59abc02a2dff24fa0cf7eceb532a5e6be2d7c7c43995fb8fb082553968fafa27

Sharing

Copy URL Twitter E-mail

General

Target
Camera_Tripod_Gobohead.zip
Size 35.3MB
Sample260620-nms5tafx9v
SHA256 59abc02a2dff24fa0cf7eceb532a5e6be2d7c7c43995fb8fb082553968fafa27
MD5 82f8186f888cdf2d52ef2e7f4d3670d4
SHA1 5abe9635ab4eb15a4435445c8359b2fe35412f49
SHA512 ee3a4c331ec01cde7d32d6ea3f998e7e077e6e41ff0f91341f6099972b2574631ec23ca71450ce4014e8fa4ede43fecfa454abc96f47e7b59a34604a5cff59e5
SSDEEP 786432:uYHaIFK6a87DGhtMcXJyca33qlhtItvZQ9FsZsRxv3wQ7716B7iCW9VQ:ZTJvOMy/aIhtItvZYF4sRxv3wkRaWQ
TLSH
T1E98733A895C62BF8DC9F45D21A4814C9BEA3C5C22294C7E57DB9A2D821ECB110D73FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  Camera_Tripod_Gobohead.zip
- Size 35.3MB
- SHA256 59abc02a2dff24fa0cf7eceb532a5e6be2d7c7c43995fb8fb082553968fafa27
- MD5 82f8186f888cdf2d52ef2e7f4d3670d4
- SHA1 5abe9635ab4eb15a4435445c8359b2fe35412f49
- SHA512 ee3a4c331ec01cde7d32d6ea3f998e7e077e6e41ff0f91341f6099972b2574631ec23ca71450ce4014e8fa4ede43fecfa454abc96f47e7b59a34604a5cff59e5
- SSDEEP 786432:uYHaIFK6a87DGhtMcXJyca33qlhtItvZQ9FsZsRxv3wQ7716B7iCW9VQ:ZTJvOMy/aIhtItvZYF4sRxv3wkRaWQ
- TLSH
  T1E98733A895C62BF8DC9F45D21A4814C9BEA3C5C22294C7E57DB9A2D821ECB110D73FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Camera_Tripod_Gobohead.fbx
- Size 3.1MB
- SHA256 58e623d3ac49268133e09cd46deb30a38d75d82793c9831eeba2f1548a7884b5
- MD5 f1414cf3e0162273f4b2a18ba7529972
- SHA1 f155b04dc3c4ed2b9333374f54fe2dd4fc73489c
- SHA512 92c3a7c04b75329dbc704ee781bca86994e02bb5772444a04ab4a393976fa5c6cbd59f97d871a098b04b1453695d36c3a376b439c14ae5bd63ac849a373b9393
- SSDEEP 49152:GdaWW2zJLDyfyVcQEQN59vJ6wK5G5K96S5XHZpOB+FhXvFZOtOZnFZ2OlSrb3555:GdaeP
- TLSH
  T1F1E5155A3C4BDCF0ECB65A72ADBE585E35C31CFA685B19B721388B19F0A4018DD0D4B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  textures/TripodGobohead_AO.png
- Size 9.4MB
- SHA256 1ba42fe617e9f513b33540981458c926e26a210733e324708119405425ca2700
- MD5 9f19d2891780c153f02bfabbab94ee4d
- SHA1 49232b9b9a9726a24e0cdecdc7e98ac03a9c97fc
- SHA512 2092df81544187fdc771aa9c5e69c4a574e5d60378fb249af62e2b7e08ce593b533ad621ab4ea9a9709cab1ab7d2d3fe5826183147c267036a81dd190a06679f
- SSDEEP 196608:3BwsX6L9KBR1F/SiMpRYzHDnIk7APE67zX0xoLUEBWaM8pSS67awxOh6X1aD2hBi:3BwE6ZA1xWRYzjIkKfX0xoLUk3jYSEaF
- TLSH
  T136A633E2DFD24FF3502FAA4411CA5CC61DC113676728BCD789B9D49CB248A2359BAF06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  textures/TripodGobohead_D.png
- Size 11.3MB
- SHA256 8ad6d6e32a923dfe1ba4365e22ec132efceb2b38ea81a33b666549ecbb191ec2
- MD5 b68c58257b0c2810497f72b19750bc37
- SHA1 e24925b4c8106ee67f3200a65f2a2d352b57d08b
- SHA512 1cc34373f467ed8b313ea81ce685a4bc274200c7ef1f211a3bbb1a2daa3a777e63b7194bb629f6b6d80f8883ce3df8aae519e2fe9bfb811d5937b6e9590744c8
- SSDEEP 196608:e9Vk5m3Dbf9cAtfxchxbBwBWrIHGehbGFSetKo5dwUED+6WVuFk/60Hl4fovhmbx:e3k5mzbyEf0bBEWrINhbezXro+6iu/0K
- TLSH
  T1A8C6334AD5E103F5D65FA1A1885064945F7003806FFEA34A0479D1AC37FA7EA7BB8F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  textures/TripodGobohead_N.png
- Size 14.4MB
- SHA256 8a79070acf9b0429f8200dfab295ae47cc9e6d0e652031acb364314a84abbad2
- MD5 765af6b1386bcf85f15b13e528271cec
- SHA1 4d0567bc9ba76da735f5c08dd0b4fdeba314284a
- SHA512 c97dbe9d2fb4b1ca1314eaf18dc15fb7269c50d85aa78c62fd0f3249119b79bc28feeccbea3d8c5bf6273939d894ee0c07b203224232a08473d99b8733042f8c
- SSDEEP 393216:qYBYHAQ0SlHl2Ljhb1w7FsNEEc9GEODpJMaiD:TBYHALLVIqNE4E+pC
- TLSH
  T144E63368C1D423F9E8177CC34F9155AD8B5052065B0533926CF1FBAF1BAAB13A436FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10