Extracted

Extracted

• • Target
    498780a6-a6d6-49e0-a835-5ac234282139.zip
  • Size 26.4MB
  • SHA256 7484299cd2bf50ec1597ec82e5efb3e07e2d06aead5f74dcbe0e90ae411d9224
  • MD5 cc6778444eec0cf315f56c712ec364e2
  • SHA1 379c34fcdd0e496cb7b4f4411a9abeaa9644b04b
  • SHA512 74920d0fc75723f522aa9bd183b5bba299f880a3928a2670c8f03474a843c006ae42888bcf68baa6e6b22d411d54a6bd8189764007cbd23202ee04b2d7394500
  • SSDEEP 786432:mIBbMn7X1h/ll6yutpl/AnihjU3X2zbc3O0y:XBMf/llFwpl2CjSXyd
  • TLSH
    T1F45733BE92C3472BCE8657BBE4380B2BD9B9C284675491B24A7F047F594015CCF4AE2D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    ​PACK8/teenSnapchatdihhfrombe.mp4.lnk
  • Size 697B
  • SHA256 20eea6002b3b0a3716ec6687953ae54b50fc77e00241afddb540fbddf7ff3f65
  • MD5 76cb868859b8aadccbde3b360e9e9cee
  • SHA1 08e29f89ec5b68892a5984ead4813c567aec4b2c
  • SHA512 0d4aba0feb5c54ac769e152fbfafe5019ea95a096560d2d5400958a7daa13c202b168a519038155e6ddc916d200b301b87eab5b5fe6c9b044c23c1557e78ab3c
  • TLSH
    T10001284032EC1728C3B35B3B4C3956114A26BA45EA22DB2C57D0858CA868204AD29F3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitdonutloaderloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral3behavioral4
• • Target
    ​PACK8/teenpussyfeetandass.mp4.lnk
  • Size 699B
  • SHA256 e06cbda80536d564ed5ce571010f9130a20ab1155e788e0066c33d884a9927fe
  • MD5 17858f034b706a54fc48a9894c6fb4b6
  • SHA1 64bedc3fa6ff5c5ab789db331a12a6da451998b9
  • SHA512 c2ad329584366e4ddf187a1494fa078195409f9d51723470f0bc8117476b692b86d8c030b52c6aa6daee6ceec30f74e7b6a7839569f71a71663d97d453aee4b3
  • TLSH
    T10D01285021EC172CC3B35E3B087596114A22BA07EE32DF2C13D4858C9858204ED39F3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitdonutloaderloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral5behavioral6
• • Target
    ​PACK8/teenreversecowgirlboyf.mp4.lnk
  • Size 697B
  • SHA256 1c7386333c0eea8eedc4aa758f57c1b20cb1832cc3193cb8b26fe5e9865f7007
  • MD5 fd90e003a2bdad99454e8d35efc7a463
  • SHA1 65756fd3afca862b0aa3a6dd5f115710c63d745a
  • SHA512 9372af9f43bcc0b93c443cb9184569ad43ce2a507e189d3a2c37f6dd3a12b3b83eab906908bc441dac62a69ced988f7097bef59c63690be569b7c006acdce557
  • TLSH
    T16401284022EC1728D3B35A3B4C3956114A25BA45EF32DB7C57D4958CA869104AD2DF3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitdonutloaderloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral7behavioral8
• • Target
    ​PACK8/teenslutdroppanties.mp4.lnk
  • Size 691B
  • SHA256 f14d07f85c7ef6360e383d715612471ae9c1fabf0e0b7af69580ad9343b442c7
  • MD5 69120f4ce1f2fd8e791f94c8cf1b7432
  • SHA1 125f438fda3481a84748274f1d0ff9148427b5e7
  • SHA512 ea1583bcf02bbc4f4a08c0482457dd6e33aa6d5a9989feb5e735496a4c7372f65eb689876f27742effc13cfbc224c4590d825b321c036b59b4fa9bb149dd6e30
  • TLSH
    T12501284032AD0718D3B39A3B0C2556214A36B606EE32DF6C03D0858C9869144ED29F2A
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral9
• • Target
    ​PACK8/teenslutpussyspread.mp4.lnk
  • Size 699B
  • SHA256 4abe5d9e3867b9ac476d3af7a918b2b652605c844f418d2b5b3154f851852645
  • MD5 d1ff21e387c681000169a6dd0347986e
  • SHA1 d02e152341226e5027713bcd679ba5007404829b
  • SHA512 a1d00b2c50d8c010b1df81fb9fdd5df414bf01ec161f04ca6933262ff3cb36ce4a8a4f5009417eeb4c62bb457568deda9382b1880b1fd72c2adfba872167651d
  • TLSH
    T1D301284032EC172CD3B35E3B4C7556114A26BA07EE32DF6C13D489CC9858104ED39F2A
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executiondiscovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral11behavioral12
• • Target
    ㅤㅤ/desktop.ini
  • Size 140B
  • SHA256 18c589d8e572c2fdfbda471d42ce40337c4e9d40b079d3adec6f53154a784a4b
  • MD5 e1ab4cc7b74a2443bb13bc8540f21a60
  • SHA1 b82cb44939719f50e4beaa9d82fea063e8049b3f
  • SHA512 f7a5b4f90def046b3de867b2088aae596759f8ec68988e96b4a8135d2f5b03e04a81d4affdb4467ab9ef7a0e05a903debae06a97212de03485c60b475333c147
  • TLSH
    T148C09B0466F9222151325D737C78D002C771FC113C17C7DE464150CA14F4948E532B13
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    ㅤㅤ/teenSnapchatdihhfrombe.mp4
  • Size 4.6MB
  • SHA256 532d46090a544054b96fa307b739a58e29edfff17ea0618999e9f87c35ffba3d
  • MD5 c94f429f7e7e478cdefa8645780a9851
  • SHA1 bca97f88cdb180c6040851cfd367bf59ae77da18
  • SHA512 2ce7cb1cb922673b4f50f04f7ed0cfae97261814672123dbff2ba01f1f763b009fde85ce3f2265720fb72a25c79b6b45915f7cff8239d83764ec5196005c7dca
  • SSDEEP 98304:DDagnQizK1fAyvJ6SVRnIKZR7gHl83JtRDprspCKS0ZKEHTBIZAoH3mA:lK1fA2JIWR7rZftryVIZRH3mA
  • TLSH
    T16B26332E9397BC5FD5F812B822681A47BC3BC82D59984B4F93B6F410CF6534169B02F6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral15behavioral16
• • Target
    ㅤㅤ/teenpussyfeetandass.mp4
  • Size 8.1MB
  • SHA256 94a1ba68e1a9e3c9419488fc92275c2d332190e0b933f1068f8756b8e5290aae
  • MD5 c01e78481573ab0c058964509d141394
  • SHA1 134b2d6af7262963651793b0191b8d5c73a84317
  • SHA512 85275ca6f797761903bec129218de5ca735348acf31d2a96edab3384d718fddac775014a45424e1604578f138301b75f341e6677526ff00530fb18a81b11fdde
  • SSDEEP 196608:1+q/JukFVlQt0lfdmjd5gfjECUVJArkrz/1rKgS4ORGU:5RH/llVmZ5ecrztr5EGU
  • TLSH
    T19C863314BB9B494BD42D33B5B5D47B027949C9206A0B83F3D4BED0F51DEBA486988CEC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral17behavioral18
• • Target
    ㅤㅤ/teenreversecowgirlboyf.mp4
  • Size 9.2MB
  • SHA256 a59db7ae8f6fd66dbd82f64a63611dd868d6544263f83da259e900de226b70b6
  • MD5 7f3802b206bbcee163be509d220711cb
  • SHA1 f95471106f526cfd262882d6af31a37057a1b252
  • SHA512 0373862ff22bee3469ebb5a96224f81edaf81b9b84962d8c6a9fee17854697320cb2fd36558931b7cc0ed2678f3cf02cb8a827abce1e65d905c0fc1ae997d652
  • SSDEEP 196608:xubDsmqLxUizdLFIVfohHbAD/FmqFOjzdU/QAoVaVflYgPdFg39J/6ITYjo9:IsmqLxHLCVkbAD/yCoABVqidO9sU9
  • TLSH
    T1CCA63302EBF0F693D0543EB091E6D746BEE1DD450D63E463E278A65B49A63C22503FE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral19behavioral20
• • Target
    ㅤㅤ/teenslutdroppanties.mp4
  • Size 972KB
  • SHA256 32c28ae85522242e90d0bf44e918cb00a7e69cf8af9cd8e90cd78c87ebbed489
  • MD5 f1c08a3c04344bd3c7c5e4191bf8ba3c
  • SHA1 be6d6bc9c4c2d76d35b74fce6b10dc0c3160a9ea
  • SHA512 1ce9ab9b8b949b326736d3bc606bacb09e30c9765625307b526380bc9d9c2f1272a143ea261e3294d881cfdcf3203cc008be5c2cfea38d81bca11f778bd80504
  • SSDEEP 12288:0iEPJvqGGF4rhB1p3H59CovV6jNglzkFZDn9QrMob939PxH7Fb4Gv+pfFFyvblX0:0JwpShBLJUNNgJ2ZD9nK3dRv+fkhbc
  • TLSH
    T1C02523A3D3D5E267F831FAF41EDAD3EAE855D0383342FA517061ABD6ED2A8011107AD0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral21behavioral22
• • Target
    ㅤㅤ/teenslutpussyspread.mp4
  • Size 4.0MB
  • SHA256 5629851beac1baf294eed89738ab85564d1e3e57d608cecaff06ed88485e6a1d
  • MD5 77c8e8c3e3660cbc6819f47c43696761
  • SHA1 fe70fdea6da063c0667aaccadebc7db35a7b3f04
  • SHA512 efb703663caefa9ddbaf9c3f3819482789fd5c80f31cf9689e36bd70f07f305df8fd11ac8d9062114115802285fe941c27523e02fca10e1595726da4c7104d8f
  • SSDEEP 98304:JrwBR1FHS2rH+8kS0r23Os4Rr2lkrxyqHjNgnVLk+hdqgqmqFb5KdRPx:1IRRrH+8kS0fs4mZbC+nqxmab58Px
  • TLSH
    T17C16335DFB5B9097C179963832E6A705BB30ED64429922FBC68EF23A1CF36F015025E4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral23behavioral24