f6df5331cfc3333eb536fedd106fb8d94447c0495282277242352f6d0c30f6fe

Sharing

Copy URL Twitter E-mail

General

Target
Epics_GAG2_macro_v1.0.1 (1).zip
Size 2.2MB
Sample260621-qq5dcset7w
SHA256 f6df5331cfc3333eb536fedd106fb8d94447c0495282277242352f6d0c30f6fe
MD5 598ee620dc7a377d047485f0ea04c416
SHA1 fec3a7f3421f7b19e2ed0674ef822e11a468253e
SHA512 4b9f6ab159743cdea74a72041c6f1a6132c8b5636fba3f143156c3990c7a387a85504c73e2ce5cec265fed388232d5d29e066f7e0e2434b91cc296ef37d5e0d9
SSDEEP 49152:fV/RQVBcQPLcqe4toabTCGqtRLzA9hEQlp6aFUubALP5LdHKQtzq7W:fPycYLcqeNaXESyW9kz5Ldc7W
TLSH
T119B53327CD62B4C1F95EFB7A458EC80CA2CAD405D6D8868477088708755FCB84FB6EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Start.bat
- Size 1KB
- SHA256 0d4f0e5f0a6a47eae64158eb68ee14ee9f32350a6813c4e7c3c4519b51e5370d
- MD5 b9bf109693eb1bb6e76a8b1b3c7c4418
- SHA1 18ec1eba01253a4c8bb2386fcdb797c98cd2cb13
- SHA512 cd4f493e6d2e467261553980a95656f0823b9f2223fcc600f57fc22b3c8e51875a3e64b06c809d5a734c86c28f8fc0da1d44c4a98d92513fd840431d1f7750f8
- TLSH
  T17B211125BE0AC9A057E801E34E306493AA4FD05AA3B4D84B3CED94E4244F18D0DADFAC
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  images/Other/patreonLogo.svg
- Size 478B
- SHA256 2a40dc76fb628b5f163a4d4e06dd49e448f9c560c1e17630fac27e4a11bc17df
- MD5 e1e0bd0f9e057a437beb663e5183355c
- SHA1 0e33d5e9dacf072be217e03160299d179a8caf98
- SHA512 10b7ea5d9829e4d37d128a5d4aa076e8925fcefd96c033ea190baabeaafc927f8d71659ad116954c8eed36b4d8095cbe2f27328cae923da1057e62ac0401d55f
- TLSH
  T1DCF09E9CD098C02C8E65538A1F1CF6D8BD465088B2A206BCE1A53F065387A82985D3CC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  lib/32bit/WebView2Loader.dll
- Size 113KB
- SHA256 7f362fd98cc243ad620f2d0a4a6c223df80f960c4e19a2d9972f4af7938565cf
- MD5 23e935db8eacb60046ef670b961d5ab6
- SHA1 cd5a615b2705c5164e3b397c08a5fa3ced62402a
- SHA512 4f10ddc867b1cc9283498d72f4d8e2e45bbf7ebb2ea9a351584ea8773d47a80d9a62c694844af129485ca0da74386f4fb99764a364b93ecfe5780ae90fa42f35
- SSDEEP 3072:heCt9WJtX8ri9f2+DP6zmDgqeNZPTWpEtJhAlCfKf4fmi2:hT9WJtswdSzXqEtJ6Ya2m9
- TLSH
  T146B35A5175D08071E5BE1A3804B4DB759F3F7961DFA09EEB27840AA98E713C0CE35E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  lib/64bit/WebView2Loader.dll
- Size 162KB
- SHA256 271b57e3ec03c436a15d80cafeb9fd1618a43793233d8b05c9446f8de0a51be4
- MD5 c732e408181c4d36a170323e8481c6ae
- SHA1 ded12bec0428cc3d5cacccb6a7828495326fdb3b
- SHA512 1608cfb5d61014853307aabccdeee5023ed27582257394ca224bf985a30a7ca06d6a209610b5af48693bebaad202c9ca21ff7538ce66f61e3f240caac98e858b
- SSDEEP 3072:ZPQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/TbmEtJfy2a3NJn:tMMTlTRTzWiThTNTFSzjiBM2h9P5oZ9D
- TLSH
  T150F35B5772E4407BE16A8274C9A34A11E777B4510B60ABEF03A4477A1F237D4EE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  lib/ComVar.ahk
- Size 2KB
- SHA256 105e24cdc6a0a6352a07c48671454ce8e6c77208f4bd805e260f299fe7d441fc
- MD5 b15f22165d1108e93f7088fb8ba17663
- SHA1 57c5c43531ab3ffc217deecac5a8dd14266e56e2
- SHA512 6f9d8930a539fc5e3e04410ba5dda31580ecc3e560867b0f3235b795ba2a90401693dec1025920e46d35bcd53efaa33231ec952a15b170521821abc8eb3864c5
- TLSH
  T1C651DA46F7A9CBD606B123C0C1B46485DE5E90BD37661795A45CFCC49079024C4BBBF0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  lib/WebView2.ahk
- Size 123KB
- SHA256 f7dc6211057ae4ae9fab038b3e457dadf2a0aae5bc4f3e9918f5e95c75ea6014
- MD5 964881d4a342bb440c5a7c5ffcb637f3
- SHA1 73168237733a21b807ecc757bcee26331a18fb0b
- SHA512 cd7f9942156e8158e41c8f3e66e1366af8fd5bf5686ba68d8b1d41f8311815a78d076a6809b8a7aadf365b581a2204216cb71df78c827c525af4e0cb9f622174
- SSDEEP 3072:soNHQ/TQdaGlPiPZNOiayUEtDy/R4EF2cj+m4RUmAsSKLWCch93VHZqUhXtZzrwK:soNHQ/88aqRIiayZtD8K8RS3utsSKCCk
- TLSH
  T16BC38646F70F521182EB5362DB782922CFEF901225BFC5F6F040BC9425A6C3A555BEE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  scripts/AutoHotkey32.exe
- Size 992KB
- SHA256 a93dc9336080d8b880df9d38c44db1835e4f16cf90a333442633afd7ba9a1a23
- MD5 03c7811d366ca3118b606b122a417e75
- SHA1 0caa32864e0111dc7dd599aabdb2db80b158ca20
- SHA512 c0dccf861cfa9364adb950cf7fd14c2d8209c83bea9975f41eeb78e639fc8ba2c985056fd41dd0d48480bbd8283b5641f7cf7853a1731d94adc7130dfe9e5ca7
- SSDEEP 24576:15YOkoCg0ObuDYMj0Hto+SUH1WdOjNxMuem:4oDuS1WdOTMu
- TLSH
  T1E5258D53B7D3C1B2DFD205F2D5F96B365939B8380B2988DBB2D0583ED9A05C01A3A716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  scripts/AutoHotkey64.exe
- Size 1.3MB
- SHA256 a2aa56163e176ea6a3e1943016ac373d18e796317f502cb17b53f90640816ec9
- MD5 966b60af341a4eed1501afcaeca029af
- SHA1 7883dcf3f0b0cda5009cada09e33bad9226b0cb2
- SHA512 016817f807a8dcc9381434c2fdf9ac8b0e0a737260319184b973ee00f3e15d2a882e3db37f0582271608c82beb3d08bcdb2c00d1796d2f1f3ae194d2013e8e97
- SSDEEP 24576:T1c30qS5RR4/IUiEcvSZQF+mYyNoYVHCoA0kIAVQQ2xjX27:T9D4/NiEcvSi8p1P0RAV2lX
- TLSH
  T1F4559F0773F6C1E5DABBC1F6C9114622EA71B85007389BDB2194852EEFA3BD05E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  scripts/Gui/index.html
- Size 10KB
- SHA256 d383f9d1faa81e5440f56c6bed7409118afcf6c756d9147f6954d865ff957c44
- MD5 fa94a676a19aa31a720e0915435856e3
- SHA1 cd915d48da73eed187a945f0cf14d974740b5668
- SHA512 35dab6d2451ae3bca715c8e5c05fd3940662618a94eca605199d750e535624bc2f56be3f0574ad4ee9c1a144afc4ad71398dfb32512923d25f9875fb64e853a7
- SSDEEP 96:bimzd3a+SCu/1/1/bKTKBK+GOdUYK+GcVrV242oMY0voWdBkrpzcapJK0JuP/6m9:nz4+KBBECVBmwpYGcyk
- TLSH
  T1E232FDB485C9692E817380818E71ABA5FF998253EB4F520836ED27E39FFBD45CC17114
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral15 behavioral16
- Target
  scripts/Gui/script.js
- Size 8KB
- SHA256 2e4614a655af64001877305932d1352b1c0d861d4f6dfdf6c7b7e7ccd1244425
- MD5 d902d664fc61db9ac71813b699b16d2d
- SHA1 902c62ad552801e21d662479a273a507d76411a5
- SHA512 404a0654615381d1e3a8015b0006c310530c2a753cdf5c550e69acc61f302a9b698c2533b6fc18195e26505f43c46ea41b61204c717c4454950e6a5796222c6a
- SSDEEP 192:+C1v02Gok4zlXQYM9FVNW3qGfyKZQxvrHxn3tY3rAlFKqcYa:n1v02GpAeFVNW70r7lExYa
- TLSH
  T10202425F31370577427323BA87A74B8CFB255027A00199853EADCA841FB4CA1A5B3EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  scripts/update.bat
- Size 2KB
- SHA256 e405603153b61e7667e738235bc3464d13e64081b425eab6eccfdadf40712681
- MD5 de3e0991356229d41e90b9db7f3299f5
- SHA1 724852d3b37156c389b9180a2215365c96c21b94
- SHA512 618a0bad7f878698adb77ecb576c451aeb7c58055113b1129cb62a8fef4c505f1ee2852b96529c2704050c222f603254d44900b085aae20ea265e760ff7a4eae
- TLSH
  T1E24145973A62D4FA01B187BBD4785D5DEB0EC30B53D1D92D3DA9D0DC1B256D112A58C0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20