c8e228f286964078b301748314840c9a235726e7ac5c16674f5a2169f2319bc1

Sharing

Copy URL Twitter E-mail

General

Target
app-toolkit-research-v2.1.zip
Size 456KB
Sample260622-rzbm3sdv2w
SHA256 c8e228f286964078b301748314840c9a235726e7ac5c16674f5a2169f2319bc1
MD5 5ecf6a21cc90f7234caedf99f5c00679
SHA1 d792f616e05a19257ea9dce6f679769d6bcc834a
SHA512 d012b29f45865162c425fa7cd6d4082c208529d526d9f831e249af052085fafdd30fc876e82faa16c5c8bba6087c5bb01d16700f3c9955895d57a172fff07905
SSDEEP 12288:nBM1eMQPiodzYfcEaN9B/Jm0LU0gM7aQn:ny1eMQaoSfclN9BhmSHN
TLSH
T1EAA4239CA4D00A329E9373545D1C2F124764D62B33F9DB6BD61F3AC0CEBAC501AB42AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Application.bat
- Size 27B
- SHA256 b3a9d5283f982f19979689af2f4416b3e0e57cbf469c71b6275b12fcba358b65
- MD5 6f2e3a9ec6914209bf85be0677aadf9e
- SHA1 eb34adba2c6119def77f408f4e1f7ec6c4cfb783
- SHA512 510cbdda7affb8ffeb9198efd0f0f9e6c5e0e306f699b9fd78979974bd6f9a78f3f627bfe70f2698695d6a791d018f46e2bce58715039500faf15a9577759edf
- MD5 SHA1 SHA512
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  compiler.exe
- Size 31KB
- SHA256 7ad4b911d05a12f91ab27ba3baa351a56653ca099dda7ad87ee2b94f8cd018c9
- MD5 c2a7f19ba96dc460d591d37d664fe6aa
- SHA1 2e930eb7072ac6f8906c5df11e041d88aaea1fcd
- SHA512 baf23c903b68e13786657cf1bcfc6db55493988eac28edc3caaee1011f65ff04eebef9e204853a3abf07d4a36ad7ef5bb8a3683863fac600b49590d7376624ad
- SSDEEP 384:ib7da2Z2gMMu7VGueXHa2RIC23208fKUS5CWhYJ8L:Wa2JLuZ/eXaIO3r8iuWhYyL
- TLSH
  T138E2C62DB68258DEC591D27CA0D60731F079BD56172766BE1308F23A7E21AA1CB3F427
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  gc.txt
- Size 301KB
- SHA256 4e0d3da33f13e6440ecbdf4f0b838a164c73ad375c4788c4c205d87f5d2c1875
- MD5 673570abcb54b368b9521bdff8f331d4
- SHA1 6b62b776acccf2316247b31e78804b7ee0999cd0
- SHA512 0cdbe788a081b8166eb81a2bc256199efe2306763bb33cca7eac0950535abb9bfd277b17290d0b11a5809bcd2b53295d1852998015f87c9d3cf581c6ee6e51fb
- SSDEEP 6144:jrUKJMJviWm9FZ6EdAF2mKISCtFIw4rPda5apLy:jRYviWmvZ6yAgmKat6w4rPWwLy
- TLSH
  T15464F8D4518408D5CAEB86D1EC229DAF11BB2BF58B4D568E8F1CF8B03A606F3C5DD906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  lua51.dll
- Size 587KB
- SHA256 04d3c82782927330d56827ff551697666dbab4b3abf5b86bde492efdd142bc58
- MD5 82e81158366a953c33d0720dfe34b95b
- SHA1 4b5eee1d2ba5bf3ca0389c0415626634c640a4bd
- SHA512 3c9f7360bafc48d573d24fe1612e23a97fe08944c9ad5f5d46818d5e74365d00d7e5aeee63391d4c0de7390b5fecaa695b698fd62ccc741dec181f0d24ee82af
- SSDEEP 12288:Psx+0xTI82jcKvyp9jvgEXXBKHKLx2h601BqStQIF3yB:OrmyXMKF2hXBtQIF3yB
- TLSH
  T173D4160BA6B362BCC267C134879B8BB1B931BC5402346DBF55A0E7311E71E91179FA39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8