5ac0761c29fc5487ce913ce7457117844a269cd1058e96ac0ce3b8b6ca017caf

Sharing

Copy URL Twitter E-mail

General

Target
_5ac0761c29fc5487ce913ce7457117844a269cd1058e96ac0ce3b8b6ca017caf.zip
Size 6.7MB
Sample260710-ag5prsbs2q
SHA256 5ac0761c29fc5487ce913ce7457117844a269cd1058e96ac0ce3b8b6ca017caf
MD5 75fdea7fe58c169665fe42493e26b708
SHA1 a6a060db7d8754fd4b67071b8debd7ce8a7aeccd
SHA512 fec16129f1e9dfb6c535c85f5e75dd28517648ceb8a3d3e538a97078f77c77a27dde1b8365fae94987cfb437896af20cc5990434772fca6a3c2e4ce29f533d3c
SSDEEP 196608:07UekvKjIiptC5nYv/UxKcZDv5euSQ/8Li2:07UekSjI6mnmAhZteu3Y
TLSH
T19E6633D959A5B53DCFAFBF3901C410629390FBCB1EC930A26C20E922954DC5A7E719E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  AccessibleMarshal.dll
- Size 228KB
- SHA256 c6d7c68b40adfaca2204bd5a62d411d8d0b3f29c5d86141a36663ea266da00b8
- MD5 5f1398840861c185c839cf2aa0410db9
- SHA1 cfc40a4fb8d1c7eae7a15d0ceea68e6dbcb083e6
- SHA512 51ae52e407c7f76388b7fdd5900cec855a73ac399d5fcd4beb5b1638e1a043688b151dd9e2090e7c72b85f364352080a489f35d1023b996d603ef0c9d014a6b9
- SSDEEP 3072:tAIyIrjJQTRz0niJtsAICGzoRdThjqD2t6ldLO1xHxOqlbOehxQwNgnFPcRyu3:2IytTRbIGThjqD2aNWQL0
- TLSH
  T19B347C4B76A158BCD106D039930B9A7BB772B88A4730FDBF12E496302F56E512F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  firefoxupdate.dll
- Size 229KB
- SHA256 40a03d714c66d3c75c43d568e9c69ef2d4fd295215762c16bf82bf463926f1b2
- MD5 f7c7c01e0c304dcf982dce6250928fac
- SHA1 bf1b1618490acbcad6bc36988406d8c420cc7e6f
- SHA512 781cffb2520e578232cfde876c7f8dcf4c83ed4c41a4129ab1e0688a4f3f46c685c44dfa8e6d9e73f97816c3595ef83ac43cb81c8df026d0337834a43da215e2
- SSDEEP 3072:5xceGQYLn3ZnYUTqYtHZNOCGzoRXjAqSGtrn9NxHxOqlbOehj/g5Oswkpjej15s:56eG1RlO4jAqSGN9R/IOGg7
- TLSH
  T1EC348E4B72A558BCE106D078935B957BB672B88A4630FDBF12F496302F1BE511F2CB09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  freebl3.dll
- Size 228KB
- SHA256 d74512f6aaddb5217b79826f3d82f6b3126311b10470a0ba0e939c7d058603ce
- MD5 9c94730eff06bee8552cad8747a81a04
- SHA1 77d4dbf695978ce93f28fcbf38c923cf7bc39953
- SHA512 c6e42e35d903b44f9aa5238d3145001ae928a4202682cc35ea292448ba6310fe19c9faa530b0c6a7aad1866ec3ae022cecda1c0b6947c92c94e288f96d646dbb
- SSDEEP 3072:U9XfQgvdSpp23C/tTTggCGzoRS7kqu2gN/8/pq5xHxOqlbOehqDwR7GT4N3fV:WXfWpUgZ7kqu2pMsD4
- TLSH
  T12F347E4B76A559BCD116C038A347D67BB672B8864230FDBF17E0A6302E17E512F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  gkcodecs.dll
- Size 228KB
- SHA256 d26d12f91e1da5b6792d0b9840bfd9c22e488c21a84a0b80abb2752b84a6fe04
- MD5 d593f2d8b9ebefb82abe204fc4f2dea8
- SHA1 1c4db1ada685f768268202cc2a2cda9d82f1a027
- SHA512 d1ac495ee9cb396884a2f83634daa86ee0e4746a34ca369bcfd6c6f569570fa1674386e85e8a30eb9252468ece067685655a7174c81885a975e140ba9a323a8f
- SSDEEP 3072:Y0cUSQ1fmnd4UXkwtdwZQCGzoRm/p7q22387sfqwxHxOqlbOehiwwAlnF/MMlMb:yUSPdGQl/p7q22Py/wvl
- TLSH
  T100347D4B72A559BCE106D038935BD67BBB72B8864230FDBF12E496302E17E511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  lgpllibs.dll
- Size 228KB
- SHA256 b6154f1cd46c6575ca6fd5ae4750f8e407a0a8283c814d70a6ab87f5dfc68a70
- MD5 f579a466795194b8dc3accb5eee90ee8
- SHA1 d4df6d16775e430158297208e05b629f63494695
- SHA512 21dc3daf2230e6a7beb903d55a38e49f6bba78b6f955f7afc6a0386a52b3741a113545da83889556db1310c2da2a940c2a613d08171176d07a043228816d11ee
- SSDEEP 3072:XAfZQe/c4XLlZXNft8F9/CGzoRkEBqW2RlMAeqSxHxOqlbOehiOwYOyHp4q3UWrM:QfZ4SLy/PEBqW21PZOdVn9r
- TLSH
  T1D7347D4B76A5597CD14AD038930BD67BBA72B88A4230FDBF12F496302E16F511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libEGL.dll
- Size 1.4MB
- SHA256 74df4d73ae2e06d23d48e6b483214743e0dbc521fb190e96f278ecdd45938ed2
- MD5 ca05c7fd09191ff23c2c1583a0b21258
- SHA1 c912f64c29404c1b7b8b188fba163ff01fb5509f
- SHA512 4ed829d5adae7f4197cde3b2c46098c4f45796f4d88b641431217d00cd82d61f07515b74750e2292ea4fc70c1298171a65e52529dba892d8aa587f1949e012ad
- SSDEEP 24576:OX5ei5ZpA9ZPCh1LIZ5VtURYfC58dGm2VIH06iy9FMmx:c5eSZmPCnUZ5VMseIU6isLx
- TLSH
  T18D658E43E6A181B8C05DE078D3579A3BFA71BC8DC93476BB1BE08B212E15F90971DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  libGLESv2.dll
- Size 1.6MB
- SHA256 212ffc04072e2ef3ec7a97f347286522ddf0e89f4384b10e8b124d818177ccb2
- MD5 eb1c94c3fa2d18ef1ca9eb49ab11f712
- SHA1 d1076f85ba4c54b9e93bbb464d3aec8249033062
- SHA512 ad0bfa5f3cdff38db5a4f3f39e399b14f5fd814857b6e19a9bf48eb513b193d29da24546bbf717385908b6bf01dfb375b4ce2df0fd73f693a0ae0c1f855ee248
- SSDEEP 24576:RkEJz5XO3XcAp6THoXfOGs+fT+PaiYgXYdGmoVIH06iy9FMI/:2I5+8Ap8qfOGs+lgYAIU6isX
- TLSH
  T121758E07E6A580F8C099E0B893579A3FFB717C8EC934766B17E08B112E65F90970DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  mozavcodec.dll
- Size 287KB
- SHA256 723d0104e7bcf2280e8367b1c487788756be62797f8593374a2697a49b93804b
- MD5 619a9f3384e25be230ad918b9533e015
- SHA1 c805c1257793ab36e15dac663d9a8c26e4af8da4
- SHA512 20d83e7ab78cf8e9ee324a0f0d020b304b70695ed26bc784288ee3368e7715d582620d07e6e05f15ff150a61971bf36521ed6bfe147554daf0f2fb1d1fdf0058
- SSDEEP 3072:q7yDF96npzgJoUwFDB8ddpvUdakHSGzoRZXzqhTRE+i/0xHxOqlbOehqdSGtmeOh:+yDF9GlDYsHeXzqhT6/jdSSO9mrmcFa
- TLSH
  T14B549E47B6A150BCD146D078931F957BBA32B88A4631BDBF13E4AA303E26F516F1CB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  mozavutil.dll
- Size 231KB
- SHA256 88986a9d6bd2ba03aff27229ef8b5f6fffa48cd3631e7c9707e0579cfab50b55
- MD5 3d351c37cc1582e7c4a10acbc4fd38ca
- SHA1 e8060ec3c11bba5872b5cc1c3af3011cbbee16e1
- SHA512 8f5359355f413ad04df64856cb98ef33f5c23b1926f308dd3d0a4306f991693d8488b8318ec69c0b9df1cec72b5134659d7d5667a9a244934b03fcc974b94e17
- SSDEEP 3072:rEFog/CBTvJ8Cbn5EuBUSGzoRweRq4FPUZR1xHxOqlbOehvmAeKQ2Kt:rEF4GKfBUHeRq4FWRVm
- TLSH
  T141347C4B72A559FCD146D038930B967BA772B88A0231FDBF12E49A302F57E511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  mozglue.dll
- Size 558KB
- SHA256 d07b5e707bed378b2f47d87ba0c9ebb33f21cc36558ccf050583d26a739c5fdc
- MD5 eace3d571d9078524583724809409976
- SHA1 d1f2c4fcd2677619980980abcceb8f1fa88f8ee2
- SHA512 d7cc97309854f42f5d3c5fd3008b55b4fde7e24209dcec2c62cd16b661d0763ecce980553b9ff7f601ab56c3c0fd709f5dd762426f11835e75c9956143da593a
- SSDEEP 12288:Cg06PIUkebc120e3U2QUf9t7DlO0VvlhlV5EiW6iI7V:C0PIU8120etnpTlhr5EiW6
- TLSH
  T1EFC46C07F2A291B8D05AD0798357A67BFB73B88A8131BA7F27D467313E54B50AB0D704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  mozinference.dll
- Size 244KB
- SHA256 da27605a69c872409a017e7e14548090b6f29e9b5b52fa3cfe348ad2c13d879e
- MD5 897700719ae0f55c8382c82ac7b2380c
- SHA1 41ddf4b62e11689c2372f7f1febd15b669340911
- SHA512 ea0497f9551745480d4fbf12142f9ad8ef74753c9598fdd8cea63fbf1011c6df689fc3017d758c215f040c2d801fff8e232df88ca3c15666e58b83c966289980
- SSDEEP 3072:rdrHBsSPTdHoPNa9O9Luo8SGzoRi7Fq9m2KGvzWxHxOqlbOehD+wEbsTyz6ShU:rdrH9Zoi86o8x7Fq9mSzE+kTc
- TLSH
  T19D348D4BB2A554BCE145D038931BE67BF772B88A4631BDBF12E096302F16E512F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  mozwer.dll
- Size 229KB
- SHA256 cd3e2438b3051eadba48269813f2576d88d1c40789635cecccef462907e89303
- MD5 ac45839c71f4833ef9fe338de1f70210
- SHA1 379c40930c79d88a4f151d2438e3f01009173a50
- SHA512 264a1624b24ec198e419b9a5fc16547da06f619e9505556bb217d84c172532069f7f0f19e3572b9993cd1056975e09fb4e655e0ec6b0f558859a289c574d5f84
- SSDEEP 3072:LpQwPhaBkgS6FS7ltvKBCGzoR05pqj2t2ku75xHxOqlbOehB8w3GpMNycLgzsvx:lQwXgSiBz5pqj2XWP8DIN
- TLSH
  T1C1347D4B76A558BCD106D038D31BD5BBBA72B88A4321FDBF12E496303E26E511F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  notificationserver.dll
- Size 242KB
- SHA256 de252cab03ea1eaf79f677dead19a5b6bb32d07a5e3ccbf8ef35f8c86258c5f9
- MD5 8a100447627821a86c0bef226317be55
- SHA1 b05e7eaaac6809cd7829cedf7f56d0cb259c4ff8
- SHA512 7c47486e502bd40e08e489c2b94dd4a2432b0da5ceae0d72d0c2192d759bcec3106e0a31edf45c0214488dc8f4f8bdbedcf75c6c6c0eaa63581e0d2d5b7bb466
- SSDEEP 3072:RHzICPEgR5YCk6kWIgoVeFTtkeSXpCGzoRTH8qiULrwVsxHxOqlbOehc2PH+fNJr:RTpPE36mgexpkH8qiUAV92/CNJ
- TLSH
  T186348D0776A154BCE116D038931BD57BBB76B88A5230BDBF12F4D6302E16E512F2CB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  nss3.dll
- Size 233KB
- SHA256 e7caf46a70353e2097bffa8bf949d91a8ccfeda2ba4bf6422a65e6e0c6cd200a
- MD5 60d2872338257e84e5159d43bb109b04
- SHA1 423ac1e0611398907c383e52d9bc2f8a263348b8
- SHA512 151dc97c7389590a4c2257c4ca781cf501a35e441c4d4092fc559220fbab27f3c2d268a40d0e1824d502bfe9fd5bd5632fa9d7a189bb2dc6caeb8d7d2191232d
- SSDEEP 3072:3pkRJUMNwytDhnvHdKT+tveHCGzoRgCTqP2h5wP63dxHxOqlbOeh0vw/K26bTh/U:ZkRnNhhfKHnCTqP2wWmvy
- TLSH
  T145349E4B72A559BCE106D038935BD57BB732B88A4230FDBF12E496342E1BE511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  plugin-container.exe
- Size 141KB
- SHA256 653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
- MD5 6935302137f3152317eb6a3b4a74f8c5
- SHA1 494e7a194ab5e7c6934c0154f6a2e48a001d199b
- SHA512 b2c987911aba4f77df7844a6612034fd8516ab7671527c918be013179a61c28082a9ecac69625c66e5a7611535dc180f3792302ce75760d4a3d2610dce1da138
- SSDEEP 3072:Xkxq4w6505dcKCB7xjLrWqQo6SY5bBL/zp2Z2x7tg:Xg9wzXCB7xjXWQ6SYhNLpy2lS
- TLSH
  T1FDE35A13FA5950FAD549C974DA824612DFB2B8860B30A7DF23944DA12FA5BE4BF3D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral31
- Target
  softokn3.dll
- Size 238KB
- SHA256 850d1060fe84b0ab116e00ae1499cc02fa791fc911f2df4bf688f137e962577b
- MD5 5fc32941888b3d9a201d1971ebbc692f
- SHA1 4b976ace1b50a53cc5efa421bec88d7bedf6b71e
- SHA512 9bb9270fc26c0453abfc11fe1630faee67c653644881af7b093dd65ed8ab7dec7134890cfd32b240dadd02afbfe00b3cb220ad8a31cc11660e3a5fd807eab5e8
- SSDEEP 3072:ou3XUjrj42R0RXF7um/tYqIMCGzoRcitbqN2+6q78vxHxOqlbOehhVwf8vZqVqNP:bXUvRa0jM/itbqN2OYRVD0
- TLSH
  T17A348D0772A558BCE506C038935B957BB772B88B4630FDBF16E49A302F16E512F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32