0698b0e637406afe5fb48bd6f4a8ce03659e56f478df75bced564ae94316a7c8

Sharing

Copy URL Twitter E-mail

General

Target
finalfuckedgordao.exe
Size 1.4MB
Sample260708-ynapzafy8p
SHA256 0698b0e637406afe5fb48bd6f4a8ce03659e56f478df75bced564ae94316a7c8
MD5 a5b81d74264cefa5bed73d1e35e61ae3
SHA1 2cf094c3897249e4d734161723a150034e62c291
SHA512 df807f3ca3822c7964274c9d4aff541b071f1092b880be80fdd1a38185cf3a82853ee18e9751cd8b1db4d2b27125e1e94a55a476d9cf6865e01c0ab579a3a7d3
SSDEEP 24576:AK+50SHgbuO0MjdM8yfAPnqOTmciow1PmCWJds2GhSEW1rxYcxMN0j:AKglH20MjmfeqOTmcNwdmCOVGh9WBxM
TLSH
T17E65230827A80F4AEABF5E799CB0521047727503A636D3CD4DD8D0DE4676BC4BA23B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  finalfuckedgordao.exe
- Size 1.4MB
- SHA256 0698b0e637406afe5fb48bd6f4a8ce03659e56f478df75bced564ae94316a7c8
- MD5 a5b81d74264cefa5bed73d1e35e61ae3
- SHA1 2cf094c3897249e4d734161723a150034e62c291
- SHA512 df807f3ca3822c7964274c9d4aff541b071f1092b880be80fdd1a38185cf3a82853ee18e9751cd8b1db4d2b27125e1e94a55a476d9cf6865e01c0ab579a3a7d3
- SSDEEP 24576:AK+50SHgbuO0MjdM8yfAPnqOTmciow1PmCWJds2GhSEW1rxYcxMN0j:AKglH20MjmfeqOTmcNwdmCOVGh9WBxM
- TLSH
  T17E65230827A80F4AEABF5E799CB0521047727503A636D3CD4DD8D0DE4676BC4BA23B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Downloads MZ/PE file
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  costura.dll
- Size 5KB
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH
  T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  costura.pdb
- Size 7KB
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH
  T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3
- Target
  discordrpc.dll
- Size 90KB
- SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
- MD5 9f747cc51687d853f92f70a537ff6ca6
- SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
- SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
- SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
- TLSH
  T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  discordrpc.pdb
- Size 29KB
- SHA256 2fd5f1944f3139517141f8608340bf9747af6f80856fe030b0b0f1ea1114625f
- MD5 0c1cf03431012945aba35f05c7cd56c1
- SHA1 df8a7de40e43fcb70b944f4bad52cb20e03cb3fc
- SHA512 4ea2eca8ba11318a5db94a9286fd7f9bfda15ae944bec55695e2c165879f9533613ae255dd96660540a5e3b980cc61bbcdaa79345df227356b5a8b58f895eff3
- SSDEEP 768:msPyDQfepHiz7WMLHvTDpufyJ/PePYiLUDlOp:m8yBpHDvy1PegYp
- TLSH
  T1AED2F50AD3440B3EC6E651B7653353679338E045EE878B0B4B98B739AD053A85E633ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5
- Target
  guna.ui2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH
  T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  microsoft.web.webview2.core.dll
- Size 575KB
- SHA256 a5878dec68ba65280d0bb450b1029dad9bb380b9f24cdac4503ee6a919581e56
- MD5 a312715b3b3e7c28be91c9ca11a2e8c8
- SHA1 efb22e1496de7d5da74c740be51f92c8625efdff
- SHA512 eb6308060b151ab3f7272ad9f99ae494627ddfa4be86eee5d615131cf8e228b31d76d9b4f1897564b5c94f76444c28ecf5305525784e38a2510f27f322085271
- SSDEEP 12288:OmV+hdrrpQ322vy+uFKcDguRFNEMFeu+imQ269pRFZNIEJdIEY0lxEIPrEIgcvLB:TBI
- TLSH
  T1B3C45F2223FD461AF6F67BB5A47407308BFAFC96B9B8D75D0A98155C0D72B4099A0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  microsoft.web.webview2.wpf.dll
- Size 80KB
- SHA256 bdf97ef62b93a0599973ce28aa300b74d0407c51c9f9067a97723366ea0c81d4
- MD5 80ffc92e3f11c3f4afb11c618b77c31c
- SHA1 cfbd6285a741c24e6af5db59cd130644a652e49b
- SHA512 3df9eccf553ee4ecca5c696019935fa2ca72cfb09983366b6806ca5e8407fe6f993bf85919219d35c949d2ef279d3243a5b92bd49c7016bbd3b79fbd73271636
- SSDEEP 1536:zS+MapLxrD2uxpLAhZ8fY1DHf9WyEb30mpc4Jjr4YeUqGGhwU0odwQvUudkWUaqN:f9xr/TwZ8iDHf9C30mpc4Jjr4YeUqGGe
- TLSH
  T1BD838D4173AC8823C6EF1BF9786445161BBDEE837E52CB8D2D85F5E80DA73902849367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  newtonsoft.json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Loads dropped DLL

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9