6be28be8bce71ebef4d9c025552c4feb399f53b5548f4c5ea97c24b9c016bd20

Sharing

Copy URL Twitter E-mail

General

Target
Inject.zip
Size 3.0MB
Sample260627-ets9qagx4s
SHA256 6be28be8bce71ebef4d9c025552c4feb399f53b5548f4c5ea97c24b9c016bd20
MD5 d40f7595fd33764d401bcdfaa5c1c90f
SHA1 9147d2a3519a1d2975996c31e851ac518d3a793d
SHA512 9375ea48c1f4d006f79f667e7374a6481af978e6b621ba29080459b00eea29aefb450f5f50a85aeaa892e23b6f611b5360fe7d8c2b070c8aec1ab95b0891af4f
SSDEEP 98304:2M86Ko3bZZozQc5qJE5dzV+4eyVSPTte7Qpvd:2M86PtZ1G5/+4KLsc1d
TLSH
T1DFE533F46E246604F7AB3CB9E234D352EBA315877AA43016CBD371C4EA61B4DDB08647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Inject/Louder.exe
- Size 462KB
- SHA256 c51f7446d749059b4bc67bf9b01576a4992b21457a8a29038c3f325fe97f89f8
- MD5 ed192b7cad6e280cd1bc187307214a13
- SHA1 a001da88228649832db9998732a2a61889c3ef4c
- SHA512 012cdd089ec15bd8ed6d46fdd2d90bb6d99fdd4731600c800d653e7b48f1bb0f16a5a537f7c8a3a69681d5de0c4f5bbb75fe720ed08de2d69626d043e47c96bb
- SSDEEP 6144:+StneXG+TPQN+lqLNGeaWzfifZhAv5XhwL7IJMFjTBWzbSYtYfLOfCBumwbUzAlD:NV2qAy6W6AKdfKKn128
- TLSH
  T163A43A243FA98E08D580257E455E1A08CBDAD1F1253263033B1AEFA15D459EEDF2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution persistence privilege_escalation
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  Inject/System.Data.SQLite.Linq.dll
- Size 196KB
- SHA256 4fa3cc89f5c3cfa0f794c1f849b0ea8d081e5c0e69d7fb2d834caed08d1140c0
- MD5 bbb0d3ddaaba530dc111e665a4891217
- SHA1 cea5a71ff0305083a9add3c4755a8e54ab10f869
- SHA512 ebf248bb57355de887770d91ea2b40a98e0760335a57dc6ea92ab89e65177cae95eb1c08116855c8eeeca81d4022ccdde2fca7cf34fad68b4ff0e14b74c93b89
- SSDEEP 3072:0Nh7rny2puIm199zIsd9IZ16KP8cfYLcgML3:0b7G2wbdLm6KP8cwO
- TLSH
  T13E14B725B3F09E31C16B023028B57458ADB082F3737D5188FE9E63AD9F6A91117B7B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Inject/System.Security.AccessControl.dll
- Size 30KB
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- TLSH
  T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Inject/System.Security.Principal.Windows.dll
- Size 17KB
- SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
- MD5 be2962225b441cc23575456f32a9cf6a
- SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
- SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
- SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
- TLSH
  T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Inject/Vestris.ResourceLib.dll
- Size 76KB
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- TLSH
  T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Inject/WinFormAnimation.dll
- Size 37KB
- SHA256 d9052729b560d819c8d75149b6ca92c48b9e1b1b0ccaa50080a74166db8eaa12
- MD5 16b35ccfcf3e6e97e182d033cb7bb748
- SHA1 dadae07416824b194557ad182546e4faf5775d0f
- SHA512 b652c2eea4ca9da97db7660b8ea3dd43d045f1d0a7302b0d7ec6b09720ff242e8e03401cedb854fe1198f5ebf5d043502ef91ca8cfe03e27d8cb223b34ba5eb7
- SSDEEP 768:LkKguW2jU37VjIOsCF6sxx2trIOvwZw094wM8roBknl+8m3uPezhW:8FljVswHgV4oanlbm+24
- TLSH
  T1B503082907BCD67AC6AD457DA0C6451087F0D94E3C43C79A6E4CD0F9FD1A7A906823EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Inject/altv amph.dll
- Size 4.6MB
- SHA256 e026275f60e0004f85c2b58e7ad3c424e88fe011d3df52d8039f10d250c8ef69
- MD5 26386ebc868eedbeb99425281adbab4a
- SHA1 8a8e95cb6415e4a464b1658398fb452912a6ee38
- SHA512 a81c6f88d3864b5f1c35b370fc3231125db043daa04e984e6857cb09718cd30fed0fd1cd06f8f4b018b777da4bc7f01281568b00acb9a201ab6ac33dd2134d9d
- SSDEEP 49152:HS9CBahn6xkwhfdbnuW7Golh2iGym0bbT2WScIEAo9RUnGkaWnTCMf7O1aQGkkTr:E4ZJGoqamab8EAIkL7rkRqN/9Bs
- TLSH
  T17D26AE42E6AB30B5D2774434D712A21FD2B27C292310DACB33B49A5AAF33BE45D79711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14