e3f70d7fa616e0a4ce6b7eefbf24910ebaf9ead6699cbabdda686792e9ffb8eb

General

Target
RUN1.rar
Size 162KB
Sample260626-waclasds3z
SHA256 e3f70d7fa616e0a4ce6b7eefbf24910ebaf9ead6699cbabdda686792e9ffb8eb
MD5 f86fde8a86a124dd99192aaf12c35684
SHA1 9c654c2ca9dc949e34ef11839cc6c798369489ad
SHA512 9156638e3f7e823645408f1e82b944b2b89ac6573a1356c731458c62d9ba836ac4b18ca105b8831154e89c47f26e2776108480039ab477e819c9b59f046cbfa4
SSDEEP 3072:juwQ3kVzyjAjXvR+k2N41/Mim36YiSxiqVoGUrisn7xbCzseUNSjpN3Sav+TZwjH:673kVzy8rokAoE6YXfeGUrPh3NSjppS0
TLSH
T112F312B24154B74D42ADF7ECCD960C99187F60E7E7E558C4B22EE50CAAF7081345B427
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  RUN1.rar
- Size 162KB
- SHA256 e3f70d7fa616e0a4ce6b7eefbf24910ebaf9ead6699cbabdda686792e9ffb8eb
- MD5 f86fde8a86a124dd99192aaf12c35684
- SHA1 9c654c2ca9dc949e34ef11839cc6c798369489ad
- SHA512 9156638e3f7e823645408f1e82b944b2b89ac6573a1356c731458c62d9ba836ac4b18ca105b8831154e89c47f26e2776108480039ab477e819c9b59f046cbfa4
- SSDEEP 3072:juwQ3kVzyjAjXvR+k2N41/Mim36YiSxiqVoGUrisn7xbCzseUNSjpN3Sav+TZwjH:673kVzy8rokAoE6YXfeGUrPh3NSjppS0
- TLSH
  T112F312B24154B74D42ADF7ECCD960C99187F60E7E7E558C4B22EE50CAAF7081345B427
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  Xyent_1.0.0.0.nrmap
- Size 42KB
- SHA256 85c62e2b76a6d9a9b037fc7966429b40cbed5aaf0443c063c7c52d2b932ffc50
- MD5 0da190f47676caca90f65db923b7c5de
- SHA1 962cd8c9b8790d542b83cd7c6aad01ae35e6d2e3
- SHA512 71bf76cf575154a64f4d7cb8af267ce3ec840cc4b83e9c7077eb04ea3bab28111a0df94e89d5332f87954f947222d8c58d69c81747fc01ae95023f7c6ce56f80
- SSDEEP 768:ah8HIIMJEeQ2lSqYlR1JqWCR3gR2RR8ezRub8RVGq2rLTk/zf67hzsPVLRUMwALn:aOBCU2pY/XqWCwURxNmskPrLTk/zf67A
- TLSH
  T184137D6E394F3BADBD50104E6B1034ADAFEB524B5603445042778FF36C697BA0227BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral2
- Target
  pI1.exe
- Size 360KB
- SHA256 df4dc10f6a52e7a1436583fbf377f2dc320c45dcbc8de8d77b4008693b25b94b
- MD5 3f4e2fe3c510c210ec713b0cb1743237
- SHA1 ed67e25cf9be8b7e02dddb5c52c7c100f75558f2
- SHA512 a117fed1f7328d63700fe109781901ccbe1a49f8c030d95dd9bca614c0cefa01249b41d557af746f2d5902f50bcb4705d419a4a85749ccc59d25657e8d90412e
- SSDEEP 6144:srUsXXkk5m8XP3ha6Dvcu5UNBMXDqQXCOBO5DhnMfxbwO:OUzk5PXP3hwBXMei2hMfZ
- TLSH
  T17574186A36618E72D3C81333D0CAA50463F08544B7ABEB0F759513FEA84376BDE46953
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

.NET Reactor proctector

Executes dropped EXE

Looks up external IP address via web service

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3