a9ca77dfe03ce15004157727bb43ba66f00ceb215362c9b3d199f000edaa8d61

Sharing

Copy URL Twitter E-mail

General

Target
PSTools.zip
Size 5.0MB
Sample260713-w3929sd16n
SHA256 a9ca77dfe03ce15004157727bb43ba66f00ceb215362c9b3d199f000edaa8d61
MD5 41ebdadc06b18164dc571f9db251c01b
SHA1 ddfb009f8b92226aa45c467f8d0eebb29a8e2ff5
SHA512 263fb743b410f4fe5ff163e6435606b98087bd42e79ab82d1705cac32d93c31df6ecef9bcf6d9e0a344387184e3910f34f26ff7848e575b5b97019d12f7e0316
SSDEEP 98304:w8SK6YhPu87Ci2jqrAAQiu9fffhwqZ4qxIL48xtg6TK/nUjqbprp7sg:wU/h3h0qrAL9fCqZO1Kycbprp7P
TLSH
T1B936332DCAF177CBB861867F3F063818993A572876195CF587BCA88841D91305ECE3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Targets

- Target
  PsExec.exe
- Size 699KB
- SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
- MD5 24a648a48741b1ac809e47b9543c6f12
- SHA1 3e2272b916da4be3c120d17490423230ab62c174
- SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
- SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
- TLSH
  T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  PsExec64.exe
- Size 813KB
- SHA256 edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef
- MD5 db89ec570e6281934a5c5fcf7f4c8967
- SHA1 0098c79e1404b4399bf0e686d88dbf052269a302
- SHA512 c0b9723c1ebe946b7bfb36525dcc6063518c2a534ff5a9921dd84e3dd519ab670b83bd70cd4ed78843a411b573b9869b8fb527f8bd67cfe9fa7630717f6cad30
- SSDEEP 24576:szZTjAVZibdc56dh0lhSMXlGTEzGASe3n1/:0ZTkZOcbyEz8e3nJ
- TLSH
  T13D058C1173E505F9E5B7A6348CB64616EB737C050B30D69F03A4866A5F33AD09F3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  PsGetsid.exe
- Size 403KB
- SHA256 a48ac157609888471bf8578fb8b2aef6b0068f7e0742fccf2e0e288b0b2cfdfb
- MD5 3d4112b92a8285d8661bbc29125bdbf5
- SHA1 38b53a8767a1c0d7ad774548780e5e071fa0414a
- SHA512 5b250a6e29a12bab1d8b5e332dfc7d7fad1a6a96d2d065a176a7f47688e05bc6fc2b3de280c182b681276162942838b4c868aa8f87316f7f88fff763df9be74e
- SSDEEP 6144:1avXzmER+DOtMat59yLCJyrspAanZDAOg70vyLqN25hJWkTZPThq1Qecz9:iXR+DOeatPAVaZfvyLqi7TBTo1Lcp
- TLSH
  T152946A11B6E18432E4F72A3019B4A7B55A3EBD705E34D99FA394467D4E70BC08A31B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  PsGetsid64.exe
- Size 494KB
- SHA256 201d8e77ccc2575d910d47042a986480b1da28cf0033e7ee726ad9d45ccf4daa
- MD5 c2b0f2de5955aaa313999ff20b675be4
- SHA1 15eb06d96700387c1eb7214841cf6a1cb667512d
- SHA512 0678b079f6daa08dacbb56380ce093719134565adadf4ff905b08a83875c1e703b99296f4c6b9103dc9139528b4465a02c8277cfc29970f6e645a01716218da9
- SSDEEP 6144:V361fygi7BtFSGMiSpoVCMBKE7aD8JtoWohb5ySWXa76Gmq2XSEVf2PgM:Jwi7LFSXiOahKONoJw676G9vEeX
- TLSH
  T1D7B46B15B3E500E9F5B767348DB15646EB32BC524B34D66F13A0426A2F33B909D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  PsInfo.exe
- Size 432KB
- SHA256 951b1b5fd5cb13cde159cebc7c60465587e2061363d1d8847ab78b6c4fba7501
- MD5 2691d7f266050e6849793d4b6661dddf
- SHA1 7f66f109db5f30e17bc4a6705acbcace123c2765
- SHA512 467253dce2c3d4cf50fdf42a094307d97988fd2a8f01f1f58aeb9406c5a3bfb49fe5ba238dc3b47e79f88dd8be8cc71e5f23553d0b3ef21add959f9462643707
- SSDEEP 6144:sThlh7njzvX/XpKNHqCroZjtAAOS727nlSsSb8dpyk+b1fYXwj:g/T3X/UKokiLbcsS9Xtawj
- TLSH
  T1E1945A10B6E08032E5F72A3119B49A765E3EBD715E34D99F6394067E9E31AC0CA31B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  PsInfo64.exe
- Size 523KB
- SHA256 de73b73eeb156f877de61f4a6975d06759292ed69f31aaf06c9811f3311e03e7
- MD5 86a65cfa9f258b0a46ed54e1ad235078
- SHA1 e65d43d47fc1cab8359906711631beba78ab23b5
- SHA512 799e21f9d24f36184f7d148696e25f88c7fab629f2e5b06644993fc1d798e5116f3e66159ef2f3a497785c252229f82ef841f5f1f9c6fd31e112d0dafe2582f2
- SSDEEP 6144:BEpZceA9Bi3brLRSA0oIyd9MOI0Y1HQmZohauQQhsWHGZ8PgdJB+NMJQMnprK:BRBObvRIvyd5Yo0uQQhHi8Ydz+jyp+
- TLSH
  T116B46A15B3E500E5F5B76B348DB58506EA327C524B34D69F03A4826E6F33B909D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  PsLoggedon.exe
- Size 148KB
- SHA256 d689cb1dbd2e4c06cd15e51a6871c406c595790ddcdcd7dc8d0401c7183720ef
- MD5 e3ea271e748ccdad6a6d3e692d6f337e
- SHA1 f02e06bc439a28aad6dd957df8d0022f22798a09
- SHA512 07a47cb6c2663219f0673647acb01d8d5a702b5e14f40c11b1dcebb3655c9d1825d9f6f2c23dce1fc73cd2ab10565fadd19e0b18e63d51c44498b5f159215503
- SSDEEP 3072:GJsH2jYVvmuOPybZUFS37ED65lx50kKXRlED:Ej3wIYZNR
- TLSH
  T1F9E3071173E58074F5F32A3069B886621E3EBD769E34C54FA358524E0AB2BC0DA35B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  PsLoggedon64.exe
- Size 166KB
- SHA256 fdadb6e15c52c41a31e3c22659dd490d5b616e017d1b1aa6070008ce09ed27ea
- MD5 07ed30d2343bf8914daaed872b681118
- SHA1 1f5b5e40c420f64aa8e8de471367e3decc9763cd
- SHA512 4f410a52c3a91174086990d4f827842514946874d9d65a71d2716258224cb28df7214602a84ea062747e1406cab15e7cd4b61c6660bc2a7e756031d83feb85d2
- SSDEEP 3072:2CU/1bZRbIWLbJ+YdTcSio3qXatOg2X5UFyHYoWOwVRxnYs6aJcqRzE/Ma:hQ1rIabJ++TppMatOZqAL0+Ma
- TLSH
  T146F3395223E840F9E5B36B3089B19655AB3B7C665B34D74E125440AE4F73B90EE38B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  PsService.exe
- Size 261KB
- SHA256 d3a816fe5d545a80e4639b34b90d92d1039eb71ef59e6e81b3c0e043a45b751c
- MD5 136f9205a5945681ec470b8461dfee5f
- SHA1 1ca7e6ac6128bb1f4e0318a28310525baf7c67c6
- SHA512 a3eaf3665bc8a227d139fb0fd6032c1510288c3fa41a50ee5a774301f88491fa69297c437b4ddec1a0df18ba5085c9c5e61254bfcbd38fd3b5f7c4d074ede142
- SSDEEP 3072:e4iIB7s+H1oGlMqE7PbxxY0X8xR1O4yjXUnJfELaQdUFvJPKg+SjWAg0FubMr/vV:e4p7sG30xTX8tajKJGa5pIAOCvM6+e
- TLSH
  T1E0446B1172E18432E4F32A321DB497661E3EBD614E35D9AF5798096E8E71BC0DE30B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  PsService64.exe
- Size 314KB
- SHA256 554f523914cdbaed8b17527170502199c185bd69a41c81102c50dbb0e5e5a78d
- MD5 657c2da84107644a1397d49e0b526f24
- SHA1 5c9ea381169e745d68e717cb7ad4adbf6afd6391
- SHA512 f71064bbad6aae5ca94da9f49d672d04b9e1435f9e13b724f00afd2213cab402f407e71fa18817fceabdcb7c114c32febec35f39cde70c3e3c3f096e8f94bc4e
- SSDEEP 6144:DG1HIY/dt4hEotTabamlJCqTH7BXohll9vGfq:DioWP4eoA3lJT5ovlt/
- TLSH
  T111646B15B3E500F9F5F76A388DB19506EE367C564B34D6AF13A081692F33A80DD39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Pstools.chm
- Size 65KB
- SHA256 2813b6c07d17d25670163e0f66453b42d2f157bf2e42007806ebc6bb9d114acc
- MD5 009ac2be60f92dc2c41b094ce2d3857c
- SHA1 2fe7a164b987856721fe43eb174090cf69afad54
- SHA512 85cb0156b5852728b4ba30960a45143a34ccfcec7faccfb9c0e6c03cca2a3a03ec792345046e82ee21a68ae75ed221936c43da2a35d6729b23cb2a75551a5ddc
- SSDEEP 1536:L8G0S3fJmn7Mj3vwi7K3yC2mlyxYtVrRd+uwA54tC:Y/SB4w3PdC2mwxY5d6AyC
- TLSH
  T1175302B48F66827CC861AFBF7FA3EDE06D5876107F24505381662D65532CB5300A82F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  psfile.exe
- Size 229KB
- SHA256 4243dc8b991f5f8b3c0f233ca2110a1e03a1d716c3f51e88faf1d59b8242d329
- MD5 a0c7585c86ab8bfe6d55a2547e7c9382
- SHA1 c9088174075b01dcd28046441f67f9a7172d113d
- SHA512 166ab0fc420449f716ea2a568e245e6e447a1638ea1b8a662ab685f9f54516fc8c216fa559897e6f9eaf00a8eba704c18906ccda5eb438dcbb166fa9493ec099
- SSDEEP 3072:34fm+gtYL7MyTrtLJNWYAnhzqZ31CRtcNRAaJBeCx/b6dUFSOTm84LQ2Ag0Fubfh:ofmDqZFCRyhJECx3LoL7AOtQ0hvWa
- TLSH
  T14134591176E28432E5B32A3019F49BB55A3E79715E34C9AF63945B7E4E31BC08A30B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  psfile64.exe
- Size 282KB
- SHA256 be922312978a53c92a49fefd2c9f9cc098767b36f0e4d2e829d24725df65bc21
- MD5 880ed8c97e6bdb64a342fad25094049b
- SHA1 253ba984e247c640fa2c6fe1f93cafdc2d1df573
- SHA512 8424a12532223b7d28ee31a293de01be6a08d01e6abfb8a63c66f6a112d7d296738e184e50e2935311e166e48acfc68878fd1eeb4f773517acd5370f48d1a446
- SSDEEP 6144:1KSK5nJaoeoR1tVpFZ1ADrcHpYbWMMYe82hJohOHEeFy:1K9nLeoR1tVpT1mAHpYbuJooHi
- TLSH
  T102546C15B3E504F5FAB767388D719546EA727C414B34D6AF03A0466A1F33B908E3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  pskill.exe
- Size 381KB
- SHA256 5ef168f83b55d2cbd2426afc5e6fa8161270fa6a2a312831332dc472c95dfa42
- MD5 5801303c49e5bb612aa55fb8b909a9c9
- SHA1 b9cf22418a5c45ede9fb44680fa7f3d90a1e0bee
- SHA512 1d0f97cb61320bfad6d4a4a3f47f6feac8c57166a1dfbf3aab1da705e8739a1250cb5930403095a23ad1a8fc5b119a63f55a2218e1bcf2718c881f8f2b501c30
- SSDEEP 6144:erJT3E2vJM6rZ82ywZnVXxm9AOWDTaKC1CegGN85SH5dmIYL:eZ0eJM6rDz2CaKCE1IZwIYL
- TLSH
  T1AA845A11B6E18472E4F72A305AB4D6755A3EBD714E34D9AF639406AE0E70BC0CA31B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  pskill64.exe
- Size 465KB
- SHA256 7ba47558c99e18c2c6449be804b5e765c48d3a70ceaa04c1e0fae67ff1d7178d
- MD5 ba9345119c1175c96d27370b0d203e70
- SHA1 aeb2a53e9c8730c2cbd15d620c001d0501e4bb91
- SHA512 504501c7c6d415a4ed66bf39827164080e093725d498de6b69a643c73e227392c127f8ab026587bce9d0c5fe9d3dd3d25c3d236d10f2dd38fa309d7d97606a7d
- SSDEEP 6144:ucOvz1jiG+NSiKy9Uw/n/BcH7oNC5ohCe0pgaik3CCABtnVpTwXsu:fAJiG+NlKWTv/WHjoP0pTyVtfM1
- TLSH
  T1CBA46C15B3F504F5F9B7673489B19606EB32BC524B34D65F03A0826A5F33A909D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  pslist.exe
- Size 212KB
- SHA256 ed05f5d462767b3986583188000143f0eb24f7d89605523a28950e72e6b9039a
- MD5 6c08bae0981841e0cd22ff0f0e8f7510
- SHA1 cad5355c534cccf48ca8df5a1007cc34d37cb619
- SHA512 1080d9e7d3151122518c8ecc09da061086f1d490656f26df99153ddd3f933da049a8364af28fa104da54089271625f229007989a2dff713782066bd8fa142c25
- SSDEEP 6144:UJTVdqTvShLDFQUH9To/JPjDXDzM/P77U8lvfhC9GEPyg:KPkQWdPjrgDJlXELyg
- TLSH
  T1D5246B21B6D08432E4B32A305AF4D6725E3EBE715F34D58F6394067D0E21AD2DA35B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32