1a43df3e4efb8faa7425c9c973197ddb8ef8556c798c9c07b7baee528314475f

General

Target
xjtlu-ai-email-1.2.zip
Size 525KB
Sample260622-ry24msds6p
SHA256 1a43df3e4efb8faa7425c9c973197ddb8ef8556c798c9c07b7baee528314475f
MD5 15041ff12f803f15858bb369f1079d6a
SHA1 c8bf64d35cdcb91ae3be9ba0c899a4b5aaf58ec7
SHA512 82da5f94b86d6a102e1ca63894fb57f6b3ac1810851e893dc767f81221e807974748d8ad20d59e5f9c069b7601d4c7f7967220a91922ec3f41f3598bcd075838
SSDEEP 12288:3rLZ+vPYN9Vr64fQ/IPI2si0NdqZr04rxkF56zm5vW:bLZ+vwN9Z6qQQAHi08gUmNW
TLSH
T188B423F5AC68621A176F9D13E762EBD03B7DC3AC265313C42527A2CC804B96B116E3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Launcher.cmd
- Size 28B
- SHA256 6f44e6c57ec997c1a6679121d21cdabfffd745d40225e41904920a7b2830eb1c
- MD5 ca2d3536105b433ebee8007e44fe33de
- SHA1 c990030ed44c59dd0a42b76fb2d7c2441c5b4925
- SHA512 f6aaeab16525029b0f1719fa9ac96562d4a7e2b84dd8f15ffc177011979d113f9a05b7bc93dfbac5f2a5d91fe4ec8d07469ee6d0bb59b3d8a9f5521d998e366b
- MD5 SHA1 SHA512
Score

7^/10

discovery execution persistence
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  lua51.exe
- Size 711KB
- SHA256 903ddc01ec499a5d2485f9daa18d01489534d8c561594c238c5dab0e120034d4
- MD5 1e7eadb55453939b26f79bdf4bf0edcf
- SHA1 2f935a0545abf89e5cef4fbb5efae8a145e02731
- SHA512 e41ac2af9f6d704f6efcaff040285165697440ebc1f57efabc55a8988e7af24cac1f91cbafbfdc683f987b332b0a388d74637c19ea1c176782397b1ffffc1abe
- SSDEEP 12288:Us2PKmvvaStJ7SSNYPffdsBJAcYkjWhkupHZYsKZt6YBEfNt:UOOasJ7SSNYXfdsBJAcrjmH+sKSv
- TLSH
  T1EAF4CF91B6D2C1F3D49211B144B9AB7B0E3D6D2007219CE793C43EB68E346D0AB7766E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  rest.txt
- Size 292KB
- SHA256 58448cb79f50cf71408e7eabfe7e0718e77a09910fd59963f83840b67faa245f
- MD5 8407bff2956c4a2f94f681e546eca74c
- SHA1 84d3420356fff628b0464fa790909b421d57309c
- SHA512 57fa4a195e69b920149bfa53410e7424508e9d49bde7ef75a41910819f77caf53efebaa8043308b273f3f88187d288c26df2731328bbf750e14a271649ecfbf2
- SSDEEP 6144:R/t0bQoY1vDhXoEnFiBNnZnTsAERklHWA4t:sbBgxnwBNnZTsK4t
- TLSH
  T1C05408E0B15828D1CAEB4A90EC638DAE65772AF1474A268F0F1EF4F077585D1C6CDD0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6