0057a933db8b0254de48c79eb85160308247a5e802338c737193411261bc4f1b

General

Target
agent-directory-skills-v1.9.zip
Size 482KB
Sample260622-ryw8dsds4z
SHA256 0057a933db8b0254de48c79eb85160308247a5e802338c737193411261bc4f1b
MD5 d4355289337d55a88d2850a26a119c0b
SHA1 1962689be634417cbda0a124ba9a88bc31a4464b
SHA512 7fd06cd3cad1787eb27e115f5d8eb595991827fe5a7215bda5e29da5b508ea736fd0532cfc71d7484ae3d0323d85e5e509340a08ce1b1d87cb945f7bb90c539e
SSDEEP 12288:8kmht7DrvdyiECCH1oHF9nJ/qjuyHgoJrrzTPwka:8kmHzMFH1ELnKHgoJnnu
TLSH
T132B423F193429E0B23A4DAB457A3DB3375CE7292769D9311CA06CA9F4C7072886DC16F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Targets

- Target
  StartApp.bat
- Size 22B
- SHA256 1546f3bbd5bd8d2b09351ceca40ee166fa023f250d255ca5d7496b556ad44d7c
- MD5 9ce7a03d1eda0aac973834f9684e169e
- SHA1 1097b0a4b67a5656c7b9cf897533d568dfa0f5f5
- SHA512 64b115d1e12138e6be86796ba063a748de7d4cd181d445f31e4431c24b8858efb7433c1cddad929f8e4c52707fafa3aaa68d055007ec2bb328d5145c73ae67df
- MD5 SHA1 SHA512
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  asm.txt
- Size 302KB
- SHA256 3399c30308d8adfd2bb829adf28339e6290db819531a1e418a9410993e4f8618
- MD5 ebd5b4e5f1efa41921d1d815c9562eca
- SHA1 cab212094579722a2f14c2e83944e13945c4983f
- SHA512 fa92ee0ff6cedcc4cbf9ae2aab3446f40488a6d7922783c08cd5866ece05b219afe7703618ca418b0c2486409380a916bfed79f5540927cdb8fbcb27abcc3fb2
- SSDEEP 3072:Qnwy3Ep5BejJUhKskBVpW+Qq7jDlEsZ2UdFxQ8dIUsp+BmJ9qvdiNLCrSy0gApFG:MF3Egt6SDWR6j6m2wxq78kFYdD8G
- TLSH
  T15564F6D013881AE3DAAB89D5DC7289A61FB729F1874E268A0F0CF4F036D81C1D6DED55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lua51.dll
- Size 381KB
- SHA256 3597925a47270ac5346dae3327df5946372aac8a0a7bd1eae33fcf277356997d
- MD5 e3fe146f40de21769e52d1d0a715bffe
- SHA1 f8300dd905020f6893fcba60f88ebe095ed5952a
- SHA512 5682abfd5658b458c8bbb5390e68ee0a8fb2196652bba20e64b2844eb9a0f9d6bd44fb5bc8b691a93bb32a57bdc1d555ba5583792b7c62343b7318b05be45f1f
- SSDEEP 6144:p/aQQeHuezLr8tmq6IV9y8kNY1AS0cfDFC/gGIFZ4O9f/eewsUZVFDPVpr4opQzb:RaKamDIVwybsIXUZVH9vUSj/TB03
- TLSH
  T10C848D0AE770017AD9678174CA279E0FCBF6BC4913209A4F47A57E976F37B21190B329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  luau.exe
- Size 282KB
- SHA256 6a713cdf2091477786da85e9553924b768c4754c134e24edc83045f3ea26508f
- MD5 9aa4ad6eee2a6d8f74532fdaf6cd66c7
- SHA1 e491fc91aaaf06ce548818992ce169b72f1f9b42
- SHA512 0e3eb052402857031e5690322ff47da1f60aeb3df0cbef5148f9406c679a5c22de56e67e1818ff3a2b88da22fbe627690c0baf6eb0c93e0f9006e477da2e7d7e
- SSDEEP 3072:GBtvGBhKWwaMfiBy/bgh+SLPs4TUfamFgtIqvtCui8wyK+tnfOt+Xfe0N:47aaJERPs4TcaUgxcuiXc9j
- TLSH
  T186549D54B3A014F6DDBB823D8D168987EBF2B8060764E74F03A046A77F177605E2E726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8