970fa2d5be03e3fc06e8b37211818767659f89498d729e3a37139a5aee2a8ac3

General

Target
Electra2_v2.11.2.zip
Size 226.9MB
Sample260628-xmbefabz61
SHA256 970fa2d5be03e3fc06e8b37211818767659f89498d729e3a37139a5aee2a8ac3
MD5 2cc5543c5998266592d27d5ec3528569
SHA1 c67ed6ad3fed8845fe5fda414d5b222b47bc985e
SHA512 f36f68ff96755d9b5b1a73e57aaca9f6bef83d50b1bbc15b0085d142f9688a3090ef706c5ee6504222c3115c60aab9fd0888f00d8f1e051c1afa2bf4fa433dfd
SSDEEP 6291456:shJQDzhLx5P2rg84wGLPA8KXfE07SFaV9u:shOvhLxEk8hEPmlSFaV9u
TLSH
T1A3B833ECD71178E97C8E2723291CDE0AEB3A36A3021267E0569B7713C719DC4569FE06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Targets

- Target
  Electra2_v2.11.2.zip
- Size 226.9MB
- SHA256 970fa2d5be03e3fc06e8b37211818767659f89498d729e3a37139a5aee2a8ac3
- MD5 2cc5543c5998266592d27d5ec3528569
- SHA1 c67ed6ad3fed8845fe5fda414d5b222b47bc985e
- SHA512 f36f68ff96755d9b5b1a73e57aaca9f6bef83d50b1bbc15b0085d142f9688a3090ef706c5ee6504222c3115c60aab9fd0888f00d8f1e051c1afa2bf4fa433dfd
- SSDEEP 6291456:shJQDzhLx5P2rg84wGLPA8KXfE07SFaV9u:shOvhLxEk8hEPmlSFaV9u
- TLSH
  T1A3B833ECD71178E97C8E2723291CDE0AEB3A36A3021267E0569B7713C719DC4569FE06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  Tone2 - Electra v2.11.2/R2R/Tone2_KeyGen.exe
- Size 541KB
- SHA256 437374299e24a240b57f6f9512ca0574a7eb30d8ec70b361805cd0260ef39288
- MD5 a78f0a9a0043e1f2bfeb4ac001b3be5d
- SHA1 417a7d8cff2be2be3b9e50404e8bfe920d11ad5c
- SHA512 78abee96b5a7d5967a26dc6b3d467367ab905f1700aba64fcf3d7bef20dd9017c5e7c7ba9e535bae5a89b5134c1da104f2db537dcab1d73bfaa9dca507a09d88
- SSDEEP 12288:XYkc9t2Sll/jtmaFCxgqqFuGXxCc6Uyj4HKKrBSP6iw:XYkcL5j/CxsoGXuzj4HXBSiJ
- TLSH
  T1A8C41291FA2085E3C4630771B2FB9D113B7BBD2289B6125757D8BB2C6673792220B743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral2
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $TEMP/R2RGLD2KG.dll
- Size 4KB
- SHA256 984c9e728e9e95ccaa1cbeb6e006a02827dedc1bffe5d3526ba6e8a66a91ac31
- MD5 0ccaa3e3df10a44a1da8479a9b20ca17
- SHA1 47180541e78ced8a4a3fc601dbf2f7b83172426c
- SHA512 5fa5a1d492239ae51cab4d87a8db37b0c6c43d94e1001cb4e1af9266aa2a4fb95f738a621349697c3cbac3dbe6c110f95e721d84ac761f28662944261229af2f
- TLSH
  T19881ECAFB3824462D75F19780D83DE5A953A122D5F5496F35B0020DE19F06D1F52960D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral4
- Target
  $TEMP/bgm.xm
- Size 388KB
- SHA256 98c69e7f59231970dcb7858791ab5e229bb310ac7e196ddfc3203b46f2d043b6
- MD5 2dc3ec3f50214a13388932155baf3724
- SHA1 deb34a6de5c98f4d954a9eb3857694401a5e06a3
- SHA512 b3e9114e005506381d8ce58dadb4f59e9cde2999b170ec021c195d3594a2d8bc535fce6ae7463d70f72f1208ac302a89dcd30436fced727dc14e949831aa546d
- SSDEEP 6144:byrB6Iajv3kXQk4JFcoE/KdbsNknsH1qT467/3h1pj:buDG3kyx+KdbsNCj
- TLSH
  T15A84A823FA059582D8597E314C3D8BA84310BD5CAFB1571B2A9DBE2DEEFA3D31D11290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  $TEMP/keygen.exe
- Size 491KB
- SHA256 7f96d5c49352254ca4a97fa3ffb72943793a74adecc22724be4ce41399d4ae0d
- MD5 0ea0eac6c95ae6779c9e5b3c21365b86
- SHA1 9e1333e85b6b8246f2964f800c6cedcdd20873c0
- SHA512 94551bc98ea20f491e15aaf7ecddc743b5eeed1d2218123706bcd1f1ed90399668e9eba2d588a05ab906d9dd9711860695a6b5206ea37e683a578b3586eda1e4
- SSDEEP 6144:bcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOhSz3pf47oZHGFnRQNCg5Z3E1TUdO:bc/kEPDonR6Y436vRunCktEdUQzx
- TLSH
  T164B4B282D26248FEF6F9C33A40DE2338C476BF6CC71484AF82E62D5557B23D505AA2D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Tone2 - Electra v2.11.2/Setup Electra v2.11.2.exe
- Size 226.4MB
- SHA256 da599802bf9d6cbc704bd2ede76bcfe8b6ca63e2ec2aee3ad87e1dd8802260b3
- MD5 d22389c0ad973f8bfe9a5be7025145d5
- SHA1 f295c86e73ccd90c0339bcb91928710fb136b347
- SHA512 d8ca20de53a8ae40ed0c09c75bdd8c2f4110966bafa5c43b4afa60f95952c37f266983f3dcecf4be557d2f42b8a69cfeb082697681e3b9148ef38c06db1d4e82
- SSDEEP 6291456:DlZzD/B3vJ14ZWEs1Kr7MGAZLkkzOPudH0:Dl1TB3vM4Eac7E3OPudH0
- TLSH
  T1FBB83399D76260F5FC8E67331818DA0AAF32367301A266601EABF41FC739D84567FE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7