71dd00ca6410f7f195289decc5beebaf8651f8b15c9a7879aa595f1f98e84d4b

Sharing

Copy URL Twitter E-mail

General

Target
respocket.zip
Size 58.0MB
Sample260701-fatltaev5m
SHA256 71dd00ca6410f7f195289decc5beebaf8651f8b15c9a7879aa595f1f98e84d4b
MD5 b37d5146f98183bba538159ffce4b282
SHA1 3a38640c7ce307509b7bd0a2a26044fb57998eef
SHA512 65cee42bcd595f7939d6f6b47a54d881a39a7aa38ce289b4b5220fad18c32b32a31f19ced446b5487723fa4ca9b465b183fbf51ff35691fcddee30b900bdc5e3
SSDEEP 1572864:fqq5tKnLtn0QZd8AokxoYCHaS61TJWo/LuY3MyMMIFL7S4yWS:fqq6nLpzZaLkTbWmRIFJI
TLSH
T1BAD733F1FA5C6DA3B00FA242C7984B09932B346F039654EA040253E795BB7F92F36657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  respocket.zip
- Size 58.0MB
- SHA256 71dd00ca6410f7f195289decc5beebaf8651f8b15c9a7879aa595f1f98e84d4b
- MD5 b37d5146f98183bba538159ffce4b282
- SHA1 3a38640c7ce307509b7bd0a2a26044fb57998eef
- SHA512 65cee42bcd595f7939d6f6b47a54d881a39a7aa38ce289b4b5220fad18c32b32a31f19ced446b5487723fa4ca9b465b183fbf51ff35691fcddee30b900bdc5e3
- SSDEEP 1572864:fqq5tKnLtn0QZd8AokxoYCHaS61TJWo/LuY3MyMMIFL7S4yWS:fqq6nLpzZaLkTbWmRIFJI
- TLSH
  T1BAD733F1FA5C6DA3B00FA242C7984B09932B346F039654EA040253E795BB7F92F36657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  loader.exe
- Size 93.3MB
- SHA256 931e47ab4a793fa346d14b7b599cf9ce49521d3351e80d2098773f7dfa9c1e04
- MD5 5fbd4e15228a889769cb6777e71afe51
- SHA1 e3fe8983beb3b8e9af3a6e0658a9cfc177c4466f
- SHA512 9c961c4bbd9945dfbe45b56f00693748e11fc3a307f3faeb6a3b00845e3213833280119fb501ad435d868707b90672c813b68bf595e4e93ef8b994a489ba45f7
- SSDEEP 1572864:zZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:zZa7hmguP2nUOnAwby
- TLSH
  T102286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral3 behavioral4
- Target
  x64/Bypass.dll
- Size 8.1MB
- SHA256 dec01fbb6941fd9a4856f38682a6ed7d90d04e66731e9589a80001b99ea7a6c2
- MD5 113387f3925dfd0cbdd616d55d4b6967
- SHA1 b7da7a3dbfbc5be4ab41affa6c1c5bbb8c2f091a
- SHA512 6ad0288448d7f07f01296ac64d9ed9d248566c0fc875a3a0ecdbaadcd7e8ace0d923f0d2b2ed7ccf69c765a1ec77b58ba3df8a9ec34e91b644fb93c2ad6142a0
- SSDEEP 196608:lSl9ZqKWwVOuqaPg/Kei/v27WKb5+cXuDL+:Ul9ZqKWwVOuq2g/K27WKb5+bL+
- TLSH
  T141869D1776A600F8E57BC07CC6579A27EB71744A0330ABDB06E082662F67BE05A7F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  x64/ExtraBypass.dll
- Size 133KB
- SHA256 daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392
- MD5 f808357eb75ce997e02ed7c936f33b81
- SHA1 94eb0afd7193de15f94d5788a8b56e65933b2683
- SHA512 ee3b8a35183a29edf1f699bcb00463fae1d6ce0227616b90ef13979f18025ed26f4441055e872b625e87fcedfd35951467d104fab97856190a77c62d5178f280
- SSDEEP 3072:y/Mc90jGyW2CAqrC3Q8S+vEyBUB+5vnA8wvsl:yUO0jGE9qrwQ2NVpevsl
- TLSH
  T151D36C47B7B410BFE4778274C8D30A12D7B6B8251B609B9F07A046592F237E19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  x64/SQLite.Interop.dll
- Size 1.5MB
- SHA256 93b35c2c65f7eb739f8122ca09b58d0bf8a4653f772281c8c0be450146d32ba2
- MD5 5389512ffe243a7becec1d9fd58c84d0
- SHA1 580b65e88c4e0e4b91fbd13d50d28e858851ae23
- SHA512 ed42d5acb77db2736803c5d118cd0a1335e0396bbb848573d8295809621fc9bfb0b1faff7c085f8b4f5a08fad62e1330502baffba235c2431fbd655124738e91
- SSDEEP 24576:5CYA/V0MQ/AOv4FIljfL0lCNmjMO0qqjh3aF9dfOZph7/akDAz/PrZU+L0/mZfo9:ZA8IBFIljfL0lCNmjujRaF9dg7/YS+E/
- TLSH
  T140657C4BA2B501D8D6ABC17DCA175607FB7274051360ABEF57A08BA62F13FE2167E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  x64/sciter.dll
- Size 18.6MB
- SHA256 77e82cdf92f908a75efc0aa28a5b92ba36837ca309972343930f96c00dab8f00
- MD5 56aedce490069d72f6219d3ba0728168
- SHA1 a6399778ee997c73973be2f188fb3f05bb7be62e
- SHA512 ad648eebb456909edba00c9a795bf8575e3b30671302773831d0cba115d3f20dd55bc72b3d9cfa55d2e798c40d94d1c203aaa9b97387a751fcc967803b78fd9d
- SSDEEP 196608:zYyN5GzA15auSsLGaQz9G2n3VMBvkpYRNiNxK+:zYq5Gc1crsLGaQ82n3eBpRNiNxd
- TLSH
  T18B179D57B2A480A9C4AAC074CA57DE17E7B2BC590270C35F21F466EA9F377706E6E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  x64/wintun.dll
- Size 417KB
- SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
- MD5 e861eb5789c50997d9476a6172d1c269
- SHA1 647eb6588b149efe2477fd192c8cab74d018d8ef
- SHA512 d8b49a6834c1ea5d73fee6979c59def18900c86d598ea900ab741ce71eefdaaadb4862afefa14e6cc093007eae5d4325857633549f1ade555baa0344b18e6112
- SSDEEP 6144:uNsLgQtz9nDZL4tFDjiaOE1DfsnyDQhWmnPIt:iggQh9nD2tFviW4/Qt
- TLSH
  T1E2947D8273E81C96E9F3CB3889638901EB3779544770CADF1261826DDE6B7D09E34B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  x86/Bypass.dll
- Size 6.4MB
- SHA256 2a29d2d9378a44e6ce051f072bbc79aa0ec6cfc6d4594499c3f60dce007f1382
- MD5 12139240c449d58185295311b9ca1bd3
- SHA1 233a49c4e8080d114df0a8eff6c61027fb2999b5
- SHA512 b1622be018f89ba35db49625ae3c9570fb4840b35c326c519e1b08624f40c368247eec8fff12afb4c116aa940ad398690e57de66ce9ed5616e53b7639805043a
- SSDEEP 98304:ldjcdo1enJIVtecCJn+6z3WC4JySwChtBW6oG+wh1+5bUY7:Wije1Jn+6zGBJyQhUGHQF
- TLSH
  T1A466AE12B903C032E4DB01B1E1AEEBBE4A6C4630132594D797D05D7AEA719D33A35F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  x86/ExtraBypass.dll
- Size 97KB
- SHA256 f96f8b66f2fb99077a4eff2cf55c1500f334d71ba425c3989453ab5dae190c6e
- MD5 18c9f48b88bd2241a265919a4cd4a794
- SHA1 d1823f9e5fa97b4bd2196b791710e56c93e4d99f
- SHA512 54f391618df12bb996589a3bafc4e4431b9f99051818630918c406a14a6332e133070bcf804a7349c2b2a0dad3bb9138db11ab699e5ad23b03dcde85bc081b4f
- SSDEEP 1536:MMFBplMH3yTvs+w9sDPOgeFIMKMcbNYUGsWKlcd714KktdVmAz92deM8wvU:MMvfMiTE3IOgQcbc71PEVmAp2dP8wvU
- TLSH
  T1E8A37B11B690D075EDBE1D305868CA729B3EB820EEE0DD9B3759066E4F303D1DE2492B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  x86/SQLite.Interop.dll
- Size 1.2MB
- SHA256 1a6845e27761e5c26c1cfa128d2d2360d24e05d229008bc2f0b4215a03366dc9
- MD5 6112b48951eddb62e78ba86d239fb2a3
- SHA1 3219cc358a61073823294fb6cbea081a9ec2fc01
- SHA512 71022aa649c5751a2abb7b9b618747009c22c45518dafd7df307193e873308eccdf7303b7f8554a541c9f02006e488bfe3567ab61e6fde3806415b810ca6612e
- SSDEEP 24576:6KE4r0RaYdKYR7KtLqUmZRDiJC7Z2CQiQYZh5YAIQLsV5:phr0RZ5RGtA0KpcYZ8tEs/
- TLSH
  T165458C52FA8381A1E9E111F5A2FE2FB7097C1609432888E7D3A46CD49E600D3767F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  x86/sciter.dll
- Size 14.7MB
- SHA256 acebb40ecd916a04d77ebc437a42d7287fe9250d4f24e4fdebae4507861253aa
- MD5 e138cc0a64a67c61d119dd327a7ad0c8
- SHA1 4fff6bca17d1430fa15c53888d3e4f6176f8ef52
- SHA512 b46ec47bfa629e76fb80f374de9e5f3f3bf9bb98f5a96fa4df2f3894eee7a3ef816430683614c8a1e32d1b3377c3f7c0de2b18357c50a6dc3ff5ee96be987620
- SSDEEP 393216:hwKndpRismVdv7DIk9zQXB5DCQNONiNIkWL:GK5+TDb9zQztkT
- TLSH
  T12BF6AE23B681C07DC01F02B05E4DF76A83BDAE704BF182937A983ADDAFB05D16A55617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  x86/wintun.dll
- Size 538KB
- SHA256 d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931
- MD5 fa0391a861b949de22e0a59c6faeaed5
- SHA1 d451ef2224b27938eeaa97ad26f75b686d86082e
- SHA512 e44889d0f3044f90962181d7d8787076f70b6e1d7974150f16f83d33a97f1fc4bdd0c7a38eee7a1ea8e8dc4f66ed37dab004f2855dd361de8fdd4ae6e08fa048
- SSDEEP 6144:w89wYsjDrSwf2IHHVVsWhC2njQtIu1MlXwiMnnyDQhWmnU4Dm:jjsjDrSOFaWFnjQtIzlXwiW/U46
- TLSH
  T1F1C4AE43A7D84467E5F79A3445738A526B3EB9300B30CACF53528A698E637C0DE34B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Looks up external IP address via web service

Maps connected drives based on registry

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24