6b5fde6afc14fa1ca8e1d815eaa5b9ef4bf3a7eb683779faa26594628b2d94aa

General

Target
5dcb78322136f0f0865fe9ccfa4c468d201318100d122ef7f6a0112daf330587.zip
Size 13.5MB
Sample260711-tlbf9sgv2v
SHA256 6b5fde6afc14fa1ca8e1d815eaa5b9ef4bf3a7eb683779faa26594628b2d94aa
MD5 812476d9df50b24c981e5c192c898a95
SHA1 4d0efb9721f26ab21139b66b7b975fbb552f6678
SHA512 d596d05cf2a8869ce04552a0dd288027e7439971007d8a9f90585f51d416c593a2cb96f2b36636a4c8be5492f737de83d7b8bcbfb73d52d407e1ea5b9702528d
SSDEEP 196608:tYY1LSGPLNbm9nyCQExh6PjD7cfeN6cnIHl/slHiN5WrIbWMwEEC7ekffPU+YXoC:tYYJPRK9nxnTaYmsdl/sI6/Mw+ff3Mic
TLSH
T182E633A974CB5AACA41651E9B0D2F05828E8DDD0CF2E30539C7B645C5B712BC96FCB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  5dcb78322136f0f0865fe9ccfa4c468d201318100d122ef7f6a0112daf330587.zip
- Size 13.5MB
- SHA256 6b5fde6afc14fa1ca8e1d815eaa5b9ef4bf3a7eb683779faa26594628b2d94aa
- MD5 812476d9df50b24c981e5c192c898a95
- SHA1 4d0efb9721f26ab21139b66b7b975fbb552f6678
- SHA512 d596d05cf2a8869ce04552a0dd288027e7439971007d8a9f90585f51d416c593a2cb96f2b36636a4c8be5492f737de83d7b8bcbfb73d52d407e1ea5b9702528d
- SSDEEP 196608:tYY1LSGPLNbm9nyCQExh6PjD7cfeN6cnIHl/slHiN5WrIbWMwEEC7ekffPU+YXoC:tYYJPRK9nxnTaYmsdl/sI6/Mw+ff3Mic
- TLSH
  T182E633A974CB5AACA41651E9B0D2F05828E8DDD0CF2E30539C7B645C5B712BC96FCB0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  5dcb78322136f0f0865fe9ccfa4c468d201318100d122ef7f6a0112daf330587.exe
- Size 13.6MB
- SHA256 5dcb78322136f0f0865fe9ccfa4c468d201318100d122ef7f6a0112daf330587
- MD5 6c553c9e419c9a9c9a8f8edf48689080
- SHA1 3bc56fdd0eba52f38d1557617265a907483f0720
- SHA512 f0333fc403e31cdcbc3f25f1afa006bee535f1ec434138ae154d04d3fd67da77bf238d936f4d36dbe86d75134e2493ac48bbc2ba4d15ec858ff8235632e47753
- SSDEEP 393216:Fe3/5onAVsodRKv4H7lqXMCHWUjXFcuI3/PGTAI:FeBoAPRKIhqXMb8XyH/O7
- TLSH
  T12EE63308A9D412EEFA33453DDD912241E595B8A04B31C65B8BECC7F25D932E4CD3AB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Loads dropped DLL
behavioral3 behavioral4
- Target
  installer.pyc
- Size 42KB
- SHA256 a7937e7887fe90d8fec16a933a26136ebefbd68ced59af2602582bf4ea44907b
- MD5 ad086057b3cc7d48d570fce1002efee0
- SHA1 5635709f15975c572f5fcf59810847d69f9da03d
- SHA512 e9db6921143d54edd9e5a661991e99c818ee5a208d01eb207474c93935f336f6e9bccabd80a4dfdefc54f5a9db7b87e9b903780f72452aedcb90258f5db95b59
- SSDEEP 768:FoujSqFtTOkQvqtoEZ21kFfBf3SSCVYDXb2NwF0BrKIyau7XsqItBdn/HE/:7j/QSOolBfHEYrKN+0B+ZsltBx4
- TLSH
  T15013F2B49BFC3CC9DEE610529166A78820208494FE934E1D4D7DF3A9F894DC29D7E61C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Drops desktop.ini file(s)
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6