28f032d2c083e1facd674f2b2c455b2c24c51996d43a549bbeb0f5bd9dc97da7

General

Target
CR_Sense.zip
Size 15.7MB
Sample260620-cjpsfacy2l
SHA256 28f032d2c083e1facd674f2b2c455b2c24c51996d43a549bbeb0f5bd9dc97da7
MD5 1c635a0d676187fbdb90a9394af9cf61
SHA1 8b508dc48b7c17edf62a094176c823e44356f104
SHA512 3cc119061e267d29922c4ed1590760f8c6c3fb4c6a018a4168efffc4f48529feff7e742fde404f762799d057c65cf5c7d9c743055c4a0c2049fd42e416c6c44d
SSDEEP 393216:SoaZfhUlfKem6Zl36ofxnFfrB1kzOpcxBQMO:RathApm6Zlqo5nhXkzPxzO
TLSH
T1A7F6339AB6E158CD832CBD2F19EF480E932F3374B6564BA3C79E15986F1010ACBD6D11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  CR_Sense.zip
- Size 15.7MB
- SHA256 28f032d2c083e1facd674f2b2c455b2c24c51996d43a549bbeb0f5bd9dc97da7
- MD5 1c635a0d676187fbdb90a9394af9cf61
- SHA1 8b508dc48b7c17edf62a094176c823e44356f104
- SHA512 3cc119061e267d29922c4ed1590760f8c6c3fb4c6a018a4168efffc4f48529feff7e742fde404f762799d057c65cf5c7d9c743055c4a0c2049fd42e416c6c44d
- SSDEEP 393216:SoaZfhUlfKem6Zl36ofxnFfrB1kzOpcxBQMO:RathApm6Zlqo5nhXkzPxzO
- TLSH
  T1A7F6339AB6E158CD832CBD2F19EF480E932F3374B6564BA3C79E15986F1010ACBD6D11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  color.exe
- Size 13.8MB
- SHA256 d8809594785d9d33d0cb7399610f08dcc4bdfd379ad3a37991bc7f2c363fc4dc
- MD5 22bdfa48658b5839a920fa2c84cf64d6
- SHA1 81236a576717922e7f8ded0b71607fa622953319
- SHA512 6a55e90db9aa5c599430ded7e891e549b2f93f594f5a6c80b9fcf5ea1950be95222ea045e64d2cd542056d0325781af8786c44452a642736a5edeee6782b339c
- SSDEEP 196608:KeZsAulLV3fphUiuLIIHiLTKmn4bhFn50leFu1TnmHwXUZbD+DDvbq2YQ8F2lDrN:ytxRhUtLgemi3HWkeEQgcGM
- TLSH
  T16AE623EA50D431D4C4D78B34639F57CE61F1F5668C60A62937CB2C03EE31EAB9249A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  pmm.dll
- Size 3.5MB
- SHA256 e0777157b923a0fa946724ffa9517b102d5ee32600ea4e67496912418b685214
- MD5 ddb393f29ad6e48dcb342b65400c51c0
- SHA1 18841ae6b83f88ba60fd04cca05a725c8d0c5c0e
- SHA512 1e61ccf6b5b3c6f2f22cbf036a7d2fa4231d7569b29a141272c6aeba2c04da4c2a1e30c07da8367f843e73d81bb9b4cf7117c1a44876a5c1abb8e5292b98240d
- SSDEEP 49152:TNgL4Gt7CCttzkSiBS9Cqx/HbQbv+hs9Sn19BqIP02fYOUj354FKN6LnHeLQIYO6:yLpzttzkPS9hev/4nw3/lJ4FBzIR6
- TLSH
  T1EDF523FA22D26C74C0A7F7B1896B737CB52F3B4689634C1E7BD81E434E126196879B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  sensefucker.exe
- Size 27KB
- SHA256 265ab73f4a95a1b412cff8e66ece4a0eebd0c086482ec43d4c8e20c7e4864b4e
- MD5 0c94222f17e2abdc2b626a7ef61265eb
- SHA1 cd5bae48e62f26946f4c4a34c6ad80ea7d81e80b
- SHA512 3a702afc8221f2d45f1389f900f36bbb42668c2241930a8053a303d4dbff660bd0321bd815661cb731c4fc3ca555fb0aca9d3ca9a16ec683c3a6e7cdd65b7e6b
- SSDEEP 384:3459hY4Br3/L+h1Q5KYVG7nquNzsX88bx8/AS3N:343ys3/Ch4KYVG7ZGM86/V3N
- TLSH
  T1D9C20A1D989F06A4DEE67AB8443A2356F31AB52D0FF0586BF3DC40B869265DCB391D03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral4