31d6f080dee4e86aa08a9ef73c216044c9e046724310b97dbae15cd95d138b15

General

Target
31d6f080dee4e86aa08a9ef73c216044c9e046724310b97dbae15cd95d138b15.bin
Size 936KB
Sample260714-y7sd5ads8m
SHA256 31d6f080dee4e86aa08a9ef73c216044c9e046724310b97dbae15cd95d138b15
MD5 2e7448263a0543c408a5f3595ee750b9
SHA1 24679b128550bfbafe65dcf6097a695b8b33bd24
SHA512 48d460c712f96287b575f7b793fc401a500bee5520431b1ced642abc66f63df367873630d1be81de3c540ee8618204b5ba136af8e9d4e6cdda8dab652c0a3371
SSDEEP 12288:frIDaM5mgM2v5BIY+ZltPPBRXI3q6VsZ2cH6/9D0IhVvvTN64E:FuYBVI3ZVsZ2caF4Ihpw
TLSH
T1A8157F29A66801FDD1B6C1B8CA564902F771748703319ACF03E09AA77F2B6F45E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  31d6f080dee4e86aa08a9ef73c216044c9e046724310b97dbae15cd95d138b15.bin
- Size 936KB
- SHA256 31d6f080dee4e86aa08a9ef73c216044c9e046724310b97dbae15cd95d138b15
- MD5 2e7448263a0543c408a5f3595ee750b9
- SHA1 24679b128550bfbafe65dcf6097a695b8b33bd24
- SHA512 48d460c712f96287b575f7b793fc401a500bee5520431b1ced642abc66f63df367873630d1be81de3c540ee8618204b5ba136af8e9d4e6cdda8dab652c0a3371
- SSDEEP 12288:frIDaM5mgM2v5BIY+ZltPPBRXI3q6VsZ2cH6/9D0IhVvvTN64E:FuYBVI3ZVsZ2caF4Ihpw
- TLSH
  T1A8157F29A66801FDD1B6C1B8CA564902F771748703319ACF03E09AA77F2B6F45E7EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution pyinstaller
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2