761d1771841dc60204d4e76f0e448a55dbe91e4a3a673507e0bb84fb3cf25919

Sharing

Copy URL Twitter E-mail

General

Target
REMOTO-DLL-Tecnico-v1.1.zip
Size 28.9MB
Sample260603-pgalysfy7p
SHA256 761d1771841dc60204d4e76f0e448a55dbe91e4a3a673507e0bb84fb3cf25919
MD5 10db11125675945c0321e875d98d2213
SHA1 8bd86a29081240324569ce295085bddf05fb3455
SHA512 47d5434c82dcedb0fe18780e2cdada966f3a90ba8b2f51f93ab9c5c1712e6b7c3b4a0359c14542c4c66fbcc4ea064dc6b3ddfff58f5ceb93ceff9e3097a7e49b
SSDEEP 786432:oHZa3vvF7/QB5HuPZdaHz90HvGHmKK3JxUGAx07SqniOBmdlU:oE3vN7/45OPM90HvGG5ZmGSINBmdlU
TLSH
T1ED67334ABD344F169E83A9747217ED721BA00E16A8590702CD9CECE67CCACEDC5DAD0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  REMOTO-DLL-TECNICO.exe
- Size 396KB
- SHA256 f2d88db941dc4a90b175c0ef3cf42476eb2c0b366a81338a26065c9b29c59281
- MD5 e91ab4bd3623cae279dbe5fb627eea57
- SHA1 b720c7acfeb3e98e18babf0454e33f5988f6c72f
- SHA512 0d239847c70c8c7d4b07ba67c1eca7df307be9349f6d6c805d62b71ce1de2d67eb4e9f8b723557d8489f03d742093f8527f1354d06bc3ad62e4d80d5179625ac
- SSDEEP 6144:k+cyl/IICwlBJuSaPwJ+dU6WcH9WaqThWm0EjW0Vq0TBNk7am8D:FCwlu++dWcH9qT0m0EjW0Vq087x8D
- TLSH
  T1CB849E1AFBA414F9E1678138CD664945EB727C5A0BA1D7CF23940B962F33AE04E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
behavioral1 behavioral2
- Target
  data\app.so
- Size 12.6MB
- SHA256 620433ab7f4364b1ef4bd17ddac901f22aa3dd5939207f8dbafcdd5b1d85ce2f
- MD5 b3319fd9dd796d7d8a5a8ac9188afdf7
- SHA1 ed295edf127295ab2f50bae72105cb0dcf518a35
- SHA512 648fff82912ec6db786ff0eda84219b92517f4a0bcc69601a8aa97557891a8a3d6e809709590a96fe593e4d68915f9edaa468e2de9b7bbc09d35e1143cdfe060
- SSDEEP 393216:3oVyjwwaDfU8zxymnpIMpEiH4oqILCiZqZlj/A9wO:C8wvLH9y7MprH4onW0qZu+O
- TLSH
  T1ADD64B9FD4F143A1C065B6B1F79EABBA5A187DD84E70A18645EC4B723E93C6007CE132
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  data\flutter_assets\assets\actions.svg
- Size 386B
- SHA256 ef6597b20e4578e8a6ddfe62f46a9681a8e4649b132f1f10f9fc5da15018a7c9
- MD5 2a43efdc71e95b7db43c1fc5ae34ed87
- SHA1 4f93c1bbd67a7ae8c9194a1ff28db0110eedb482
- SHA512 307fa2137f0b777b28dc6b52369cbcb0666e30a5e591d6d551870ad1ec33bec1a9e8eb9b5cb7ccc3f1d151b3e0e9e1d029b79e2f9e6947e9d8cfbfe5c7d880e6
- TLSH
  T14CE02B4409EDA562C49BCB92D77528E4112221C7D67D05ADD9A716287149A47D814D88
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral4 behavioral5
- Target
  data\flutter_assets\assets\actions_mobile.svg
- Size 657B
- SHA256 527c6a251e5053ace7e469d2b1080108448ade654a5641a3b8d4052df94a13cf
- MD5 840555746fccec5610779500eec942be
- SHA1 bbd33fb5f788bfe6685ba2a0539724af32c7086c
- SHA512 10d20eab5a8607e7c8fb0093188ba0bd4803689231536b2a6d4e98ee58f6decfa30b32e3c713a869662a3d581636a976dc25bd4ca5de431d9d12b6ac197f5ba3
- TLSH
  T116019EF44F7CA81D405F9C37AE25C685622934B9314881E4918FBD3D6643E23E54745C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral6 behavioral7
- Target
  data\flutter_assets\assets\android.svg
- Size 952B
- SHA256 3feb445086c26cc0db5153b5501bfa29d7824cb62f287f2217c51d728ce61522
- MD5 2172ec92c0da8b72dfe31565d5cee45c
- SHA1 e1f297cc70cd5ff606f0cd2bb64bfaa793a1c71b
- SHA512 ded049fc27cb3f19004e266ea286be9912245d5bfb61c326b7722bb177c36fa2ca59d7a2333a6299c2e46d0c12175d43a1e63d9d70c155a37b8395a471c3d592
- TLSH
  T16A113DB1B6BD300FD26B224D5F5842A5C36EA635728EC9D1599DE3F0450FE26D227C48
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral8 behavioral9
- Target
  data\flutter_assets\assets\arrow.svg
- Size 380B
- SHA256 fe040cf78012f519f391e664c55cd3170be59575520995a4bc143d2943fb1d64
- MD5 ef5695b014466fc2f60dc3a201fa9435
- SHA1 17719cb0840d6c15ee894dcdb08f3c74d17a82ed
- SHA512 1fa6b99512dfffc493b2533f4a82045909845010c515e0b8dbcea46add429891232a84c424cf901225274b09221c69f4f74bba0e55698be569aafa751bf61661
- TLSH
  T1AFE06164DC0C081EC17E49CED5795444279B5CF43318083D590D3735E003A92E047C4C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral11
- Target
  data\flutter_assets\assets\auth-apple.svg
- Size 1KB
- SHA256 98583b4cf0dc8afe3b5025fce65f261c2f01264afdbea19b591853e8e93d7fbe
- MD5 f96f69a4e4e7f5415d0888e249198b8a
- SHA1 1c5a79da208fbec599cabca711914f277c3e1dfb
- SHA512 927519b1991e0d8f27cefe0dab83e63bcd3855d44fcdf8c25f9927128f2a441642cb9c6b3da93f6b55e4a50168e032d35bda0c16a38362f5cf78f43c8c5c35aa
- TLSH
  T16F218774C3948374DCEAD7B49723BCB5649F5AAD80E1D35E4368C8A0F2941EC624C8E2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral12 behavioral13
- Target
  data\flutter_assets\assets\auth-auth0.svg
- Size 285B
- SHA256 65360327073579c1e72626b3dad257913c6653bfc82b1becddd5f49179fa511a
- MD5 563377c91144cb7d1a02ff8ee5aa58bb
- SHA1 4d66b425ab761ca36548d8d73e699e9129d206c8
- SHA512 1f5454acef401c130bb9c4f2374d204c4c6036f22e5dc34decc133149dae5a9968a969b27b77441257cc334ff50bf37f02103368ea7145625930926911a37dce
- TLSH
  T104D0C2B5626931B9945A231ED27212216F52B1A98FB408D88BB4514C404DE22DB24ACC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral14 behavioral15
- Target
  data\flutter_assets\assets\auth-azure.svg
- Size 604B
- SHA256 6586f685c555ee5658ca0530075ac3ce4aae6437d2aea9a109fd70ab6dcb7293
- MD5 0b862edafb052f0211c3d2faa00531c3
- SHA1 0090e57c7836edbe09371e86c1f1e912cbc1f32a
- SHA512 4670e99774f6ef600665890988860370bf71690dc64975cbd92dc8e14d2e271f2f4ce5309c9f646d96f180cb34156ff2d072fd764ab9a1d837cb142a4f67d817
- TLSH
  T15DF002C8DABAE72CE444971B27195C943582E45EF0E118D4C2412336706BFC85595C9D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral16 behavioral17
- Target
  data\flutter_assets\assets\auth-default.svg
- Size 564B
- SHA256 1e555baf5a32c88d5f1e47648c0fdae13e211e6a743632cd68256cd35aa259e2
- MD5 6c1a2702edb372085ca4371c4ef09aa5
- SHA1 65452f3e76a9bf03d94cf8f336f0c27b99e08e56
- SHA512 8d64bb64403751fba02bfd0de616fb7c0ded7d41ea9feddc429f8079dd935cfea5cc09f4e42bca6c477f5e9025d8c08d808f0892ca76b5316ba96387a2314d74
- TLSH
  T18CF0E1C4EF84E07C50041451C310859D40BB12BBD6950BAAD2AC8B8127F2C99B80C9D8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral18 behavioral19
- Target
  data\flutter_assets\assets\auth-facebook.svg
- Size 274B
- SHA256 7d05241541ea2ac9a918a5852ace86c06673d8aa54cc02a274c8bc5ff7efa715
- MD5 ee6b89b302080bcef63b9779b6c9bea4
- SHA1 36b181f17a4c0a94982a8dfba0a51c3f58c1273f
- SHA512 0780d8b981957aca62a328c7f94832b3633a733e125140deed8a633183a1aae9624683bdeccd68699f2051e33ce4e4ebdd356349cec8feea5e866966071b65d2
- TLSH
  T17FD02B60E1B4E51DDD38573D2E68B4DD006F604D8241417DE488497CA257BDBFC4825E
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral20 behavioral21
- Target
  data\flutter_assets\assets\auth-github.svg
- Size 582B
- SHA256 699aae703998c04758bc8c90ed9e89baaf7cd3ce9b90f6b261cd18b2e9a0b32f
- MD5 3c30cd99eb7418fe737b717536672201
- SHA1 4748875ff45202607694eba37cdc9ff95fa9b5c5
- SHA512 a0722bb178482efd4a93fd6e9d74ad987039d12204290916c03424f36c8592fb9f1693963ead96fa90afe30b4ae26d8d8209e7aa7975a69f4b1d117c2e760fe9
- TLSH
  T1FBF0F0F9275C65AC254743E5CF1672B4270F69B93186CBF8487FABB091472D4E39B018
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral22 behavioral23
- Target
  data\flutter_assets\assets\auth-gitlab.svg
- Size 684B
- SHA256 976be154f07bed12377690ddfe734bf94ff01858f9ce28a0a526db7617130e5e
- MD5 b9b4d037f50930335a0e503cd9a35294
- SHA1 91a8e0d1e843f687444a4c90b8ab3720e71e39e1
- SHA512 f0d676d130f4a5b0b7e36b5d5dc95a3ba1adc69703ca4b4b3c51d4a92da0d1aa741dc8db72638ad1dc19118263d9bd8f5445d4129507ea6fcb44867f2eec6af2
- TLSH
  T171012BDC26BD3459990287F0CAEC21D705D7F0B7E10900D9F0481C18FD86B5FD6A7648
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral24 behavioral25
- Target
  data\flutter_assets\assets\auth-google.svg
- Size 846B
- SHA256 442e7678b4ba49a4261222bff05e52c9c892d4b37f5403c974f3ecf79007bc4b
- MD5 26dd5d10ffb0d02eb37a3858f2e533f3
- SHA1 9e5de4e23ba679f93eb64834cf0289e74c2f0417
- SHA512 e4e3ff4610df52ce85bb497c9faaf1df05ab7171e4bf21c9d6fa2fb33354c3c34f1e9f3cb8b5d41bc7c3325540bcccde233040cfc3915da5a70879cd3175b618
- TLSH
  T16A012FC04B78349DA58A1FD8C7AA32F15312B07D2A2487C010BC376C2F0559EAC11D18
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral26 behavioral27
- Target
  data\flutter_assets\assets\auth-okta.svg
- Size 1KB
- SHA256 483911dd70639a6c5c20d7c44b26593a7032fd0c61c824646e5692b019d51fdb
- MD5 2f417879cb6ff130f0b6294c6710fa72
- SHA1 15d162c2897d4200254a11cd5990a1dfd57b3eb8
- SHA512 6442cd248bae0e8dd6b5cc54cb2ce823a8ad7321003a249165494e78b45ba63ba6664a131152bf10ed5dbdaf087f4ee0c868571c25681caae8ac08634c8a0c9a
- TLSH
  T1EC316979D391E3B8DE55876CEB2264F4A44F91BCC1F1D32A82ACC5A036D28C8F25D4E5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral28 behavioral29
- Target
  data\flutter_assets\assets\call_end.svg
- Size 786B
- SHA256 a9b2e7de60c87f5289db4eafe78e997a70d76d7a4245d2b2cfa7ccb7ae3605a0
- MD5 82190401a712a19798a416252071b2ae
- SHA1 425e8fac91df851dd5121e84b81ffe97a10d1306
- SHA512 1dcda3cc518bba16a608f48fa92dd71ea562c365adfb91df6239d7fe54ff6b9b1879ae5602c8272d034ea4b639a2f0043547a360d8d7d7b82c00584881af331f
- TLSH
  T1F201F1A40A1E880D94A7A394CF72F8DDA32F54A4759A00F8E50E7C34B0031A0D453D24
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral30 behavioral31
- Target
  data\flutter_assets\assets\call_wait.svg
- Size 746B
- SHA256 b6bf409d50255048c0b8e73397190a222a6c26f32326ad654dbebb8794525fb4
- MD5 ca0cdeaa2a498f901db4973419f56e49
- SHA1 479032a98e1f1086a5ab287189baac103430ebd0
- SHA512 2d99fda0a8ad128f36e1b2566b743daf53995000c8a33609ca1007406537e840b3bf02303b765b92940805f6611382bd875eeec7662fa43a9503208f4e54376d
- TLSH
  T1710168F14C3D882CCA074A12FEA72541EB18B5B8304AC9BD9B2D7DF1A022370E483E04
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Modifies file permissions

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32