a1578e552a95a7a0decd6572781b48f58a7fa68c7ae19b0f9b9290b35b44dba9

Sharing

Copy URL Twitter E-mail

General

Target
loader_res.zip
Size 61.4MB
Sample260620-p7ch8se15k
SHA256 a1578e552a95a7a0decd6572781b48f58a7fa68c7ae19b0f9b9290b35b44dba9
MD5 1846fb5b71a1a3b8503cacfb98eb34ac
SHA1 ccbb7a548eba49dbb3ffe18b16052624ef03cfec
SHA512 8a1a1e9357f87c8999d050384db732c27e5ff5b7577546fd0aeb3dfdac7291d14dc25c12b79be85316d561a0198be9769e2706d2f47c861401d98739bdfa4bb3
SSDEEP 1572864:vp5OleNqUfnaJhkLiegvHcIU/LuY3MyMMIFL7S4yWj:BgleNnfaWRIFJB
TLSH
T14DE733A9CA506DDB34335034E6D07E27C32E90525EEB9DE50B1247C989CFAE8372BB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  loader.exe
- Size 111.6MB
- SHA256 8476214d7b4586c47d67e608a355e8bd5780578b365712cd98b6fc4a8ebfc7b8
- MD5 e3b4600028b0739561267d9f5203e0f5
- SHA1 f1a83a09352ae9bcd2ac1d6f273e4861c4d3b3b1
- SHA512 2a05eff6be7235d7d150d0f7491ac98169b7c1094d8ed97a9777f85b7d84b8bbd40f58905359e1deabc86653be3d2abf8879de7047f083384256060010fe5401
- SSDEEP 1572864:MAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:h3iXtqwb
- TLSH
  T114486C43B2A75098E4BBC97582D65323E9337C8A1F3069EF15845B312F73AE09B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  x64/Bypass.dll
- Size 8.1MB
- SHA256 dec01fbb6941fd9a4856f38682a6ed7d90d04e66731e9589a80001b99ea7a6c2
- MD5 113387f3925dfd0cbdd616d55d4b6967
- SHA1 b7da7a3dbfbc5be4ab41affa6c1c5bbb8c2f091a
- SHA512 6ad0288448d7f07f01296ac64d9ed9d248566c0fc875a3a0ecdbaadcd7e8ace0d923f0d2b2ed7ccf69c765a1ec77b58ba3df8a9ec34e91b644fb93c2ad6142a0
- SSDEEP 196608:lSl9ZqKWwVOuqaPg/Kei/v27WKb5+cXuDL+:Ul9ZqKWwVOuq2g/K27WKb5+bL+
- TLSH
  T141869D1776A600F8E57BC07CC6579A27EB71744A0330ABDB06E082662F67BE05A7F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  x64/ExtraBypass.dll
- Size 133KB
- SHA256 daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392
- MD5 f808357eb75ce997e02ed7c936f33b81
- SHA1 94eb0afd7193de15f94d5788a8b56e65933b2683
- SHA512 ee3b8a35183a29edf1f699bcb00463fae1d6ce0227616b90ef13979f18025ed26f4441055e872b625e87fcedfd35951467d104fab97856190a77c62d5178f280
- SSDEEP 3072:y/Mc90jGyW2CAqrC3Q8S+vEyBUB+5vnA8wvsl:yUO0jGE9qrwQ2NVpevsl
- TLSH
  T151D36C47B7B410BFE4778274C8D30A12D7B6B8251B609B9F07A046592F237E19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  x64/SQLite.Interop.dll
- Size 1.5MB
- SHA256 93b35c2c65f7eb739f8122ca09b58d0bf8a4653f772281c8c0be450146d32ba2
- MD5 5389512ffe243a7becec1d9fd58c84d0
- SHA1 580b65e88c4e0e4b91fbd13d50d28e858851ae23
- SHA512 ed42d5acb77db2736803c5d118cd0a1335e0396bbb848573d8295809621fc9bfb0b1faff7c085f8b4f5a08fad62e1330502baffba235c2431fbd655124738e91
- SSDEEP 24576:5CYA/V0MQ/AOv4FIljfL0lCNmjMO0qqjh3aF9dfOZph7/akDAz/PrZU+L0/mZfo9:ZA8IBFIljfL0lCNmjujRaF9dg7/YS+E/
- TLSH
  T140657C4BA2B501D8D6ABC17DCA175607FB7274051360ABEF57A08BA62F13FE2167E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  x64/sciter.dll
- Size 18.6MB
- SHA256 77e82cdf92f908a75efc0aa28a5b92ba36837ca309972343930f96c00dab8f00
- MD5 56aedce490069d72f6219d3ba0728168
- SHA1 a6399778ee997c73973be2f188fb3f05bb7be62e
- SHA512 ad648eebb456909edba00c9a795bf8575e3b30671302773831d0cba115d3f20dd55bc72b3d9cfa55d2e798c40d94d1c203aaa9b97387a751fcc967803b78fd9d
- SSDEEP 196608:zYyN5GzA15auSsLGaQz9G2n3VMBvkpYRNiNxK+:zYq5Gc1crsLGaQ82n3eBpRNiNxd
- TLSH
  T18B179D57B2A480A9C4AAC074CA57DE17E7B2BC590270C35F21F466EA9F377706E6E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  x64/wintun.dll
- Size 417KB
- SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
- MD5 e861eb5789c50997d9476a6172d1c269
- SHA1 647eb6588b149efe2477fd192c8cab74d018d8ef
- SHA512 d8b49a6834c1ea5d73fee6979c59def18900c86d598ea900ab741ce71eefdaaadb4862afefa14e6cc093007eae5d4325857633549f1ade555baa0344b18e6112
- SSDEEP 6144:uNsLgQtz9nDZL4tFDjiaOE1DfsnyDQhWmnPIt:iggQh9nD2tFviW4/Qt
- TLSH
  T1E2947D8273E81C96E9F3CB3889638901EB3779544770CADF1261826DDE6B7D09E34B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  x86/Bypass.dll
- Size 6.4MB
- SHA256 2a29d2d9378a44e6ce051f072bbc79aa0ec6cfc6d4594499c3f60dce007f1382
- MD5 12139240c449d58185295311b9ca1bd3
- SHA1 233a49c4e8080d114df0a8eff6c61027fb2999b5
- SHA512 b1622be018f89ba35db49625ae3c9570fb4840b35c326c519e1b08624f40c368247eec8fff12afb4c116aa940ad398690e57de66ce9ed5616e53b7639805043a
- SSDEEP 98304:ldjcdo1enJIVtecCJn+6z3WC4JySwChtBW6oG+wh1+5bUY7:Wije1Jn+6zGBJyQhUGHQF
- TLSH
  T1A466AE12B903C032E4DB01B1E1AEEBBE4A6C4630132594D797D05D7AEA719D33A35F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  x86/ExtraBypass.dll
- Size 97KB
- SHA256 f96f8b66f2fb99077a4eff2cf55c1500f334d71ba425c3989453ab5dae190c6e
- MD5 18c9f48b88bd2241a265919a4cd4a794
- SHA1 d1823f9e5fa97b4bd2196b791710e56c93e4d99f
- SHA512 54f391618df12bb996589a3bafc4e4431b9f99051818630918c406a14a6332e133070bcf804a7349c2b2a0dad3bb9138db11ab699e5ad23b03dcde85bc081b4f
- SSDEEP 1536:MMFBplMH3yTvs+w9sDPOgeFIMKMcbNYUGsWKlcd714KktdVmAz92deM8wvU:MMvfMiTE3IOgQcbc71PEVmAp2dP8wvU
- TLSH
  T1E8A37B11B690D075EDBE1D305868CA729B3EB820EEE0DD9B3759066E4F303D1DE2492B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  x86/SQLite.Interop.dll
- Size 1.2MB
- SHA256 1a6845e27761e5c26c1cfa128d2d2360d24e05d229008bc2f0b4215a03366dc9
- MD5 6112b48951eddb62e78ba86d239fb2a3
- SHA1 3219cc358a61073823294fb6cbea081a9ec2fc01
- SHA512 71022aa649c5751a2abb7b9b618747009c22c45518dafd7df307193e873308eccdf7303b7f8554a541c9f02006e488bfe3567ab61e6fde3806415b810ca6612e
- SSDEEP 24576:6KE4r0RaYdKYR7KtLqUmZRDiJC7Z2CQiQYZh5YAIQLsV5:phr0RZ5RGtA0KpcYZ8tEs/
- TLSH
  T165458C52FA8381A1E9E111F5A2FE2FB7097C1609432888E7D3A46CD49E600D3767F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  x86/sciter.dll
- Size 14.7MB
- SHA256 acebb40ecd916a04d77ebc437a42d7287fe9250d4f24e4fdebae4507861253aa
- MD5 e138cc0a64a67c61d119dd327a7ad0c8
- SHA1 4fff6bca17d1430fa15c53888d3e4f6176f8ef52
- SHA512 b46ec47bfa629e76fb80f374de9e5f3f3bf9bb98f5a96fa4df2f3894eee7a3ef816430683614c8a1e32d1b3377c3f7c0de2b18357c50a6dc3ff5ee96be987620
- SSDEEP 393216:hwKndpRismVdv7DIk9zQXB5DCQNONiNIkWL:GK5+TDb9zQztkT
- TLSH
  T12BF6AE23B681C07DC01F02B05E4DF76A83BDAE704BF182937A983ADDAFB05D16A55617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  x86/wintun.dll
- Size 538KB
- SHA256 d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931
- MD5 fa0391a861b949de22e0a59c6faeaed5
- SHA1 d451ef2224b27938eeaa97ad26f75b686d86082e
- SHA512 e44889d0f3044f90962181d7d8787076f70b6e1d7974150f16f83d33a97f1fc4bdd0c7a38eee7a1ea8e8dc4f66ed37dab004f2855dd361de8fdd4ae6e08fa048
- SSDEEP 6144:w89wYsjDrSwf2IHHVVsWhC2njQtIu1MlXwiMnnyDQhWmnU4Dm:jjsjDrSOFaWFnjQtIzlXwiW/U46
- TLSH
  T1F1C4AE43A7D84467E5F79A3445738A526B3EB9300B30CACF53528A698E637C0DE34B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11