88048354e2818052625f3548fd55126d4fe77f7886731bb5346c88f8bc42538e

Sharing

Copy URL Twitter E-mail

General

Target
Epics_GAG2_macro_v1.0.2.zip
Size 2.4MB
Sample260622-2q5jxagy6n
SHA256 88048354e2818052625f3548fd55126d4fe77f7886731bb5346c88f8bc42538e
MD5 9bfb02efb1dd541d11610ba5c82f2ad1
SHA1 2ac1d0fc732525dd21fadb0c2816cf0551c1a69d
SHA512 8066a8b193b6a2990872624dbb46c03769d8fb466cdde6c17ad0e98765170e85373fc7637acdbf209775d1810ef52e01404c66b54fc1d222506d1b76aea51ef9
SSDEEP 49152:YjvPcMP0/cQ/94Lvqc4ZW17TZGd54weAOh7Ql8TxaFUubdLP5LdHKQtzq6O:YL+c5Lvqcb13uCxWzxz5Ldc6O
TLSH
T1EEC5333BCC61B8C5F95FFB7A459D880C728B9405D2D88AC077088718745ECA84FB6EE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Start.bat
- Size 1KB
- SHA256 0d4f0e5f0a6a47eae64158eb68ee14ee9f32350a6813c4e7c3c4519b51e5370d
- MD5 b9bf109693eb1bb6e76a8b1b3c7c4418
- SHA1 18ec1eba01253a4c8bb2386fcdb797c98cd2cb13
- SHA512 cd4f493e6d2e467261553980a95656f0823b9f2223fcc600f57fc22b3c8e51875a3e64b06c809d5a734c86c28f8fc0da1d44c4a98d92513fd840431d1f7750f8
- TLSH
  T17B211125BE0AC9A057E801E34E306493AA4FD05AA3B4D84B3CED94E4244F18D0DADFAC
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  images/Other/patreonLogo.svg
- Size 478B
- SHA256 2a40dc76fb628b5f163a4d4e06dd49e448f9c560c1e17630fac27e4a11bc17df
- MD5 e1e0bd0f9e057a437beb663e5183355c
- SHA1 0e33d5e9dacf072be217e03160299d179a8caf98
- SHA512 10b7ea5d9829e4d37d128a5d4aa076e8925fcefd96c033ea190baabeaafc927f8d71659ad116954c8eed36b4d8095cbe2f27328cae923da1057e62ac0401d55f
- TLSH
  T1DCF09E9CD098C02C8E65538A1F1CF6D8BD465088B2A206BCE1A53F065387A82985D3CC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  lib/32bit/WebView2Loader.dll
- Size 113KB
- SHA256 7f362fd98cc243ad620f2d0a4a6c223df80f960c4e19a2d9972f4af7938565cf
- MD5 23e935db8eacb60046ef670b961d5ab6
- SHA1 cd5a615b2705c5164e3b397c08a5fa3ced62402a
- SHA512 4f10ddc867b1cc9283498d72f4d8e2e45bbf7ebb2ea9a351584ea8773d47a80d9a62c694844af129485ca0da74386f4fb99764a364b93ecfe5780ae90fa42f35
- SSDEEP 3072:heCt9WJtX8ri9f2+DP6zmDgqeNZPTWpEtJhAlCfKf4fmi2:hT9WJtswdSzXqEtJ6Ya2m9
- TLSH
  T146B35A5175D08071E5BE1A3804B4DB759F3F7961DFA09EEB27840AA98E713C0CE35E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  lib/64bit/WebView2Loader.dll
- Size 162KB
- SHA256 271b57e3ec03c436a15d80cafeb9fd1618a43793233d8b05c9446f8de0a51be4
- MD5 c732e408181c4d36a170323e8481c6ae
- SHA1 ded12bec0428cc3d5cacccb6a7828495326fdb3b
- SHA512 1608cfb5d61014853307aabccdeee5023ed27582257394ca224bf985a30a7ca06d6a209610b5af48693bebaad202c9ca21ff7538ce66f61e3f240caac98e858b
- SSDEEP 3072:ZPQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/TbmEtJfy2a3NJn:tMMTlTRTzWiThTNTFSzjiBM2h9P5oZ9D
- TLSH
  T150F35B5772E4407BE16A8274C9A34A11E777B4510B60ABEF03A4477A1F237D4EE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  lib/ComVar.ahk
- Size 2KB
- SHA256 105e24cdc6a0a6352a07c48671454ce8e6c77208f4bd805e260f299fe7d441fc
- MD5 b15f22165d1108e93f7088fb8ba17663
- SHA1 57c5c43531ab3ffc217deecac5a8dd14266e56e2
- SHA512 6f9d8930a539fc5e3e04410ba5dda31580ecc3e560867b0f3235b795ba2a90401693dec1025920e46d35bcd53efaa33231ec952a15b170521821abc8eb3864c5
- TLSH
  T1C651DA46F7A9CBD606B123C0C1B46485DE5E90BD37661795A45CFCC49079024C4BBBF0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  lib/WebView2.ahk
- Size 123KB
- SHA256 f7dc6211057ae4ae9fab038b3e457dadf2a0aae5bc4f3e9918f5e95c75ea6014
- MD5 964881d4a342bb440c5a7c5ffcb637f3
- SHA1 73168237733a21b807ecc757bcee26331a18fb0b
- SHA512 cd7f9942156e8158e41c8f3e66e1366af8fd5bf5686ba68d8b1d41f8311815a78d076a6809b8a7aadf365b581a2204216cb71df78c827c525af4e0cb9f622174
- SSDEEP 3072:soNHQ/TQdaGlPiPZNOiayUEtDy/R4EF2cj+m4RUmAsSKLWCch93VHZqUhXtZzrwK:soNHQ/88aqRIiayZtD8K8RS3utsSKCCk
- TLSH
  T16BC38646F70F521182EB5362DB782922CFEF901225BFC5F6F040BC9425A6C3A555BEE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  scripts/AutoHotkey32.exe
- Size 992KB
- SHA256 a93dc9336080d8b880df9d38c44db1835e4f16cf90a333442633afd7ba9a1a23
- MD5 03c7811d366ca3118b606b122a417e75
- SHA1 0caa32864e0111dc7dd599aabdb2db80b158ca20
- SHA512 c0dccf861cfa9364adb950cf7fd14c2d8209c83bea9975f41eeb78e639fc8ba2c985056fd41dd0d48480bbd8283b5641f7cf7853a1731d94adc7130dfe9e5ca7
- SSDEEP 24576:15YOkoCg0ObuDYMj0Hto+SUH1WdOjNxMuem:4oDuS1WdOTMu
- TLSH
  T1E5258D53B7D3C1B2DFD205F2D5F96B365939B8380B2988DBB2D0583ED9A05C01A3A716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  scripts/AutoHotkey64.exe
- Size 1.3MB
- SHA256 a2aa56163e176ea6a3e1943016ac373d18e796317f502cb17b53f90640816ec9
- MD5 966b60af341a4eed1501afcaeca029af
- SHA1 7883dcf3f0b0cda5009cada09e33bad9226b0cb2
- SHA512 016817f807a8dcc9381434c2fdf9ac8b0e0a737260319184b973ee00f3e15d2a882e3db37f0582271608c82beb3d08bcdb2c00d1796d2f1f3ae194d2013e8e97
- SSDEEP 24576:T1c30qS5RR4/IUiEcvSZQF+mYyNoYVHCoA0kIAVQQ2xjX27:T9D4/NiEcvSi8p1P0RAV2lX
- TLSH
  T1F4559F0773F6C1E5DABBC1F6C9114622EA71B85007389BDB2194852EEFA3BD05E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  scripts/AutoMail/Gui/index.html
- Size 3KB
- SHA256 25567b1d2da8fcc41e6527d6c3707e96b3515c6789e51fad926acafb09b5c9b1
- MD5 6a5226080841645676ff866097464002
- SHA1 267d6789910799a738f4ca374a85c2e0d0cd2d11
- SHA512 5da50a9c611c9022014f4b3400af5a4ceb435fb8688bd435200af1216409169c80330d25547e6b27a4523182014b460ca081ccb76332ed5ae06dc4f7e845da72
- TLSH
  T11071A83480EA656341B381D45962AB56FED29207CB8B9B1836ED27C39FFBD85DC63004
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  scripts/AutoMail/Gui/script.js
- Size 5KB
- SHA256 a240581b2f6d36650b21bd118219c07322f3f690607d802153958f624824b16a
- MD5 4daa44ec0fefb0b7ef0c6db68b314114
- SHA1 ae1e9a7b35e94e7a219ecbeef3c55dbca8fbe333
- SHA512 81d77463fc32e27020e634f80d3208b7753c64e2553a79f3665c11004c2fde3c6440f6ec810d0be98c86e8940acf5839c2998e85d461a45416b09de822db8463
- SSDEEP 96:+X0hLmQ9qhEeEzfilRoQx74FSrQsZbIXeHrxsY3rAlFKnqcOha:+omQYhyzZQxvretY3rAlFKqcYa
- TLSH
  T1A1B1214F7523023747B363BA869B4F88FB255067D00195543EAC8B841FB0CD0AAB2EED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  scripts/Gui/index.html
- Size 11KB
- SHA256 62b0a7e2baabca1801e1e4078d80469ee3a864c19675daddc71f31d7cc1a457f
- MD5 4c7638b0e00cb15cf91d7449078741f8
- SHA1 2d26f3ee90f9d854028cc4af53e43258e74823ea
- SHA512 bd7f3217b2a9d5585c224a392bea8fee592d5d88eb91f32a8c80d37963a385ec0e0f06e03630ec8094567b03db47e1c9a7e25f94873aa53fb4431a676c1a5993
- SSDEEP 96:bimzd3a+SCu/1/1/bKTKBK+GOdUYK+GcVrV2VE2oMY0voWTUBkrpzcapJK0JuP/t:nz4+KBBECVdmjpYGcyk
- TLSH
  T10E32FDB481CA692E817380818A72AB96FF998243DB4F520836ED27E39FFBD44CC17114
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral19 behavioral20
- Target
  scripts/Gui/script.js
- Size 8KB
- SHA256 ccdccd98673d4e0d25b4a2d7415a6b23e3b4e7e3813c421dcbd94c724559cd2c
- MD5 905942e3d80f383dcdb2d962125659e0
- SHA1 c7e238cb2e4957c9a728b3240a223a9d9b29bba1
- SHA512 6fb5c706c090fa78afab69c30ec37b505d11a180b95358a3e14fbc1287e691825decf0913a12510515d5e85c260b724fabc3100e79fb94df348edf1126f7af3a
- SSDEEP 192:+C1v0yGok4zl7QYM9FVNu3qGfyzZQxvrHxn3tY3rAlFKqcYa:n1v0yGpAGFVNu7Vr7lExYa
- TLSH
  T1AE02315F31270677467323BA87A74B8CFB255027A00199853EADCA841FB4CA1A5B3EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  scripts/update.bat
- Size 2KB
- SHA256 e405603153b61e7667e738235bc3464d13e64081b425eab6eccfdadf40712681
- MD5 de3e0991356229d41e90b9db7f3299f5
- SHA1 724852d3b37156c389b9180a2215365c96c21b94
- SHA512 618a0bad7f878698adb77ecb576c451aeb7c58055113b1129cb62a8fef4c505f1ee2852b96529c2704050c222f603254d44900b085aae20ea265e760ff7a4eae
- TLSH
  T1E24145973A62D4FA01B187BBD4785D5DEB0EC30B53D1D92D3DA9D0DC1B256D112A58C0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24