84f657b2315d64df0c1962155abe18c2cc5c1cd2af3f802fccd6b895f3824eac

Sharing

Copy URL Twitter E-mail

General

Target
84f657b2315d64df0c1962155abe18c2cc5c1cd2af3f802fccd6b895f3824eac
Size 1.4MB
Sample260715-193c8ae16k
SHA256 84f657b2315d64df0c1962155abe18c2cc5c1cd2af3f802fccd6b895f3824eac
MD5 c115d89bd5441a60df8f6cb7db785fa7
SHA1 30e022738ce8dc560ce2f249cc4dc39c0ed1eafa
SHA512 239ab9944c33ddc2d26ad299ae237181fda93ff58a47aa5784d5368d58cf91b0ff9ef7ee96c50cf9f3eb86546128418a63fbef9bd4f74672cb57ce13e632ab01
SSDEEP 24576:g7x2Q6IpL8+fGQYIYuqlk/ZfVIofdujVeIsvrMoN9dOXx5KH+7VsSB:wcIZ8+fGrIH/NzSeIsvIumsHyVsy
TLSH
T1216533B6E08E5073E52AC5B842077EF1112DFD28F4EDB6CE1900E5AD68924F05BF999C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
   /bin/Telegram.lnk
- Size 1KB
- SHA256 f84f30a7263e6d7c7f0836aff66bc42cda0efe80bfd386fc49ee776b1500c3fe
- MD5 80d55b093ba924dbf439ff6b0b490f87
- SHA1 bafd99f019746922dca3f05502c1b822058ddf82
- SHA512 dc02325f65efd4fe1d400c57775b46fb6fde421d50bb1fcb600706603ea1fa43f8197eb1ffeaadd1f0ac8ffa8c1df06a95b363825a6ae72d354bdd72fb4781d2
- TLSH
  T15211DC853FE95B1CF2F3927103B762A0837EF0241A51E28E40D4464A5C62D41A73DB6A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
   /bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
   /bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
   /bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
   /bin/winws.exe
- Size 199KB
- SHA256 31d68a175abebab19f7f39bf6d0845ec5c18ab653eeeea6ee830b22d799b7e55
- MD5 f94c4b0110feccd6aeca48c93b278d8b
- SHA1 0148ac55f074a602d37db9031a8f33912ad427d6
- SHA512 cc45b7029bbff2cad44faec5f3f4a96a23365007101be9795b2dc7ad1c0184402160ac13deb97ddb01547be7803d35cdd79d5ec59a750ac33ec2234e076d280a
- SSDEEP 3072:u6iE1/fe+JgV/uCUsnD23WDTCT4+4Q1aRw0SKcVsa4jNKcdJbIk6D79th2y/lJ:r7JgrUsdDTQFDVsf5KQxIk6ltz/lJ
- TLSH
  T184146C17F3D688F9C462C17897AB6333E931FC452124EA4F6F94DB252F61E10A12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
   /general (ALT).bat
- Size 2KB
- SHA256 ab60ec1bf1a2f9afdab0acb53f821a98b88298ed9f3fbba0b903a1c2ab31afc2
- MD5 13efb6478ce796a894804ec296b9d04b
- SHA1 03f3bebcbcbdfd962051405fe787dc8812965937
- SHA512 3e1f1c32ff9aea9d6e67fef1f8636e253d665e5a47ed3acc13dae8de336f04c02eccf8ec3f42ded18d92062c9fe1487dfa78c1380053e197dcd30f6b02a93468
- TLSH
  T1345148A7E00CCA47F2CEA53EF46FB5607127DCC369D6D802834A59F8DC4EDA9684E494
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral11
- Target
   /general (ALT10).bat
- Size 2KB
- SHA256 44c714516a7194eb63ec3fcd0aa25d51cddf602556b361e48bc0b91862224f84
- MD5 31fb88574439ae74c35265a9f065aae7
- SHA1 40ed0170cf4011e394551b92d78435cd4063d173
- SHA512 38b802993618aec29a54805fc7b7d80c76afd4ecf14f609de431a23851111daf16e87c724fd312066f11f12691eb6187f383d5a106628173fd1a363d4ddfd2f2
- TLSH
  T15B5148A3E00CCA47F5CDA93DF46F7660312BEC8368D6D402524A45FCDC4EDB9684E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral12 behavioral13
- Target
   /general (ALT11).bat
- Size 2KB
- SHA256 1426dc42d67dedb2ad91efab038fb0dc51fbb45f70eb608b36715682354ce0fb
- MD5 459c4743633174024ca6a5a65a0f3d26
- SHA1 73c9eebd3d1b5029f2c8068b545f3f9af534b351
- SHA512 b0ceae1255f7609376de2404a64316ac62015fdde7b7876d850478c8ea06d7bbbf58d7d135a37b2257feed3a0ef05da1ec6018292df84123e80566dfd14c9069
- TLSH
  T1BB5159A3E00DDE4AF7CEB53EF46FB6A53017D8C368C2D402834B49E8D84EDB9595A185
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral14 behavioral15
- Target
   /general (ALT2).bat
- Size 2KB
- SHA256 d77c227ca34f1f31e4eaac00d958e605b637162c0e2c87e7bbc796b3cf096890
- MD5 b8424de27a42629a1954ed279fb4beba
- SHA1 1099472b47cdbbcdebe116d671dd81513d5a2a69
- SHA512 7cb5b46fd85d23d52a0c6dd091fa835c5e295f7d8cbcdce65192886cbbd4074c186f6c1724bbf101a51f4dd766919f3d77400d55341157aafe4bfe526e22d6e4
- TLSH
  T1175148A3E00DDD4AB2CFB43EF45FB5A13017D8C36DC2C402564B49E8C88EDB9494E499
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral16 behavioral17
- Target
   /general (ALT3).bat
- Size 2KB
- SHA256 26cf029351d5a68096af5e4c4a6891eaa5ed4559fdeff1d720887061fd8f55d8
- MD5 dc4994fa7e9d3fc154a1214e82ac049c
- SHA1 8d44311b95ae158d1e1d5100f3ac28bbba43b0fa
- SHA512 1ad0ef7c099f10b5caf71c92b506c54ac5111b8e32d4d787371dc0ac9c6334d852660f638077193d3c44ddf77a8ce5f423c82f35bc55616ed7cafe85e5a30899
- TLSH
  T1FD518B93E00DCA57F5CEA83EF85F71606027DD8778D2CC41A28E09F8D84EDAA684B095
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral18 behavioral19
- Target
   /general (ALT4).bat
- Size 2KB
- SHA256 3fa57948a707b6f5b63283ddf62afdceaee284763d0f5b301de147bd367540e3
- MD5 c53b7427fb6671a1fb015bc5f4c8df21
- SHA1 293ba27b92563d429b9651342548f4d347563524
- SHA512 db29996a7a70272640b4ed23e65ea5be78a097079b8b5284662c0cbf106761d8a34143eefe09808319bf8e76d4a59bd2d911f7b12bb71ac4a70af9c2dbdd8010
- TLSH
  T118516993E00CCA43F2CEA43EF47F72A0312BECC769D6D442824A45F8DC4EDA9584E598
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral20 behavioral21
- Target
   /general (ALT5).bat
- Size 1KB
- SHA256 cdfd68723e7f8c434e79c864425a76faafc7ad27197118e1c42e433931ba6947
- MD5 fff169eb10dbe048ea6b7cb5c40cca7e
- SHA1 a40418321d5462f42c03ec70918ca058482d5da9
- SHA512 a6b293516764f769feea51e085d0ac3138dfa7089dec92ebd7d52abf06aa94803391c5bf62a6b97911da7d2deecdcab96ebbcb0901e15a661592a0063cc27ad4
- TLSH
  T1F9316893E00DCE47F08EA83DF86F75B1711BD8C769D1D502578A44F8D84FDA9984E498
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral22 behavioral23
- Target
   /general (ALT6).bat
- Size 2KB
- SHA256 553d5f383df415a5830fafc11a4402358083849a64237d600b7bdbc17437438f
- MD5 69bdd3855dafb9bf91c3abafc17ae57c
- SHA1 ce7cd8a2196df4ccf8609dcac89745b2cee9c69a
- SHA512 2e1143861921ca59de2edeb75d6c337f54d566aec7a0bf973fc57a197207b59ae15ffc989280bf1dec4c66407b9ec61925787de7562d491f1e37308322aa313a
- TLSH
  T1F45158A3E00DDD4AB7CFB43EF45FB5A13017D8C36DC2D402524A49E8C94FDA9894E599
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24 behavioral25
- Target
   /general (ALT7).bat
- Size 2KB
- SHA256 203ee71db10bbd877ff3eeb3218ece1e6662267030535f55af5ed72b45fcf2d4
- MD5 5558ec0e6fdd497bd8089b77fd62a258
- SHA1 9b426400555c1800b866153c05a8c7788bc8b2f9
- SHA512 bf45b15c2d45d174d179d10edef4beee05a3b27443aa674ada51c45c71e33603e23238b26c0faba8ad9f089f882b9afd61a902a2b9adff65730dcb375b6e347d
- TLSH
  T1054149A3E00DDD4AB2CFB43EF85FA5A17017D8C369D2C442524B59F8C88EDA9494E499
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral26 behavioral27
- Target
   /general (ALT8).bat
- Size 2KB
- SHA256 c3b23f88f3cd569f19cceaa24ea937d79395231e13fd16f8cc1f0c4eaab93517
- MD5 c3201604c1cfad42eccb0107813846f6
- SHA1 f95ced998d27ed53a4f49ce887be731f5c9ef5c2
- SHA512 3ac7f7b68a72f2b70d8121e20d81af1cd0f474192ec751300d4d1b7a4eeb0c550488ac917688f4f345e7ce63bc1dc7832f1ea3ce741feed15e667c047bfe7299
- TLSH
  T1E0415893E00DCA46F58DA43DF86F7270312BECC769D1C542528B44FCE84EDA9A84F998
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral28 behavioral29
- Target
   /general (ALT9).bat
- Size 2KB
- SHA256 cef3126fe83433b0a19e68f579b3e184b219930a0ff75efd12cdd2576bc65b0d
- MD5 037017c017c78763c7eaee07866774d2
- SHA1 fe40787b37be248d021de7d87f576a64a596cbe8
- SHA512 453d1b665e190cb7f5c3473d0db267edf072725c213abd8e62a37e17cd3d48b014b26925440e9735a0ed6e07ed346484b19650510dc22ecf1ebbca5ecc46bf5a
- TLSH
  T13E418D93E00DCE4AF5CEA83DF46F75717027D8C768D6C842634A45F8D44EDAA684F08A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral30 behavioral31
- Target
   /general (FAKE TLS AUTO ALT).bat
- Size 2KB
- SHA256 393746cafae0cda69b08bd63a26733a3600bf4c4439bc6692f260c6311027911
- MD5 23093e657db54ca4143ab9146f73034e
- SHA1 f9a98b535264598019024cff4a7d440d1f8366a3
- SHA512 089d1c00357e73cec9b74c609afc46990885551d000bc1f5815d06eba4d2a79ae29405c07ed459752d16031e6c9fb128f3df3944f5b34f19c8fae651ccd4a2a5
- TLSH
  T125514DD3E00DC947F68EB43EF86FB2607127DC8769D1C841925E44F8E84EEA9584A594
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32