb51d366f7d997c3ee963f4e361a660b70aea113a9c566491f715126f6e78b5399569fb1
- TLSH
  T1C0019E02DC46DED1AB5741B52925CC39B14C59938F085930FCAC92685FC80A9C6EC07C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  SomalifuscatorV2-main/src/util/methods/anti_methods/anti_s_screen.py
- Size 1KB
- SHA256 7e6e2dfe683b701a624da610415163983cfc71019a4cd06f3937d957abc4df7c
- MD5 2680d45c7f4f42caf178c0df36cb91cc
- SHA1 c689e7d8f51c7a1d15e8ae18281293eb44021238
- SHA512 9d84594219c7c06257567ad7b99452ac79e2ca3e13fc010ea77514c85cc5b7f62d761c80c1abce00ab2134f0415e0b406c8f1d45f5003d4003fea0224f368d20
- TLSH
  T1A5213102CD868F31A9F1897249415423536A68E7471E5830BBBD46683F1713780F9DEA
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  SomalifuscatorV2-main/src/util/methods/anti_methods/antivm.ps1
- Size 6KB
- SHA256 698b9cd06b70762fe7865fe6b79f84a8935eb94e4393fb02cc5534e52362d60e
- MD5 6cc3111f4a858515914dac20afbefd3b
- SHA1 072123826b8e212c77e7e10f50df44876bfdb137
- SHA512 a0f0a5344684a5596c08addc2afd4a31f5b843436f84f89147641bc39dc7dc144b098b7cba6f533f6bf4dfedeba1f102b2347c60d4071eb27b4633968ea4546c
- SSDEEP 96:3dzuOn+oziDzB+iDzBPzX1s4sz+rZznYMcl13E4e/YbFmzzjxrhECymcCLzXUHKm:Q0+AiYi/rvcr38zjxrOCymrE0FerMq
- TLSH
  T19CD19526E5889DC582A710B55D8B2806B589C1378C18BE00F7ECC6DEEF4D62FCB7161E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral13 behavioral14
- Target
  SomalifuscatorV2-main/src/util/methods/common/common.py
- Size 36KB
- SHA256 363a56e59e22fc524b92716abe49237a587cc83c4e2e32f182f24763b7a78c5b
- MD5 2631cef8a6851033ec8bf3da3986cf5d
- SHA1 2a32bd598fe1ee9dc364a602e56d39d4a7c07c12
- SHA512 67f9856bde2f8c2894fe3eee544dc9423399b2a2e8da9547a67fdb263902df3b068d5325e2093dd12f2895c475fdf1c59bbbb9ce75fe2dbed28ffcdd48b55815
- SSDEEP 96:n0zI90NwcPcp+j65HDo7Z8f59JdhP7zx0skab:0zi0NweBj65HM7ZY59JdRzx0skab
- TLSH
  T149F28419E892CC7D4596842495C69D4DA118EB0717A128B7FC8E80E41F36F6BA1F0FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  SomalifuscatorV2-main/src/util/methods/custom/decorators/custom_decorators.py
- Size 779B
- SHA256 696fb9e9bab0a2d99f7f5c02552452c06c0828b5b1f2de4b3557018c4210029c
- MD5 aed6a78e0c9fcb52eafb2370fc41bbbc
- SHA1 1675de3746dd188b17d5cb73786332f1ad7613f7
- SHA512 8bcd773ae986c12e39fac3c3984df98f01d035e954c1c57bc23eb27d87072a5c3af8f810f59bbb80e5b568cc1939e945eba349e628a09d3c38b6e004adf07aa1
- TLSH
  T12E014C42F6D929E1C546241C6C9B9416D2B43913036E30B0F98CE16E7F6256CEAB95BC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  SomalifuscatorV2-main/src/util/methods/dead_code/dead_code.py
- Size 5KB
- SHA256 a505adf27e2b1b4be17a605458dda8fc45f2c4593dbc90892816f17b2364b441
- MD5 a454bd4f0243fb32cde0ff37c2f820f4
- SHA1 b2a67e240789283d8e0098a0e70e17026219143c
- SHA512 d567bf3a91dc65cf11c5d5325a25df1785c048704b2983ed6f4ca91d2d1c872e4fc32897775f4ea7efc7724648272d7cb5a68f6666f30a451dd7cf0b9f5eb69e
- SSDEEP 96:wS7Gd5cpBAEwSSDXcfhxXnNv6H/6SBsFi7hmJWS+cyeQFM:wSZAEh+XcfhxXnNv6H/5++0Z
- TLSH
  T1C8C1CD09F4EA5E2856CE853AB0CB5D85A05023330D043D41B75E687CAF7F6AF62B126C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  SomalifuscatorV2-main/src/util/methods/encryption_methods/cesar_cypher.py
- Size 4KB
- SHA256 009b4c1903d17b0ae8d2698989eca1726af18f2b4d12166665b5519abbafc242
- MD5 ffb73df9185fcf790a8ec88551fbbc96
- SHA1 459b15e7d9ad4e512134bd2eae3c8b1cccc4877b
- SHA512 704d29e637c87f217007fa8572ecd99a709316fad9906afd5e9222e2bcb657f3918115107f790a7f8218261fb8ee394a73da1b48c31983b2246f590469a0f677
- SSDEEP 48:1kcNXQGh1rHoPP048kNyrVmrHnsLj4+EpS8kNyrtrHns/PV8ZLVui+Ec9s8kNyjs:WkX/vpWpVi/+lc9rfDr3+tuOz00gAkPS
- TLSH
  T19F91F315F8C6764138D3CAB914DFC0309D2435335D660A74BE9F63248FB5A76A2BE8E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  SomalifuscatorV2-main/src/util/methods/math_methods/bit_math.py
- Size 2KB
- SHA256 38c62f9513f79e82a663deab162c6a5ce6243d9395c17b0d6e7d6a694c9d7df2
- MD5 f1cec916400829fa7e25be1eb582af83
- SHA1 3b63447fcacdc1b3d5a0f5a92ba1675be6bba2fe
- SHA512 dd44a9e6193ae5831f47f018bc3c7dbc829da85adb448edb70630f3babab765e16ca8409c11dd15a50f172e85ae5ecb226279faf10290c6616c218962f3f58e0
- TLSH
  T1B651DC08FDEAA51693E39B5874E0D002925C7C0393882CA5BC8E51712F7253E72FA9EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  SomalifuscatorV2-main/src/util/obfuscation/obf_oneline.py
- Size 9KB
- SHA256 f0e740a4856fab8651c25201b1b4e43a03f9d5db606cfc43f7bba77681e0552c
- MD5 2fac50dcd72f3d392997a760b622eacb
- SHA1 23c4808b6b16d5cb4b0f2ef62a6eec73927d979c
- SHA512 cdda7cac45d17509dc20a4fa644bad4d7e3aab79e3fbccf10f8e31228f54ce1430f842a7247229d686fdd1a6a7339e5e1fe6001de49d4a509bcde0070ead75d9
- SSDEEP 96:2R2BVTmLsHKHZZsqT3H8mkqT3H55Ym1TrwW55JTEY1x5C9iIoIGzBJJ+j:AIVTmMuhTXTVTXbqW5Djs1LGzh+j
- TLSH
  T1FA12BE01995594D4A68E292A3CCBF407A31CAF63169C0474FC9D3299FF19528E6F8DFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  SomalifuscatorV2-main/src/util/obfuscation/obfuscate.py
- Size 14KB
- SHA256 ea3ded41480b9d9e8bae918c9bf759ddd191664914841c84bca32e7c7bc01ec0
- MD5 f718e67b632e0dcbc51a57bb6dc38a99
- SHA1 35769518ea9b0ade4ecacd938d6ec42d527cd81d
- SHA512 5d409c2b8613d3279fc5b20526a0fc95ad1e9ac6a621880d975c9c33592304cd6c209c9255beaab737d517440f6bc489a8c6a45243cd1068c750dcad609bde09
- SSDEEP 384:xEDFJ3vHuBsciQVoCuOJsY1BWP8uAfN3zX5G/7NXjXu:WDmB8/dje
- TLSH
  T1AC627312A4A60D1983A3B93C28C7B166226CB84397486D34BE7C97A45F9C53D52FCDFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  SomalifuscatorV2-main/src/util/obfuscation/rans.py
- Size 8KB
- SHA256 0b985a10a454110927dede74ffc3c499db27feb30a016328867bf05d46360e1c
- MD5 084d162cadf8fabaa1441c8c1b75b11e
- SHA1 4b2e1154bfc03fa2274a4757583f04c1e2a528bd
- SHA512 9147a949e5ce1c98c3e7a0614d16de65a5aca80fb226b41421d22ab22e0390f3214950fbb41036adba0599b5b131c0393f84c633ed572aaddb6e9aafb50d385d
- SSDEEP 192:b9z4GQJgz2gr1RRN+7WCkdy8/dXa0PgVDgGg:hzxQJ7GVY7E/dKtDgT
- TLSH
  T183024410FDC2189961C2695464DFEC0681ACFE136A841D60FCCCD22D6FB9939A1FDCAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  SomalifuscatorV2-main/src/util/obfuscation/scrambler.py
- Size 6KB
- SHA256 ca539d8cf77f36d34a10988d08b6fbb3e564e016104a0cdbdca7c91cf235f324
- MD5 8919f5a356e4e22101269159e961c7fc
- SHA1 4d1b51b94b0222738213b3868ecbfd0573e84afc
- SHA512 118ded060b2f1a28b101d7c606819c04424c52fec528766809b4e34402b86219ef00e9d4f31f1150c38e8a50f00c5bcaae0040a87cb8fc447828ae8dd91b3b24
- SSDEEP 192:smIkpLzx2rWw4GOKVkSysgSrgSvTX3LFb/X5:skorWw4GOMkS3gwgSvTX7B/X5
- TLSH
  T198C1540278B3642DE5E3C93A31CB6067510DBC23869D4CA4BD6D4E281F6247CA1BDEF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Badlisted process makes network request

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32