39095c8362696b365aa639c78ee29ae994c5324f106c96a8e9b99a7112881723

Sharing

Copy URL Twitter E-mail

General

Target
passathook-cs2-9.86.5.zip
Size 124.2MB
Sample260709-trdhtads9r
SHA256 39095c8362696b365aa639c78ee29ae994c5324f106c96a8e9b99a7112881723
MD5 ea44b3f24dea6a702a04f1ebe9afdc8c
SHA1 c796a0f3e32780a545abff69319e65dffef6b434
SHA512 d078c554f46b667dfc611e3e004274e7f69b275d962c2096b3c95de55b53b6c57170b2617baa2c321f633c59e4f6ebb2092e095e6e131f170675b5bb0cadc4eb
SSDEEP 3145728:JxkXQCSr8Hcbgpa5g8Inu45LiuZXrIVD0:f7r8HcbQJuQuW
TLSH
T15E581263605C21E79476421ADE32D462C9B9A5E61B2982C370CE700D3BEFCFA457FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  BetaDecoder.dll
- Size 17.4MB
- SHA256 1b4a5b44d527b313b57a39d8b0e4569a15a07ef297fb713603bcbf3f08da66de
- MD5 9688a3d5eb9b84843fe92683d9f798b9
- SHA1 4672ef5966ec69dbb1f3a413fd08f5d893a67029
- SHA512 83fed94535ff45e67ac3ba912c140ed76ceb0623e337304176869a3776770d544f8927dcf2ae6526a29104a4b222c2909d26ab1c5932cc157501fac76668d46c
- SSDEEP 196608:VWsHHGTaxG36cx6p5+ZVAP/VFKztgTG1hDBA9balZq9Rzmyj:Xgb76p5+ZVByTG1hDBA9mS7myj
- TLSH
  T121077C976068A1B0A57E934CCF32CD09DA7152C90F648AC334DD7A8507AFEFA55BE702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  EliteOptimizer.dll
- Size 95.9MB
- SHA256 925f784ef935ba832b60beb2d653dfd7931950bd28ba400cad98336ddde5131b
- MD5 84ef284ae284248150085fbe627d4795
- SHA1 aae648e5c755ce4c90b85c3f9034a132162c8f3f
- SHA512 0d08244727ca067b03b76f0540dd2ad0a8786919b669f3818bac374e4c3ac1f017f8f45940c4b3417bf9202e8938d56669f7c78a48d288329f03131135d59ee6
- SSDEEP 1572864:XtkXzkCSrUtVBcbDMpiEeVrK7n9i3IPe+u/bbcNH59BiuZ2S71BKjVDBTs:dkXQCSr8Hcbgpa5g8Inu45LiuZXrIVDq
- TLSH
  T14D2833132889C7A6E6BDDD61B23035C9255AC6E70429EEF16A7C44A3CC0494FAF0D7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  README.txt
- Size 164B
- SHA256 351ebcc62f3e95cab329631ab367a34799331bd88861f0f30df86f5c322b4364
- MD5 8e4bcb8b0619816daa94a30068ea2b85
- SHA1 8541e9414ca7fa5ace31b01ca8ae3a4e2d53958b
- SHA512 40c76fd724b4a7d7410c10d3d9da6e89888dde6311aeea79f51ab0986c3cab223ba251ab8b8746c5cbbd4a300d220c0bc6284cc1faeff593624d880f66963e51
- TLSH
  T1E6C080B3CBC153752540C68DA1AD16D49634525866B314E19A41C1C4424E4C657375DC
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3
- Target
  commons-aggreement.txt
- Size 6KB
- SHA256 2b0ff1a66769222b85996fae92f7fa734bcdfd422ac864cbf28659b243baa182
- MD5 357667cc150eae3179af95d0f75bee98
- SHA1 69fe5bc431df3b3e03a5ba32ae5b92748fbb82d9
- SHA512 d3d326949168f98a136deb84557d7ecfe925872ab2364eb797f8b3a7c7707fc3190bab199644827d56413813f6881c5e0554745dbcadbb89c5a68f9ad81f774a
- SSDEEP 192:Dqmp8oexXBebMulgRHumb3hpaEuMISHON:DqeehB+Edjpa9MI1N
- TLSH
  T1ABD1B6A5378A03A54ACF01516B0B5084F66AC13E71AE56E572AC514C33FB16D83FE39F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  github-about.txt
- Size 28B
- SHA256 209179469c1e695941800566fb504e7dc7040f883dd67f7d6caf6c4170103406
- MD5 8af80a3db0423f0255edb2dfb0a9e98c
- SHA1 e7cb05336b4e3cbc386fd06a2e7bb57098f9eb38
- SHA512 6a7e425e6b232d7b8191f080e3c8ce3e0690ac22ef90b0ed5a5ed470f9127af49a65d8f0486726c9bd2cb26692580c7a2a20591b25fff934be1742551545a1f3
- MD5 SHA1 SHA512
Score

1^/10
behavioral5
- Target
  icon-github.png
- Size 22KB
- SHA256 17eba628a7dda862d236bca66899be4b80c02c57244f0fbaca573f31740ef730
- MD5 f0fca642b1b10c65c5388d54264df46a
- SHA1 2827ddafa45d9aad3c54f4ff581d046699e015fa
- SHA512 48d09410cba82a923efc3974c98d77afea09a92bdeac603cb2439f8dcd033a863c59ffa3260abb4f9595d3fc2bff1718f627db96c695b6cf700dd910348795c2
- SSDEEP 384:kagku6S2KQRNMvWsx5IK12VpYArX/JpZx3vag01/TqWrZy7sL4nGCOmWW6j0sBJ/:kagkur2KQRhYIZVbrj3ELfJL8GS6oGJ/
- TLSH
  T15BA2DF617E58A481D72F6DF2FD94CA91AB0E180D46584C93A20AE678F7C6D3CDC9070B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  libcurl.dll
- Size 10.1MB
- SHA256 319025f95ce5f6e6b61d4bf56923475c3ac5042175c7f6846d7db520ed79a654
- MD5 90d773980a5cbfcc7e363ef06c125e73
- SHA1 c091c662e5933334d86657faf9d4be59a3ef3fc4
- SHA512 55b871492cd47003aef3c28d485e174cfb08b467cf558433c7245ba44eefaacfd7b13b3855fe6a47e1bb3b483c2249574de245ca3d697bd9cb6bea509fa2202b
- SSDEEP 49152:ZiAfq/9uyKjwV/4Gp2G5dAnkB2z0p8qga8+U8uipPJ7vTHs7Hi1YOEzwyLAyla4R:b
- TLSH
  T191B60733644D32CF58920452E512A0F38CBEE936A71A93E5D48B902D39EE0ED956FF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  passathook-cs2-9.86.5.exe
- Size 789KB
- SHA256 b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351
- MD5 7744ed6fac4775706938298f9cb5ba0d
- SHA1 2f20777a19b81a4b37de89e4d5a9b8eda21b51a6
- SHA512 9a6d02f58367c3bb728e81566685b0292232e4cd3e5c6b4eed65928026115e7a1fe20e1248950431a5a9d0b5e477310d756f9a70b9337edebee9b2a9acae47fb
- SSDEEP 12288:r/uMr7FsWEt/e51oHpbIp+UfhbkK4crxzB4uhBTpbAhTPCUe2F:7uOzC9IVkK4CxVToTPB
- TLSH
  T18C058E2A676C01F8E1B7E27989954507F7B6B859137197CF43A0867A2F236E05F3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8