fb46493660f101de3bc8e4ff19f524b6e22d09ebb75bd6f069bf672445877b39

Sharing

Copy URL Twitter E-mail

General

Target
HarmFulCityNoSongs.zip
Size 833KB
Sample260719-2p86psew5q
SHA256 fb46493660f101de3bc8e4ff19f524b6e22d09ebb75bd6f069bf672445877b39
MD5 cfe617a9ed21e9fde1adbcc49bb7037c
SHA1 09ec1875f599e611a75d01580f4178d78f3bbcf0
SHA512 365c0628fc0f8f0ace1dd38a2e4f840364969a233d072ae1041ddcb2e6ef980c8e6ba68da375a6f35818d6926c8da4806a3cffa84543317d2801f15e4bf5b0dc
SSDEEP 12288:ghz+9WiTWuKZc+HEqbDZ/9DTeEixmdq+TKd/CWnG9Z1PAnJSkAF9TlH8w35zJi7n:gVCj1kDZ/9DTS+leGFwAXlc25zIb
TLSH
T1D105338B18AF7FDA3A796BCE4CF122E017058F5F584118E1624E76AB41F7253A3814E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  HarmFulCityNoSongs.zip
- Size 833KB
- SHA256 fb46493660f101de3bc8e4ff19f524b6e22d09ebb75bd6f069bf672445877b39
- MD5 cfe617a9ed21e9fde1adbcc49bb7037c
- SHA1 09ec1875f599e611a75d01580f4178d78f3bbcf0
- SHA512 365c0628fc0f8f0ace1dd38a2e4f840364969a233d072ae1041ddcb2e6ef980c8e6ba68da375a6f35818d6926c8da4806a3cffa84543317d2801f15e4bf5b0dc
- SSDEEP 12288:ghz+9WiTWuKZc+HEqbDZ/9DTeEixmdq+TKd/CWnG9Z1PAnJSkAF9TlH8w35zJi7n:gVCj1kDZ/9DTS+leGFwAXlc25zIb
- TLSH
  T1D105338B18AF7FDA3A796BCE4CF122E017058F5F584118E1624E76AB41F7253A3814E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  HarmFulCity/HarmfulC2.exe
- Size 3.1MB
- SHA256 a208e3884520066e119fb0283bb8f38995a191e31377de88115c1add376329a0
- MD5 70e7275190433ac4dbdfb286eb5cf99f
- SHA1 2a9f461730aab22f882d8748de08e12a7ab303b1
- SHA512 59857ac9af6310a893043a7826cb18bd3a339e21a098b4bfe43f87d1148e32c095987d2bb8efc3f95d1c5df0171faf4d4cf314f62d9494ec842d23ee2d65d8ee
- SSDEEP 24576:hUrMa6NGGhorWpUr7gyGXdNt9T9ZeJSDYk3AMFMC5:sMa6NpKdr7gPHfqS5Az
- TLSH
  T1ACE5D917F7B651D1D1BAC038D553622AFC7134A6833897EBA2C18E461B60BE8EE3D741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  HarmFulCity/bg.jpg
- Size 34KB
- SHA256 713b0c42ef532e487b92dc1e72d2b1a05df28143eed5b9e0d36cf29d7066b1fd
- MD5 ca4a3921200347b8f03abe707db7fbe8
- SHA1 8e98a20a5591889bd58e2f5ffda6ac2ec85764ac
- SHA512 eed265254fc3042017606d759dcb898b1e0e8fcefb12ad533db95e07351ea6c3611f14edc92821ca8b1f76b65d4fd0ca74a6e6e013b6e797db496b79b34c0fda
- SSDEEP 768:gYyR71CAOSSYRZUFxpvzuW/FVQuSCYTQyhHIDVSC2U:gFZCAOSS8S/Qu+MhRSCZ
- TLSH
  T1CCF2E1F633AAC7E1E5A5CA3804AD0365B2D5DDE6F247B64D6119E137002B2B11FCA487
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  HarmFulCity/icon.png
- Size 58KB
- SHA256 42ed040ea6aaa04bdc8f99ce005b1c4c837acf4e492fe08b8990a576723ad669
- MD5 d1886910829b95f0fb2b0db654fcb0fb
- SHA1 5850c3a0bc3e165f3bf943aebf3285c55c8572bc
- SHA512 efaa01153e717fe3b11059a43ab5fa7239ae2d6f98bc80a9b9086f8fd84c0f7040a8ec1262494ca8b7819fcb78fd5ea4febdce5e578e1a28dea21fef909dcd30
- SSDEEP 1536:G5DkMuukk+uu8/yGfneOzYN5JuAiX3JYDmBemfiTZD65Apm:I7eUqwnhzK5eXqDtmaTZTm
- TLSH
  T15043018D6DC0D27AC492149838ACFD41DE93B8DD9731B25542CD257F6B06AC3B2C77A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8