Extracted

Extracted

• • Target
    ​PACK8/teenSnapchatdihhfrombe.mp4.lnk
  • Size 697B
  • SHA256 20eea6002b3b0a3716ec6687953ae54b50fc77e00241afddb540fbddf7ff3f65
  • MD5 76cb868859b8aadccbde3b360e9e9cee
  • SHA1 08e29f89ec5b68892a5984ead4813c567aec4b2c
  • SHA512 0d4aba0feb5c54ac769e152fbfafe5019ea95a096560d2d5400958a7daa13c202b168a519038155e6ddc916d200b301b87eab5b5fe6c9b044c23c1557e78ab3c
  • TLSH
    T10001284032EC1728C3B35B3B4C3956114A26BA45EA22DB2C57D0858CA868204AD29F3A
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executionadwarediscoverypersistencespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    ​PACK8/teenpussyfeetandass.mp4.lnk
  • Size 699B
  • SHA256 e06cbda80536d564ed5ce571010f9130a20ab1155e788e0066c33d884a9927fe
  • MD5 17858f034b706a54fc48a9894c6fb4b6
  • SHA1 64bedc3fa6ff5c5ab789db331a12a6da451998b9
  • SHA512 c2ad329584366e4ddf187a1494fa078195409f9d51723470f0bc8117476b692b86d8c030b52c6aa6daee6ceec30f74e7b6a7839569f71a71663d97d453aee4b3
  • TLSH
    T10D01285021EC172CC3B35E3B087596114A22BA07EE32DF2C13D4858C9858204ED39F3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionexploitdonutloaderloaderpersistencespyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in Drivers directory

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  behavioral3behavioral4
• • Target
    ​PACK8/teenreversecowgirlboyf.mp4.lnk
  • Size 697B
  • SHA256 1c7386333c0eea8eedc4aa758f57c1b20cb1832cc3193cb8b26fe5e9865f7007
  • MD5 fd90e003a2bdad99454e8d35efc7a463
  • SHA1 65756fd3afca862b0aa3a6dd5f115710c63d745a
  • SHA512 9372af9f43bcc0b93c443cb9184569ad43ce2a507e189d3a2c37f6dd3a12b3b83eab906908bc441dac62a69ced988f7097bef59c63690be569b7c006acdce557
  • TLSH
    T16401284022EC1728D3B35A3B4C3956114A25BA45EF32DB7C57D4958CA869104AD2DF3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executiondefense_evasiondiscoveryexploitdonutloaderloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in Drivers directory

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral5behavioral6
• • Target
    ​PACK8/teenslutdroppanties.mp4.lnk
  • Size 691B
  • SHA256 f14d07f85c7ef6360e383d715612471ae9c1fabf0e0b7af69580ad9343b442c7
  • MD5 69120f4ce1f2fd8e791f94c8cf1b7432
  • SHA1 125f438fda3481a84748274f1d0ff9148427b5e7
  • SHA512 ea1583bcf02bbc4f4a08c0482457dd6e33aa6d5a9989feb5e735496a4c7372f65eb689876f27742effc13cfbc224c4590d825b321c036b59b4fa9bb149dd6e30
  • TLSH
    T12501284032AD0718D3B39A3B0C2556214A36B606EE32DF6C03D0858C9869144ED29F2A
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral7behavioral8
• • Target
    ​PACK8/teenslutpussyspread.mp4.lnk
  • Size 699B
  • SHA256 4abe5d9e3867b9ac476d3af7a918b2b652605c844f418d2b5b3154f851852645
  • MD5 d1ff21e387c681000169a6dd0347986e
  • SHA1 d02e152341226e5027713bcd679ba5007404829b
  • SHA512 a1d00b2c50d8c010b1df81fb9fdd5df414bf01ec161f04ca6933262ff3cb36ce4a8a4f5009417eeb4c62bb457568deda9382b1880b1fd72c2adfba872167651d
  • TLSH
    T1D301284032EC172CD3B35E3B4C7556114A26BA07EE32DF6C13D489CC9858104ED39F2A
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarediscoveryexecutionpersistencespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral9