7ed50074e41b865db205fe34cf8a244713b3ec352c75eae60b5e96485b2d067f

Sharing

Copy URL Twitter E-mail

General

Target
kshurta-reload-2.6.zip
Size 482KB
Sample260622-ryxtxsds51
SHA256 7ed50074e41b865db205fe34cf8a244713b3ec352c75eae60b5e96485b2d067f
MD5 f8ab8bf187c5654890ff072b482d5b73
SHA1 d1cacd3713ed30b800d4553b5ba7263787356344
SHA512 90594e73b7f22d883e4a4542e8bc2661542f72df0a72f37c8c0cf1658aba1a3266dedbb5d8aa297ab46141b9ebd072e67c0b473414fbdff1ea5d28bfdd2c047c
SSDEEP 12288:Qkmht7DrvdyikCCH1oHF9nJ/qjuyHgoJrrzTPwkq:QkmHzMZH1ELnKHgoJnnW
TLSH
T196B423F193429E0B23A4DAB457A3DB3375CE7292769D9301CA06CA9F4C7072886DC16F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  StartApp.bat
- Size 22B
- SHA256 1546f3bbd5bd8d2b09351ceca40ee166fa023f250d255ca5d7496b556ad44d7c
- MD5 9ce7a03d1eda0aac973834f9684e169e
- SHA1 1097b0a4b67a5656c7b9cf897533d568dfa0f5f5
- SHA512 64b115d1e12138e6be86796ba063a748de7d4cd181d445f31e4431c24b8858efb7433c1cddad929f8e4c52707fafa3aaa68d055007ec2bb328d5145c73ae67df
- MD5 SHA1 SHA512
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  asm.txt
- Size 302KB
- SHA256 3399c30308d8adfd2bb829adf28339e6290db819531a1e418a9410993e4f8618
- MD5 ebd5b4e5f1efa41921d1d815c9562eca
- SHA1 cab212094579722a2f14c2e83944e13945c4983f
- SHA512 fa92ee0ff6cedcc4cbf9ae2aab3446f40488a6d7922783c08cd5866ece05b219afe7703618ca418b0c2486409380a916bfed79f5540927cdb8fbcb27abcc3fb2
- SSDEEP 3072:Qnwy3Ep5BejJUhKskBVpW+Qq7jDlEsZ2UdFxQ8dIUsp+BmJ9qvdiNLCrSy0gApFG:MF3Egt6SDWR6j6m2wxq78kFYdD8G
- TLSH
  T15564F6D013881AE3DAAB89D5DC7289A61FB729F1874E268A0F0CF4F036D81C1D6DED55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lua51.dll
- Size 381KB
- SHA256 3597925a47270ac5346dae3327df5946372aac8a0a7bd1eae33fcf277356997d
- MD5 e3fe146f40de21769e52d1d0a715bffe
- SHA1 f8300dd905020f6893fcba60f88ebe095ed5952a
- SHA512 5682abfd5658b458c8bbb5390e68ee0a8fb2196652bba20e64b2844eb9a0f9d6bd44fb5bc8b691a93bb32a57bdc1d555ba5583792b7c62343b7318b05be45f1f
- SSDEEP 6144:p/aQQeHuezLr8tmq6IV9y8kNY1AS0cfDFC/gGIFZ4O9f/eewsUZVFDPVpr4opQzb:RaKamDIVwybsIXUZVH9vUSj/TB03
- TLSH
  T10C848D0AE770017AD9678174CA279E0FCBF6BC4913209A4F47A57E976F37B21190B329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  luau.exe
- Size 282KB
- SHA256 6a713cdf2091477786da85e9553924b768c4754c134e24edc83045f3ea26508f
- MD5 9aa4ad6eee2a6d8f74532fdaf6cd66c7
- SHA1 e491fc91aaaf06ce548818992ce169b72f1f9b42
- SHA512 0e3eb052402857031e5690322ff47da1f60aeb3df0cbef5148f9406c679a5c22de56e67e1818ff3a2b88da22fbe627690c0baf6eb0c93e0f9006e477da2e7d7e
- SSDEEP 3072:GBtvGBhKWwaMfiBy/bgh+SLPs4TUfamFgtIqvtCui8wyK+tnfOt+Xfe0N:47aaJERPs4TcaUgxcuiXc9j
- TLSH
  T186549D54B3A014F6DDBB823D8D168987EBF2B8060764E74F03A046A77F177605E2E726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8