cf8e3e77855ad2be9e0caa65340655bfd19a259fd62ef8a245a09e236422b097

Sharing

Copy URL Twitter E-mail

General

Target
Weed-Hack-V1.rar
Size 78.8MB
Sample260718-e4v63abw5w
SHA256 cf8e3e77855ad2be9e0caa65340655bfd19a259fd62ef8a245a09e236422b097
MD5 9e34e317ebb751c3f9506ded56ff50f3
SHA1 9989161e85dd324b753f66fa9047cc62f885b0db
SHA512 9bcad50eb0f3b49c702a5bc0823262ef1ea667d83d42b6533f725d2cc5209f6e3a3fe567b5af9243805df81a5de6e3d9284dcc4f238660294ac54ee7aeb2fd44
SSDEEP 1572864:/gffKUejNWsiZXW0LArBHLATDk2rVNjfzWoVNEI8E8UXdl+lBsOihX:/gfyUE7iUKAFHLek4VNjzzyUXdl+8hX
TLSH
T1650833C31A7DEC2B866FCD525CDDD9ADA6D00B38EC369A4201E606375DEF7533858A80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Weed-Hack-V1.rar
- Size 78.8MB
- SHA256 cf8e3e77855ad2be9e0caa65340655bfd19a259fd62ef8a245a09e236422b097
- MD5 9e34e317ebb751c3f9506ded56ff50f3
- SHA1 9989161e85dd324b753f66fa9047cc62f885b0db
- SHA512 9bcad50eb0f3b49c702a5bc0823262ef1ea667d83d42b6533f725d2cc5209f6e3a3fe567b5af9243805df81a5de6e3d9284dcc4f238660294ac54ee7aeb2fd44
- SSDEEP 1572864:/gffKUejNWsiZXW0LArBHLATDk2rVNjfzWoVNEI8E8UXdl+lBsOihX:/gfyUE7iUKAFHLek4VNjzzyUXdl+8hX
- TLSH
  T1650833C31A7DEC2B866FCD525CDDD9ADA6D00B38EC369A4201E606375DEF7533858A80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution pyinstaller
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2
- Target
  Weed-Hack-V1/WeedHack_Injector_V6.5.exe
- Size 78.9MB
- SHA256 917edf4ad4984f6ac0d4622fdf8a47f2cc60d9bdeca8a38de6683dd50bed4920
- MD5 4ef37fa189dee0ec123f96f913b0b8d0
- SHA1 05a2e6c25a0ad6833916e4d839e3c2331a491c45
- SHA512 73753eac7d1b9d7cbcf33b1a03a803eaca91fbd66342e251e06478b2655f5f0c63a2c1d44751e3b1b08a5a086c7e2cae2fd6ea843a851c17e64e8c6c882953a1
- SSDEEP 1572864:wdY0XBsBtOVlQGR5qKm6Wbk4Qalo7AvnyE4Rhjln7bRB:sYZBtO75vPjYLHW7AvnylhjN3r
- TLSH
  T13708332176E072EDC44B463C9D039E884E5919E8C1BA58C96FD1830B2767BD34B9EDF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence pyinstaller spyware stealer
- Adds policy Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral3 behavioral4
- Target
  Weed-Hack-V1/config.py
- Size 31KB
- SHA256 36833596a09994925e4cd702ce02f9c17746505fe929f4c631594f686554eb1e
- MD5 5bb7bc28773c39e9152bc9ba5720cf53
- SHA1 622394fccb2107e9892114794ed06d905e363fde
- SHA512 d8d185963be23b1f286d4cb21d1d2aea3a1d254703e76a48ad6bc5705fe3220f5029521b0a06fd0095aca7c603fd59e2b02ebc7300aadd1c3ca112e54b5739c8
- SSDEEP 384:niZWhEuI+GerzvAM+FKsgY1JBR/KSMBX8WUlaX:BhzIQvIgYV9VP2
- TLSH
  T143E2B3778D5228363133CA2D8E1A9095E72EB7237639511A79BC70946FFC05082E0EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  Weed-Hack-V1/requirements.txt
- Size 30B
- SHA256 cf6c51c88eee6d6bfea34dd7d0111a53e9b73d72c6e02beddf2d8e1350497267
- MD5 b9e1637e29fcb3acb570bf10f28184b0
- SHA1 a7be370adab82d3a18d75e4ef093a83b09f5a0c7
- SHA512 5c133519a153d40cf65f71444561cc84e613525f2fc93c54809b36ee9c6b8e475b52a9f1c0a1c009ebb4d1fea2f6f6ba4523d0f68e48966d220974016a17d62b
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  Weed-Hack-V1/start.bat
- Size 2KB
- SHA256 7a72a7be29ec13f0f05bec5ec12ed5e0ad75dffe62af91bcc6052727246d05ae
- MD5 ea74ca8e0a00819a211acdd16c0bc401
- SHA1 2b5b4a92689587d5731f741211b4d7290388b35f
- SHA512 387ba3d8fcabc4ba8f688f9d37e2247a2837166edb23c40cc1eb711ffb503143fd3a1429678de61212086cce5bce6a563c595427814f1486539157f3a35c560f
- TLSH
  T16851CC893201F03936B4C98B89794166F727D0F702415EAEB06B8039DF6778271FA7A9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12