8ce18c169310fe424722be375fa4b47212c853131bcca589f55ca1ec50afba87

Sharing

Copy URL Twitter E-mail

General

Target
LuaTools-win-Portable.zip
Size 6.4MB
Sample260628-3brvyagt5x
SHA256 8ce18c169310fe424722be375fa4b47212c853131bcca589f55ca1ec50afba87
MD5 c4ed2e7575e4dc518761d271a95dfa10
SHA1 5852d083ca4a098815ec3523c43b13c355e181fc
SHA512 5e68527ce2b0172c9dce36eab76582ad8a7c0ff4b640f857289ac9cbe2e4e3a9f575411ba19ca11b154d8e85b111627ec4e9e4f467347e7bc6712de745716515
SSDEEP 196608:wDOUzSNP0jxzoJj86bU0bWjPf5CaV6x/+3Y6s:yxSNPqt64lXMaV69oY6s
TLSH
T1986633C98ADB6C42DD16E2BF9D44016CBD397C2321E5B98E88697CF903E9EC72191C07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  LuaTools.exe
- Size 489KB
- SHA256 8868c694c156f908816a3c5a82258f5d6c09ee18e2b313330a9d05d216de8cf8
- MD5 99bbd7a0e1718d93a10ecabf3f434e0f
- SHA1 b23ea058df0a4f254c6562dce99e302832d6fe5e
- SHA512 157664a6ba6f8fba7bdb993bb37c152f5acbcdd7f942ad0b6df36d8dd7f1af9f0c13875b5924555785d1a49fab16d0413f56751f1b7f40cd360aa9161d59d15b
- SSDEEP 12288:eSJJkYLauS67aQ2UWIgXgCtgLz1uXe+OuhKDxiKgMZBF:9uuS6eeQXe+XTM
- TLSH
  T106B49D327B41C0B2E04770B19E3CD72DCB59AF111712CAF36E9735BCCDB82914A62699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Update.exe
- Size 3.8MB
- SHA256 b716430004afd2c1d2b8f191332541759f30d49fe19c49f671a241f68c3a468c
- MD5 9c559eb649f6aae84517e8311ce0478d
- SHA1 eb5735184f13c237c28c9b4e4deb8e3b8104e615
- SHA512 80a19e3b298ae7c1c6ff3ba01d5e770b584a782b9f818f8cd86321ebb26a93a98f46cbcaf2db5da31890e37357d40ff4e5a6a61eff163ed1cea06850f03fd0a6
- SSDEEP 49152:V0z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZC:S+v0ntHsOnaH
- TLSH
  T1E506BF62FF42D0F7C48A0175E42DF37D8636AE558B2A85C396A97C5CACF0270885739E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  current/CommunityToolkit.Mvvm.dll
- Size 143KB
- SHA256 19b2144fed9600d58a742a5a4a5fd7b10d4d0d2c2e79f5d8019307cf5657044f
- MD5 c5aba3e739e682a6727f33e7c89f1f3b
- SHA1 2c656c3c24e66aea61bda770f146d8ccff5c868f
- SHA512 fd7269021e7064742b1bd2b361d90ba5f848ba9f275f1b1b7a1459b231d4f012fa1bfe37cb0c01f524356e6bbc8a91f7eaddc91202b7fd498b6fa016b3a8659c
- SSDEEP 3072:TSieaCkJBmT1YhqlgBE6KZogn10iAj+QPuzO/:TRVxmYe6+n10iV2
- TLSH
  T1AFE39E1273E85A33E6FF1B75B4F0808A8F72D707ED26E34D958D82920963BC059517BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  current/LuaTools.dll
- Size 721KB
- SHA256 bbe753164bd052f8c956fd89d5a17101516fe726ac458d79171922967d15b71b
- MD5 95240a972a8b138092f6a253652940a9
- SHA1 b87ede9dc4270a2445b321291ea9fa04a8f5c234
- SHA512 cd5e359a2823318fa808527af432f9d87808cdf1aa6e1526375a2a393ff38d0a641c90a74b2ba936b51d97b607ab909f50228c171fae3dc79494f40bb957c6a5
- SSDEEP 12288:ePyMj4y8tLFUXHyi1vQREH13jmbtIWk073trc:eP4t0Ci1vQR61QIWJ
- TLSH
  T16AF439B152A14578E4AFFBB5A961045C8AF9FF427086E37D5C4B74FCC8FA3129082693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  current/LuaTools.exe
- Size 254KB
- SHA256 7d602d8b2599b567918638b398b840156da376a51ce354eadd43d7b179766a17
- MD5 446097aea151a0ca7996419cf90d070b
- SHA1 9681046a38323318fbf2a8af84da75ccd5d6e512
- SHA512 44259699c680c470abf557a7a08fe1e98dc252712551b16ba8abc39e9e15f3494c0cde6503f090ecfbb6b2e17742414b70facdb732b9d2b53e407953ec1b1488
- SSDEEP 3072:FqeXA/4yIg9vkNPNu6H6xCYOiVUE265RJ6nIyBJ:FvgvkNFNaxmNExJ6Ig
- TLSH
  T1B7442A37928541B9F097F1B4CA610845EBF17F605322A3FB1E0379BFCAF92819A69741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral9
- Target
  current/Markdig.Wpf.dll
- Size 36KB
- SHA256 b3054e4698878b89fb7e6244edd62b047be82aace0b1e506ff0271ab663a95da
- MD5 36516367616a3339e7f9a8440b926d83
- SHA1 186c8bb31a6479cbf868cc83d1a67106e8d3b212
- SHA512 1cd6d37e7bef1c6a9871472cbe5dc3046c1b4f41bdd91a44398c0a41b2604a5131b80800a6b7a6935aae84a1e65d30edad3b75b17d60ab866fac21658175ff5d
- SSDEEP 768:4rwjdE8a+zfLQUowohKV41fnPX9ZmsLAMK5qJTa:Ow5E8a+DLQUowOMYnP9ZmsLda
- TLSH
  T169F22C50BBDA812CE1FD4635B8B29A50B1B7B98E1206DE5F1D8150BF0CABB424611FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  current/Markdig.dll
- Size 397KB
- SHA256 17b19e9d32487968d5b55ec1d2d83800534985fc67151cbb6b82f42aaf232f30
- MD5 9df1a79d00d43baa73de4a11c5e1db6f
- SHA1 eb71d0ebb49f105ab733940ef5de364a41d363ec
- SHA512 85f01b9cb614f70baffffd0c7426797ce97d71f45806edf2b7429cf70790800e9f16110881b6c47af1f7fd06e4161843133979b703e7d00fc46c336c6cc8f881
- SSDEEP 6144:n3iVRvQuyp+zNvN8433eabMz+KECAqJGv3uh4bpQOGuV1PIYryeiJEtyBg:n3iVRvQuN863emMz4CqqvZBg
- TLSH
  T1218472B413F451E8F2EBFE37E8A21A20D6F2794BAD41ED5E0484244D8CB57419CA736B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  current/Microsoft.Extensions.Configuration.Abstractions.dll
- Size 26KB
- SHA256 3700bf75d75ceef47ebd6df7df9bafb9f7b7dcf22fc537f227db72ccf74c476d
- MD5 6f48fbe8c1d66121fb930d01cee4cc95
- SHA1 1cc8d8afaec01f6e967818a484fd7aa509624ecd
- SHA512 3fe0dba909f19ea448ccf6e3874db0b6709737b215107f7b86fe35c3b911b200ca37dde2f1377f258fd265caa09f93af49ea5b239b05db5c3442f48c5571942d
- SSDEEP 384:o9WZMDYtid3v9TaTG/FwEzRjz6rMwTbFmDWsjINWJlNgoR9zFiXS:0WZMDYk5pdO/09zl
- TLSH
  T19BC25B1653AC9333DDFB2F71F9A1C4952E3997E6A801DA19689E700809777C09B3372E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  current/Microsoft.Extensions.Configuration.Binder.dll
- Size 41KB
- SHA256 efc13893ebfa02cc7e49ac13cfef68517c4441a33210d67956e7488b8e6b277d
- MD5 2290f7d234bcbf93459adb8bb0745275
- SHA1 e5f4067e40be7685d35d7cad76ef7768e53b078d
- SHA512 7ffbedde32c75599a7c9f5ffda297f5a7f58699b05f7b42248ef28b0bafbf33ec9bd4fa27afbd6dc8f97b7d4ad61fb43cacc19e96fdc536429efd0a494c01baa
- SSDEEP 768:DsjeqKLvg51cjLTwE6ry/v1rt4m37oX9z/5Y8:DsqxL451qUE6ry1Wm37+zhY8
- TLSH
  T1B1134C1793EC872AE9FF0B707471A4224FB6BB917926D6195C89A05C1D377C08A3236F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  current/Microsoft.Extensions.Configuration.CommandLine.dll
- Size 23KB
- SHA256 a1c8c9728b0dc64dcd975f82d013a1b7bc0c0133e46a94f29044f16cad6072b6
- MD5 584eda713ab7795fac1645ef6f3352dc
- SHA1 231d179d15e5caac7de89cb8ad71b9d0db1f82f5
- SHA512 07f7baa9912b3e17239a601e33d40b329788c3cfc47d03626a0ea0c4f1766a3a9184f4c354715136878ea444287d1ffa6ff97e5cdb11020019babfb5dd9e1db2
- SSDEEP 384:/fym2RBaP8ckJt+KAW9BmnWElNhtIscmeR9zlQQR:/amEEYRAvtI7N9zh
- TLSH
  T110B24B6693FC8317FDFB0E71A6F1D5512E39ABD76811E62A145EA0080D737C08B72729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  current/Microsoft.Extensions.Configuration.EnvironmentVariables.dll
- Size 21KB
- SHA256 bbb26aacd4ba67351d3740106bbcc5544827d98d91b48109362988147ae7963e
- MD5 177dcffd43ac45b58a0c42b2c7b99c0c
- SHA1 f61334d03d1050174a90c300c19fa29c39517e64
- SHA512 3ef3aac0bdd86d7401d363f8d4d4771e79402c1459c9c5e5f1f178b4300cc9fc67b18d8af2c2d1f742f3a22f556efe5f554336db2e6126ab536344d1cbe65581
- SSDEEP 384:v/dUEK0NrbQObCWU+JeWDlNBki+R9zd17/:v/UmfNxE9zj7/
- TLSH
  T181A24B8197FCD106F9F77FB4D9F9C9662C35F7D21862953A006DA00B0867B848B91B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  current/Microsoft.Extensions.Configuration.FileExtensions.dll
- Size 26KB
- SHA256 1830c601c1b155c54fbd3a6844453dae87af14eafe763942939d06905035130f
- MD5 ee6d71766d2811851d8dd808384b5d83
- SHA1 dc1a15ffbe9e406484572c21a2e94052099b1461
- SHA512 bbf23f5c8c1059d48e04b965fba41921fb5346117c46792b218e07ed123be5ff1397781a8ddc68bfac44a0a9333442015dec3e67385a9a65633a6fb93f207dfb
- SSDEEP 384:SNHfs86q0/ALi2iTFwLsdYyOiaXAzpkLqWqKl6WYlNorgFbR9zBTV9:Sk92/VyOOpkL3/A9zD9
- TLSH
  T1E5C25C62C7BC4213C9BB1E71A9F0E5022E35A7975C10E66B59DDE00D1DB73C08E62B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  current/Microsoft.Extensions.Configuration.Json.dll
- Size 25KB
- SHA256 e106f8bc13df7168294b95a6cdbceaba47b8eb7e562940eb4ef038db6fb1f2d0
- MD5 e0a403e5af381beb4a47945fb5155ca7
- SHA1 31b3051b7622207f803333e799461f9182319fb3
- SHA512 0828841a0305e043f2df522b8d34c822d13964d870f08e1af0c461dd22a957088b0c44e2a24e877e87aff91a3dcf09f71b225e3e83982fcd0c80473606babaac
- SSDEEP 384:5iemM0/vv+cFsbTRo9ge1lgzWkWR2W4lN4eFbR9zBOViT:5iMCzFsjfGG9zCW
- TLSH
  T117C25B6257FC4213E9BF1F319AF5C9412E39E796A811E71E15ADB00808B77C48E7272A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  current/Microsoft.Extensions.Configuration.UserSecrets.dll
- Size 24KB
- SHA256 a310bcdd868dafc0efce5b03a68cd7af5d4fa0d06509ed4b5c51ddc1758e9791
- MD5 249b5a3d38956616eb522a7c7214d0cc
- SHA1 1b39211cf7978386ce9589eb88983deee137c3e4
- SHA512 03d7b1eceadca05b35a14a3183ddb406d971fe61c217ffddd9d2ac9c187f9ad2cc6cece04c9332096b1396397e0b2398002ea4d3e8d0ec26e8e6a4d5246b3bf0
- SSDEEP 384:o88CyOBc4Rm15FApdE1wEDW9ytCWjlNy2jR9zGGhyL:o8ByURi40uw9zwL
- TLSH
  T1C4B24C52D7FC4332FABA0E73F9B5E4452E38BBD65C11A61D109DA009187BBC48B32769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  current/Microsoft.Extensions.Configuration.dll
- Size 42KB
- SHA256 7a883c57d00808ca9b5d11bfaa2c5d21f714ed7560e781d7313d65b09b88b6c9
- MD5 3970d9bf37ecb6cff7a394bdd25ee78f
- SHA1 054b4622b962ae25446888ddf5ec823e340ff662
- SHA512 950d50379cf9fe0fc8216a1f786b4c0322eecdeb390098e8bf855dc40c6901de1da110ddd48650ade001f009a815e8151ba72872381a16c6b2e96167d7fc427e
- SSDEEP 768:LnxYrISYXrpu4dAn9RY5Pd9Lgg4vScADpDgOlfe9zb:LnxYrISQpu4v5/cANDKzb
- TLSH
  T153135B52536C8B17D6BE1B73F8E4992A2F71D2476815F30D9C9EB09908AB7C04B12737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  current/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 63KB
- SHA256 c2a34d5259e6d6c0af43d9b926454105e80e7657dfed901d845100db254de89b
- MD5 8db369e1139ba14a6208ea8df983ad0a
- SHA1 62e77416f1f25a91c3a5140e3635414af1b8202e
- SHA512 ef872d41c7775a81bb2dcbde47637cca29b4b810f2671826de042129e9907aeb2dff02a1ab684425cfaf7b2f48abc6e9a4f2261a4bb4c15bab70eba556f93633
- SSDEEP 768:z0dv145TiKK8sfK8wUcrioA085JW14e2KSpYzRTzPdH9zJ:z0P45TiK3sfK81c52W+eHSpYztzldzJ
- TLSH
  T127533CDD37FCD373FBAE5B722A7390C09A35BA531401E70EA98550EA0892BC88551DB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32