886ac2244d337176308fce9dd800777c16adbcfd0115c95290c1a3f6a1d8cc10

Sharing

Copy URL Twitter E-mail

General

Target
adobe.zip
Size 14.4MB
Sample260708-pgdzdaft9x
SHA256 886ac2244d337176308fce9dd800777c16adbcfd0115c95290c1a3f6a1d8cc10
MD5 d950324ca8f0bda492d98a33d00e5c0c
SHA1 96b07549038fa5102e7ab007a8e69620435fabd1
SHA512 6e4e8ac8aabd6ec275e2d0c4a94ba1b4308612320e8cb941e5306851b845b3b58bb98db29b94d68f9fb640d8bc8c06341b03c6c2556abdc9066ba4eb3844c861
SSDEEP 393216:WFMHt1diOHW2qt1CgUUaeaUW2vVwPm7ZUaWHKqVPUVR7f:ndi/R5UU5DW3PmTWtUv
TLSH
T173E6330CD168B10AE177BAAF8938A7E15CEB71574CA2695C1D4F23C12BC0DD35F6A836
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  adobe/Android/index.html
- Size 2KB
- SHA256 ca6e1c6209f3dc406d2c568089fd81b5b503dcc2eb74ccf713e4455c591b3827
- MD5 dbf7d7449445a6029bc7f4f7b6f2c52c
- SHA1 8434b2517799da2fe72b4f89c605516357e14e61
- SHA512 908d272937617be78a62b30ca471b052de04dcd580faae004c2aa549b62d75dacc22f046d5b99bd2bc5a7bb425a82766c4b7f6ab324aeaed742566a7618554fd
- TLSH
  T1A9511F0A99845406217B8374FFF35B26EB968423C30289693AEC728A9FF456085D3F4C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  adobe/Windows/down.php
- Size 2KB
- SHA256 7675173754ee16d10ce9d7145b37d23e22e1ac56434ecc7f54375f9448ff2578
- MD5 eca411f623cc231005f589e86a4c2454
- SHA1 ab9593ab2a755fa1a1746e610e48af6591537793
- SHA512 49a07533915599e56767a0a68dfbf6f7e9b1f62f98775d2e603e25bd2d50da4304467bbfde650e4dd94f6d245d23ef3bfd179145a1643b84a7838a2fe4aefa78
- TLSH
  T10641DB6E52D3500658B282B59FABB288FF860047970785217FDE510F9FF4A4186D3BCD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  adobe/Windows/download.php
- Size 4KB
- SHA256 c6611c26ad815d94953faeeaac8b38b1e52bdcbf97645085057a6f72b3530378
- MD5 62cbf842e93adf9f6c4709aaf0eec428
- SHA1 8653f96957d0071511316edd749d75ca09e30382
- SHA512 bdfd00ce3ad91140f74efb7e5816f2be53c6d068cd987de838638f2db925e7aa5561862cabd71b333bb649b2ce86e3c4143ac58eed37c437fed07b40f539ab64
- SSDEEP 96:gPirZAye27pEn/4NK/Do/nUiwwjOQauxrnNhAMgaEcLjNIwIaAiGU:YE82NE/X/tgOsginNNxF
- TLSH
  T168A1B7DE207B60299B32E67ECF41AB09F4A9410745229201B87D00CD3FB446CDAF8FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Contract_Invoice/Document.pdf
- Size 1.9MB
- SHA256 53b0092b709d55639ad82688bb6dfcc97207fe0932aaba85e15bb20472165317
- MD5 c7b6cb290fb76051aa605f67e54050d7
- SHA1 c930a5e686f6d02783c4a636a63104d866f1c490
- SHA512 c721416e3d85f9cb38ccccebeffc1ff83e47c0372009dee5a3b0507a9812eec1936e38c9ab19fcd2e0331a505cd75608790a8db150a38e38e2d91bb0d0b945c4
- SSDEEP 24576:pRSWW2XJn7j1idTx53c8ZauSovlPqq6xpQ6QCH4psq3gjK1XBKpgA+qj:3SWW2Zn7j1uT73csxPqPxBxYpIL
- TLSH
  T17295D0478C088B47A15583E8BE170D7D7B5A275CEC863AFE602A4DCB2F106625DCE46F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  Contract_Invoice/fix_lnk.bat
- Size 466B
- SHA256 b0df35d527a135a3008a3e34a323e8f726a17011a90f309a83d71bbd7eefa8d4
- MD5 d70672123eceb1dedffafb465208f382
- SHA1 d7d3e2915c2f6b673be4095652d578f0e2bfa2bd
- SHA512 feba2ab7d9f25308f4fb1f510d0feaceb6231c165459a79dfaf7b1b555ab5695dcfb371396c13481d2b5dcba2cca698c3336d99073509a40a07a7ec199a8c4c7
- TLSH
  T1E7F0DC036875E31747F39CC5847EAC2EEA6A10911304C4D32371880078CF13DFAE0187
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral10 behavioral9
- Target
  Contract_Invoice/fix_lnk.ps1
- Size 426B
- SHA256 f4c4a3cf75cf93e6df5a773f7b5145a1218c0bb120831c11c339ed4dddfe02fd
- MD5 1a6420261281a0c2996b8b352cb47e03
- SHA1 a1c7e7b900d92d6993ec9f312d9ce7064cf16960
- SHA512 3aa59b446e124e839b8e22e97d201470b6717267f5890fdfe9b9ae5946f48bf014a804a1e5ca5a9617a8a682115f46078cd0e519d1435d22f53f8c717f05a321
- TLSH
  T1BCE0AB6790FEA4418BBECA05713D8C15C866818C5080D8610221B9CC7C432BCCF7626B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Contract_Invoice/install.msi
- Size 12.6MB
- SHA256 2067e236c1df64fee6b2fe36b273c21cc918e947cd915f29239dd7f91bfab4e0
- MD5 51d938944c7a87450159801958a6ded2
- SHA1 017b710d0a8940fe2ddd459ac0328b436cd52091
- SHA512 96e1d8c821bd50cfc1b51a1c3c965cf827113e0437855793b23ade5ffcc615519e7cb7e8706dd779bffe5833e7a4f7ad5b63301a786c0afaa7f7d607c851918a
- SSDEEP 393216:GmkEdQ03NldmmkEd8mkEd8mkEdwmkEd2mkEda:6E2cxaEiE6ECEcEo
- TLSH
  T1CAD6230573F8A119F1B72A3AED3956F1587B7C22CD62D15E0658364D2AB0EC19BB2333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  Contract_Invoice/launch.lnk
- Size 1KB
- SHA256 cf60bc839a5374e7941a3c4f7271155b54a396f50f1f459d3ca216e9727dc36a
- MD5 59ff3f0fcb9978f99dd98ce74ed9bc76
- SHA1 3f5c4a9e6635062b6407aa1c5b20af10e0ccfcf2
- SHA512 88acad3e80bfea1f2f0aebf886f5d44bc3cad2ef8e96b201b2b473c58d779d00ead8e157d674c250d3364fe8d1d6bd16ff111a6f03bf22aa44aebaa827b85c67
- TLSH
  T15E41004A19F82710E3F7DB7E147DB5128E30BD85FD514B0E04C681899865A50BC20F3F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware backdoor discovery persistence privilege_escalation rat revoked_codesign spyware
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  Contract_Invoice/launcher.bat
- Size 63B
- SHA256 32d273c180050e1981c2a7085125c4e32ae9d9a96cb1d2e9628ee4c2842cb8a8
- MD5 df5d3d65bff81f5e913c42e7fa2d3b2d
- SHA1 18d10993845111733891b09660c065e46c78da53
- SHA512 8dd1c54464950199eb3c3b96e32a47d47398a6f3ed37dd3560b64bc84349429b921089524d60139918daff17bacccefd6981fd24f8ffd8d575af0e7cdb77d4f4
- TLSH
  T1F2A002454DE95804701B5500556A50DDFD1F90837143999032D2B465548F68586469D2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  Contract_Invoice/setup.bat
- Size 256B
- SHA256 4ab511325cf018ed39c5223d91cfa1b47006004167cfe31761366aa51e60ff42
- MD5 928ebc54bc97997f28742f45100fb4fb
- SHA1 58dcf4952abc1502b4538424f86763cf91a86868
- SHA512 97b38a0ee460bd42fde75e4609b0f0704a30e9398a55e0c0f240d4ff4fed4b76af723e2691303c05f4bd8166f6d60b2bf3c7babbeb49fa743a4d8f77d69f8466
- TLSH
  T143D09501241D043B255ED1196034034BFDCF52D7241525D071DCF0490E0F635DFC0CC1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware backdoor discovery persistence privilege_escalation rat revoked_codesign spyware
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  Contract_Invoice/silent.vbs
- Size 561B
- SHA256 5fe79f26445462b9a6a4801a78976814abfd9791be284a60be08570a9ba21255
- MD5 a0a80a2ac6a1c69ffcda33c9d11e4777
- SHA1 09cf7938982ce95e17ccce9f4546acaf78456af0
- SHA512 d8d3ed10a5422e916245fa035ac1d2d8b3d0b565b2c0e20db1649fc662d1aab976e9763a299ff3bc09fe77d0e8829d5d1de9298445662e1f8c882a05c9c9158a
- TLSH
  T124F0590D592EE2210019C3B025798C8E6F4A667FC138B8EE7F89C880311E3F09E287C7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware backdoor discovery persistence privilege_escalation rat revoked_codesign spyware
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral21 behavioral22