70cf86af4ee9f9849374b43a348b8b2413cd2e0dff5de1aa63b3f83476a7ef53

Sharing

Copy URL Twitter E-mail

General

Target
Utilita.zip
Size 21.9MB
Sample260713-v2d3rscy9k
SHA256 70cf86af4ee9f9849374b43a348b8b2413cd2e0dff5de1aa63b3f83476a7ef53
MD5 06427d5da85858822eaf0813927da082
SHA1 f14c3a4cdda237d8bb889d23cdbac57269e975d1
SHA512 60d8aae861ee7a8f039b9073dd654bf2290a448dce3f8b48505dc5fcb38abe69b2ccc1482a177f96300cb01c2a46c703f2a58d372b3976a31d3d1f1253f60e9d
SSDEEP 393216:mLQpDYkqEcEnd35dsWdh1mX8uDj+rWwXrL+T4xgzdsV36LLcjSxYrotsfKk0gpk:0AaEc09EIhErDufXrLXgzdsCLce6rot5
TLSH
T1DC37333F8415F50DCC08C671E75EC95EAA30AF539B9B8642B1539BA5331F0AD3B1A4B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

costura packer

Malware Config

Targets

- Target
  Release/ALFACSN.exe
- Size 14.2MB
- SHA256 6791b82635916387335cb9f01ca6e586bf8c9cd9c35d4c15ae7c72fd81c592b2
- MD5 0f4af39835712b7e83a906a8e7346148
- SHA1 81b916c4d0b0d87419e648caf7f7e5cdafd897b8
- SHA512 f6bacde5937198dafde1816fac95b76fb8a5ae3c567bf75a4cb1ec39ad67e0ffc8bcf8571d5fcc0f6c7e23a3041dfa4c9093e037e5b69b50b968006d8c656991
- SSDEEP 393216:H4qZHvz8v5BHuYJWZHvz8v5BHYuJIOnouJIOnLtMv4Ljor0JQR:YqZ8nHuGWZ8nHnRn3RnLtDjor4+
- TLSH
  T1D4E6331EB1A0CD0FC8248338499ACBFC277127D37157E685956178EE69EAF943D6308B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  Release/Confused/ALFACSN.exe
- Size 1.9MB
- SHA256 b2f74dc20536f241d904d7274e676e626a8a904a840ee0479bede810ba4d491d
- MD5 b73d74f411c490d3e59f93c55fe7413c
- SHA1 2f829d35d97e66ac9328648a9e78a95b47239834
- SHA512 93d562b16e858d5270d254d233991f8c197c32dc9a2eaf38f92caee80f24d37c09dc07f1158a28e2046998013efbeaa0ec14ff296442e218b342c1804162c601
- SSDEEP 49152:HvzA+3Nv/C/N4HSYTd/wMrOQSLG0vb4fLTzTNmOQ0Ojr:PzWCSYTd/wzv4LjwOcjr
- TLSH
  T18295224D72043C1FCC3A88F155256E99D3F2A527661BEBC26C8759DD26CCF868F0A4A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Release/CuoreUI.dll
- Size 538KB
- SHA256 dba028d1776f4af590461553111f55d6ac723e31a3930094c25e0645c6776ed0
- MD5 af9ee24c660094c6bc4e2531e45e5296
- SHA1 0b1d7f5d6e21752b87e3f5bb0ccaa6782c138994
- SHA512 6e87bcdea36b8e9f62bc6b8734942b34d9feb57e4c92cb1841f4e974e56f1569c2b6f5518594b900503dc707011a388acb66571fdbcf1fef1214f3c6c8adfe52
- SSDEEP 12288:pT/WOn7Pl4sNN+XXImp+9o3HTuYfpIww87+tU7sXOz/Rfxyg7wIyhHCy:p94yQHPAezRxG0r7sKx6Iyh
- TLSH
  T1F9C4AF303318DE2ED57F077A909B9A91D7F19246721EDBDC5F80D0FC2A92715A2262E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Release/FireSharp.dll
- Size 40KB
- SHA256 ff23e74a4c3dce34982b35f8cfb0e2bff1659c400595dc5506b7bb86dd4a063a
- MD5 7b16302d15b551c845666a53161f51a4
- SHA1 7bef61df6037dc38fe2e727e282adf84057e3572
- SHA512 c91bfe80b1e0c093e7cf9817c3c8ea7197ebee66bab83d1549376a89835e5b235cda1a3c5024303ba28fcb46d42301a6654c0029fcbaff53a932db3deb5b9a1e
- SSDEEP 768:AM5txQcWLPeVIxr5OlcnD9+qDcuFW44JPCXw80a+AyItz+jFXt4j28:j5wOl3kc7LCDdAjt8
- TLSH
  T11F030849239CD633EABF5BFE9861870143B6D656A813EB8F1D8CA9F838533441C5439B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Release/Guna.UI2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH
  T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Release/Microsoft.Bcl.AsyncInterfaces.dll
- Size 27KB
- SHA256 f89f62aee959e03cfc50c646d38b50085c5862cec86f519254dbb7a3381939bc
- MD5 d2c3ccc2a7e89694d95de651be7f34fc
- SHA1 fb438847f188118a8d951a74fcddb581472f6830
- SHA512 195976a969be1014314016806e93633802b6605e5777bd1db7cd8a07f9b50dd3c0e3a14f26f962c370187ea8ca0f233d894546af12a21ca93dfe7cb20fe211bc
- SSDEEP 768:CuwIOTx4Z22LwJEFUYHLzdsDjQrr9znP8:ClL94lwOFjHLzA4BzE
- TLSH
  T101D26C61D35C8323CEAF2FB5D964D9812E79E3862C32DA3D128CF2560C9B744A635338
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Release/Microsoft.Threading.Tasks.Extensions.Desktop.dll
- Size 46KB
- SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
- MD5 e548a93d16964e52868c47cef1c98f2e
- SHA1 4b96b0aa48f6ac050a764c7d65f4129a9bb8cf21
- SHA512 fd1377b5d2d792eccf2ab9a01529838f178126fd6748da8e27cbc908ea83813fb4de021aa88989186459fef1c11be76aaf8b29b2291203d5f34f98361acf77ab
- SSDEEP 768:bsoKLggFUyETHj0Y5m64r+B6yP5wwWGZ8iJvHWrI:DKUgSyyD0Y5tVwwlZ8AWrI
- TLSH
  T1D4236D95C728957BCB463674EAE4D1825A34C7C28902DBAA3C99F0F5146B7F84B103BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Release/Microsoft.Threading.Tasks.Extensions.dll
- Size 30KB
- SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
- MD5 6aa2393ff1fde1a61d0cf51730428f74
- SHA1 3c847a95a6547aa49919789d7a0cb6ed76122849
- SHA512 1af984ec56885cdea9a0e379d659b65196713571377e2db267259dbc1f8748f1a610b0183a8fea3730f0049c3468f632240475730563c6413cbc88cc76032d91
- SSDEEP 384:5qL9uaxv+fg8SA4nrzrRzoGbSOW12nWH1q//0GftpBjHoH3HRN78xLsltr/wn:+MfmrRzZ+QD8idoH5r
- TLSH
  T14DE25BA1CFAC8143CD4B7D71D7A4D6C36D39C7E29C05DB66188CF0B41C973D99A20AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Release/Microsoft.Threading.Tasks.dll
- Size 36KB
- SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
- MD5 d01819bfe03222dfa9e35a36555b6b6c
- SHA1 25f8069590b14724f28e6a04b8a42e4ef4a8562d
- SHA512 e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
- SSDEEP 384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
- TLSH
  T1B5F27D89C3BC4117CEAB1E7196A4D5432E38EBC34812DB196588F2E51C937D19F3266E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Release/Microsoft.Win32.Registry.dll
- Size 22KB
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- TLSH
  T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Release/NAudio.Asio.dll
- Size 33KB
- SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
- MD5 01a76191d31b3d6042484e452bd66ce0
- SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
- SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
- SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
- TLSH
  T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Release/NAudio.Core.dll
- Size 183KB
- SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
- MD5 4e4302ce791e48f985a3a221a19a272b
- SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
- SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
- SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
- TLSH
  T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Release/NAudio.Midi.dll
- Size 45KB
- SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
- MD5 f6940019dad6c782bcb645c2f7d52db5
- SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
- SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
- SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
- TLSH
  T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Release/NAudio.Wasapi.dll
- Size 176KB
- SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
- MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
- SHA1 6dbd30a9216590d012a7feb802831f538345756e
- SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
- SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
- TLSH
  T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Release/NAudio.WinForms.dll
- Size 33KB
- SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
- MD5 115137414b41a26d6e73738cd94c036c
- SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
- SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
- SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
- TLSH
  T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Release/NAudio.WinMM.dll
- Size 56KB
- SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
- MD5 c1b78af3d6402be8f259dbbe9250e7fb
- SHA1 98e2c38597c50390852801d46ff342889c7351ae
- SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
- SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
- TLSH
  T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32