f3a74bed32a2e2b95e6032d32744cf7b51eb3b2939b9611954de4c1ee1d7f85f

Sharing

Copy URL Twitter E-mail

General

Target
f3a74bed32a2e2b95e6032d32744cf7b51eb3b2939b9611954de4c1ee1d7f85f
Size 16.0MB
Sample260718-weax9sg18j
SHA256 f3a74bed32a2e2b95e6032d32744cf7b51eb3b2939b9611954de4c1ee1d7f85f
MD5 9c13768d25c8142d21f5cc4116405f9d
SHA1 ec3b5a18be04855103366b00f85a4547f430f068
SHA512 b90420145e56ffdcf1f6e33803701b5cd1751657b09de7b12ead066b29613b1ee898a3695faeda90b2f0bdcee62e89e727eadfbdc4793c2dea3d2234bc17c623
SSDEEP 393216:fHiRimklNRbHjaw4z6y5f3TFIHiRimklNRbHjaw4z6y5f3TFjq:fiRimwNRb2NjgiRimwNRb2NjA
TLSH
T118F6333A164EF78C1BD8E6E5BE6178D3C913CB6C12C51E804EF65B0B59ECC7281B8946
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  HostServices.exe
- Size 20.2MB
- SHA256 0e162c85e04ff6c6b3e5eebbd0004c4cccb565858c487d03fef122f789278221
- MD5 28886ca8b0df7657520d5240540c741e
- SHA1 ee5cf6f90a0318b2b1ca081778bbf89430fdf3bd
- SHA512 eade96c73047daf11d315f9b43a723e4b3f44c17aa69311b5faffc87229b18e0057b84b5e0f557b5cbc854ab5a889d85f1e3ed8d243fc1fb930cfcf440993943
- SSDEEP 98304:S/AK8zo+kQ+X4xzTiqQ6Y4nWGh4c8ELFNHbdPDZArGIe4KsY78iRJLAKqgb3qKIL:YARMaY4X3RArkZsY7agb3qAmmhA
- TLSH
  T1BF275A42FAC706BBDE021571C6AA539A2735C9005FA7DBC7E600BA3DF8732964E76344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  psclient.exe
- Size 20.2MB
- SHA256 0e162c85e04ff6c6b3e5eebbd0004c4cccb565858c487d03fef122f789278221
- MD5 28886ca8b0df7657520d5240540c741e
- SHA1 ee5cf6f90a0318b2b1ca081778bbf89430fdf3bd
- SHA512 eade96c73047daf11d315f9b43a723e4b3f44c17aa69311b5faffc87229b18e0057b84b5e0f557b5cbc854ab5a889d85f1e3ed8d243fc1fb930cfcf440993943
- SSDEEP 98304:S/AK8zo+kQ+X4xzTiqQ6Y4nWGh4c8ELFNHbdPDZArGIe4KsY78iRJLAKqgb3qKIL:YARMaY4X3RArkZsY7agb3qAmmhA
- TLSH
  T1BF275A42FAC706BBDE021571C6AA539A2735C9005FA7DBC7E600BA3DF8732964E76344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  pslauncher.exe
- Size 3.3MB
- SHA256 16d31212c38f9e0791f93b95bbe49e72aa831211e0b011118060fc5feb8d6b1f
- MD5 6f829d71d811867f760bca1743c8be4c
- SHA1 901b98ceddb04ad313182ce7104a3df14fcec702
- SHA512 4e160e32f3b0a2d9c1a612a2d2ad37ca793213ba7aa236fad3f335d6fc4c6ce0099c9e8d80fe64234623c4fc8f837e054707cb8d0a389bb8ae024ff7e4f845a0
- SSDEEP 49152:N/vqFE/FULu2sebVjtBrhawFVE62WAE9L18wb:Zv6OFh2s0BlawFq62FuW
- TLSH
  T118F57B45FD9785B6E902263694AB626F23349D050F36DB9BEA107B3EFC372E11836305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Drops startup file
behavioral5 behavioral6
- Target
  watchdog.vbs
- Size 310B
- SHA256 752936a9bf3c335c90fe543eb9a611c645fe62444d188db06940d2fd4ec915c3
- MD5 418251d1064e31c3f1c4033316f1e5e5
- SHA1 eb8452648b1103affe5f7e606d1cf7d9b2cee1e8
- SHA512 bc15ef122ed718abb4ebfe823d9a5bc81aaa2daf8adf00554bcb7c5feb5316d32f25c4b5e95d6077dc43f6d7bed8a42cedd79907d90c45153bc19dd3c23afe0c
- TLSH
  T157E07D03701FD1F4007615C326F2306B9DC1CC0523BC6139ECBAC4191B0854D5A9C0B3
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8