9082ace5f0a91f0236e9a963156de05f4f93e8d8ee3c4ec84b0618490f58f86e

General

Target
ImageLogger-main.zip
Size 5.3MB
Sample260710-pd5ypabs3p
SHA256 9082ace5f0a91f0236e9a963156de05f4f93e8d8ee3c4ec84b0618490f58f86e
MD5 c187a26e1029c2ae6accaa8a70af76e3
SHA1 3afc481c8d01f1779091d792c46546e6ddad8a26
SHA512 2c63a8dbf5aed6b86cb1d250124a7584ffae8afdcb98d342b945eb09465b557e4e9e73b814965d36b36a6592c454a55591184a94c1ffe035c613adcbd9a757b8
SSDEEP 98304:JN643O2seN2bZq22R2DUS6TqhQHaLKCfMbnlNsWd5ssZ96xCoetDZcWW:J4kpsLZwIDU9gZ5EblNsA5swUxCoelZS
TLSH
T1874633C5AF97585CD4BCD73CC8B9194FAEA008D88399D93BA5B813F3A4527A4C0D3D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ImageLogger-main/ImageLogger.py
- Size 26KB
- SHA256 7fad86ebedef3a95f088ece7da99a1f5e639cf414ecd831871c63200e97b4822
- MD5 6ac2812bfb9fd3426762561164729f5b
- SHA1 d8bcd75cdc78d0ce5bc039c1e55f480f36bdf7cf
- SHA512 d1e28ed657bf3f03cefecf65966302dfc1158411e0b2688371be6b41113f30f4c0fc3fa7d89dea3be3e3c3553a0d9038ab9769572c792c8919e5b9974ae50b46
- SSDEEP 384:g3kX0VdltYWHgDwFiPBqred8JfYinTN0StBqQxEuQr+D45YcLB8VQbBy2EARA6xy:gLj1USiPOlJfYiTM+D457RByZ6xy
- TLSH
  T1AAC2CFC4E9BAF4DE4A0C99520E12966F3BCE342D26C4474FEB80FE59174939794CEC98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral1
- Target
  ImageLogger-main/install.bat
- Size 63B
- SHA256 d8969c20b7388aabe420e105fdfc9c303e0ff5e468c4d495d97de697419f4fb0
- MD5 99208abdcf004a6d6858a2907d44dabf
- SHA1 f0ba7a437122b9868c458d2671fd7a00d2e8213b
- SHA512 e85706d2ba19a73aec4e756504de9d344d0e6a2bf0951b336b7dcfffc8694401364c00d0e0fe7859d1a0d92bb17622b13ca8f1120eddca37fce4668de9290de0
- TLSH
  T15BA0024E26A36461B81C7AAD918601D37197EC4738105E42568B62FD8491A40E356313
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral2
- Target
  ImageLogger-main/install_python.bat
- Size 700B
- SHA256 f2dd02228d70d02117008e4e295b36d9af242d5d2c621421732d326605081ea4
- MD5 6d3e127fa5eb1a35486a3b1eadf0de7b
- SHA1 46d3c40a12fa3cc4261dc09cf828e41d0c3c8ee9
- SHA512 03563c060c3e69ab8a6b864e992a9331c7738b5e4cc891756eeb3323fb3587c2931eca3161424e380b35f499fa41cf0a8c6e86c122c9e881e76eb0a17fde6c1d
- TLSH
  T19501FE23032CD4FD03D568CBD522AA93BEC7A3CC45B82190E139EADC4D42F04404B6B7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  ImageLogger-main/login.txt
- Size 291B
- SHA256 678aeb03a646deb74244d3a58efe89a8a3622a131cd1d1ac1d750102ff5e3e15
- MD5 1173d5d321a91f7de3a61a56a8082667
- SHA1 1dadc5604a1bf4ad167575350f5c1fd34e733235
- SHA512 d8627cdab7a9dd4d0d385be96a4c9929642e1054a27f80f163834002a1483032d9aab34971f283c667946f5860b1f0e87567482241c5dd6f0984a2b6ccfd5a52
- TLSH
  T137D02B142365114041F6DF731932831EBA2120775542DA2239DDE6C8BFF2F1941D3ECC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  ImageLogger-main/run.bat
- Size 68B
- SHA256 7507f1be990286062edf2aee73fb944d889c59d621695ad9e75ae2a6e6f8ebc8
- MD5 2470bd09635ab3537f82cc59b046f5ea
- SHA1 b7e761931161593e4f89f9bfe31c2527b6ea4f28
- SHA512 634ac99a884a7f149b67a664fb579251396ddaed233cc32a45557490eae5fb9485c0ca5827e4c227901e4b9fb52132481155e088b91f66d88c3308e83f077a7c
- TLSH
  T178A0220B0B2380E080AC2F0C20E8C3C03CE2BC022C00BF030EA8303C8C002C8C2E3A02
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral5