e2f7049e7e50b837182ea3328fae7ec728af9a9f02d54230d3bcd807d4963adc

Sharing

Copy URL Twitter E-mail

General

Target
Debug.zip
Size 109.9MB
Sample260721-djsprsdt3n
SHA256 e2f7049e7e50b837182ea3328fae7ec728af9a9f02d54230d3bcd807d4963adc
MD5 37867058b23b4bed39c46b2835dfef84
SHA1 48041090729e1be925b03bf509f0b134292091d4
SHA512 6befda4954c9af1f37e513f50cd94c378cfe88c4c7bc8a092c410a97379cfff24e5176630b04bf97c99f1abef14c8615121bef71df117d39da1239cda6f5266b
SSDEEP 3145728:4DMYJE/vgtaRkVCJ3jvWhWHx7bo4o5/efMrq+4:4DMGQvPuCdE4dho5G0+
TLSH
T1BB4833E994F6A539C0B1F23CE3B31F34A17A454B732FA41BD2B438FC95A6AD97916400
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Debug/ZEUS Activator MEID-GSM.exe
- Size 3.6MB
- SHA256 b20bd7cf803a8b36f64853d4f4dcf5543ff8ae680bbf557ac9ab7f03888d5342
- MD5 385ec164913461b68291ada4af0729b3
- SHA1 5f0ef2486b215c188630363508dd08217733458b
- SHA512 9e9ff5218d89e6d73419e4b7aa4020d6686882bba9c0f447fa1abd334c638b104674e28508ea7565b62e84ef4ec6b41ac0bce7fdf30729ca59f5ce14ce81ec56
- SSDEEP 49152:HgrsmRmvwt+Yxr+TbQbZ+HJEfRFeg0AbpKGu3zya0Emfkwk:csDwtHd5bKqFeg04IV2ae5k
- TLSH
  T1ED06221132D59A0EE4264BBD9630E3F4537B7FE16822C21A38D27FEF3631B419D52A46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

agilenet
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
behavioral1 behavioral2
- Target
  Debug/ssl/ecid.pl
- Size 18B
- SHA256 e5136ef1310abf93bdc58ec62777349584635ec58c4f79cfe433a21cf16ef597
- MD5 177a8041977e9483b4b6ea4d7f6b6336
- SHA1 aefeebfc7b14afb3c880b0e2e96a6d28d96a4769
- SHA512 12161e1aa78f31998a5176d1612a415ca7ee9bcfcb7cc7f0ccf41af6ffedad3cadbf3523dc9519707922d479424a4d584e3c2120c0089872a3bbbcd460e3a299
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Debug/ssl/misc/CA.pl
- Size 7KB
- SHA256 c4f8681d06d216202c061b5d7823d577f31d8399df1880ddd5719d1f439c271b
- MD5 4dee21ee4fef4bb1d8480605aa389e09
- SHA1 063e217c0b3c1d722a3ddec732d5b7bc3a64ae27
- SHA512 31c03c40411fe8788328e6a36deb6d1b46345215db515282ba16820b6106080e162c07ec4e2411efbf8d3db828df78c4bf096f41b4f7aee346f5d5f2737a5225
- SSDEEP 192:zhOeG5zPSP6/SBZmbzZCkP5I9hHRxlqoLOrl1miK:zhOXusSB0JCiKoC
- TLSH
  T154F17100C9C79B2265595369FBCA216B628B9E0B224DFF18F08D44D63F2C674C1FDA87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  Debug/ssl/misc/tsget.pl
- Size 6KB
- SHA256 23e35449d18e085d82ed576d754c2dee7cf0580b7f73ed70fbb944278e4c3fa6
- MD5 752ca711424382379b6ad584f2605978
- SHA1 b9f295ac57ed28bbfc2bfbee965a7fdab7840dda
- SHA512 87e4f9e86fdadb69c426d515b42841a1ee38b1a38f0ffd15791256b9c9c1709746b7f3a1154c5cd78fc4247fe791a6b2c1994f9203caa2a9001d5a84ad35a640
- SSDEEP 96:ZfcCouJPt+2Qtanc/Z3obpmNajCC23E2iwJSxzoiQLQvN5leXtv4G8bvtLIm:Bc8Pt+2QAc+b3/22zoiQEXl8v4GCIm
- TLSH
  T13AD151097C47220796B3E0E807CEA44DD93A999773ACF865B9C886C41F1142CFAFD0A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  Debug/ssl/pr.pl
- Size 10B
- SHA256 45c425249e3f576cc4ea86327fe59c64f0a94dcf8a3bba7ec417811f7a248acc
- MD5 a59a8ca405d562842c7773d44d2025bd
- SHA1 c98f4de657462299e47ac02b73f1686e7af6182b
- SHA512 508f80877cca5a22b835f78945a0744c2577d456509945cc13e0209942b5d99bd60e08aee9a59d0117618761644931d8b1c8fb45acd32b66f596e5edd9c8ffbf
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Debug/systemdrivers/PongoOS/amd64/WdfCoInstaller01011.dll
- Size 1.7MB
- SHA256 f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2
- MD5 d10864c1730172780c2d4be633b9220a
- SHA1 b85d02ba0e8de4aeded1a2f5679505cd403bd201
- SHA512 c161bfa9118e04eb60a885bf99758843c4b1349ac58d2e501dabbd7efc0480ec902ac9a2be16f850b218e97b022a90fcc44925d7b6e5113766621f7ade38b040
- SSDEEP 49152:jRUp077GQSph1DxQOzAFXEfEacq1XT7HM:jSoe1GEf5j7HM
- TLSH
  T1AE85235187FC4099F5B2BF7193BAC9436A3ABD861A30C29E1780D89E19B2780DD65733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Debug/systemdrivers/PongoOS/amd64/install-filter.exe
- Size 43KB
- SHA256 df2abf387893332f28c4df68b10a6b176dc9706142055dccccf447f5a9cede2d
- MD5 a16f041c87529221c86e16124c7e9add
- SHA1 e4933d7fc395b397db9aba78b05a2a490622c7e5
- SHA512 972eb4a6cf96692ae0ad43b42a6d418406aad5539451b4e24e564b89a347a9fc8ee5572d9b876d9de7b72192ba70aa114e8de9d721b37af9c169503aaef611e9
- SSDEEP 768:9NutDn4dFG2wgAVZ8xFxnR0JG/3V/y75cg3AmQbT4gOcB4DrTer3np:9Qt7yF9w0nR0JG/ACg3o34gv6nQ
- TLSH
  T1EA13180687D100BED4BBC07AE5E61722D6F1B84083261BCB37AC89155F573EAA13FA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Debug/systemdrivers/PongoOS/amd64/libusb0.dll
- Size 74KB
- SHA256 4f18b5d2c28aa66b648c8683c6d09b52b92cbbee85984bbefad5f38a64bc2a14
- MD5 1d8215f7f8cd02a553499b534ccfb4d5
- SHA1 bab236f840f1521c43bcbaa2a7b92f14f329bc70
- SHA512 79ef4b25f16b2f2f37605298470ba9c4600e724e4b52d589add7d48816f656b93c082b5c65669e50e0546865063a068d26390e6ec7fbab66c3726e49a3779d69
- SSDEEP 1536:4Z4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivaaC+ziia3:4ZCxbEtayHpnkOBMmtPJzivaIO
- TLSH
  T166737C5797A5106ED5BBC03ACAE24127E6F1F400433856CF47A18A588E47BE69A3FF07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Debug/systemdrivers/PongoOS/amd64/libusb0.sys
- Size 51KB
- SHA256 8058f2afe6ef96a7d2ded432997fd8655970c9ea75a938ee4557d6a2cb4cc989
- MD5 16e18ced459b1824234890386ee66cd5
- SHA1 81d2b572ec0d24aba11ed6bfa9174ffad54140b7
- SHA512 b0e67d040d39f043305b0c172906bbea8341f1326108f5c5a0379cd6b287d62cbd86270385713d0f6a14c5106a5a6c23f6247a303e6124cb3e33982978505c98
- SSDEEP 768:HFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QnC+ziX7BE:yConbt8wifuQRtR7QnC+zirBE
- TLSH
  T1A6338D4AD75B444ECC93CA35EAA54623CFF0F8C447A44ADF0750846AAF03BE4A63DB46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Debug/systemdrivers/PongoOS/amd64/libusb0_x86.dll
- Size 45KB
- SHA256 5e84d13636fbce7869cddc8b20c7d83fa0063e98c319e8e5ab751edc9ee1da76
- MD5 1a534450750eca1f3d951def8d9965bf
- SHA1 7dd82b6d52a840c4979a7515fc7a9ca3725363c4
- SHA512 3acdfff24a4d9ebb4e9647afccf95f33b4580980fb35a91eff65a01ce470b0bbc1a3a27c476653911f1fa431757ca64c945da89da54bffa599744f29123ef715
- SSDEEP 768:Necy9908dqax/5FdC72/WkFkwUEihlLBHCnp+KCI:Ucy9Pn/LdnFFlUEulEl
- TLSH
  T160234B076AC09037D4D34176656E33228AFCA470472977CBF39E5A90ABA42D9F537B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Debug/systemdrivers/PongoOS/amd64/libusbK.dll
- Size 96KB
- SHA256 592cd24bae321f1cb6cbe2f6e1bc5c05e279328e1c86814eb64ea1e89fdea188
- MD5 7abe7f583d5d52de4a9727f94419cc4b
- SHA1 fa8489441ac82d22567b5c3d5b494576df54f37d
- SHA512 ec7c734dd954b7ffd5eb320c41a7dd7f481a632c8314028b020986e6310fb5eb25b7b274b6df1b442a9204d449f70d848032a7514776254ebee978753fedf3dd
- SSDEEP 1536:BM25LZ8eWbEcOC2cq/AdA9aHd/V+GhNOXdas2L1tbx6ZapazAeJp5qQMW:BMQDPAa9a9t7NSaso1dx6nAeJp5qo
- TLSH
  T111A36D56B1A810D6D47BD079DAA28AD7EBF07080476583CF0360975A2F27BE1AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Debug/systemdrivers/PongoOS/amd64/libusbK.sys
- Size 46KB
- SHA256 1df66ff22e2eaec27180756d90926ca5b07e8bcf6b0e4e3c56471e63a3a05fa6
- MD5 a814ff2972f55909aaffd943ebb0e866
- SHA1 b966ad29d209c64b3f0d879703086df1f6121e6b
- SHA512 37f2fe6ae0160d67709b125ff3edcc894effffd377e0086072aa96e53a5191fd67988f2a5465d24c87b41e9ed20f8ae30da18c216a568c7bcac6328ca2ec01b8
- SSDEEP 768:DpFlaIuC05+IPxXgoVer+E93hmk8P3vOUgDhw38nq3lsKgAn:D09jyNRG/3lsO
- TLSH
  T14A235A6DC3D21490FC6AC274DAF25627EB327482AF7087DF0256CA515F27BE16A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Debug/systemdrivers/PongoOS/amd64/libusbK_x86.dll
- Size 82KB
- SHA256 22803c719494f193d22519bfaff9484fecdcf1fadd6f082efd024fcee0b97ba4
- MD5 22e9219bc86bb8d3fb6209acdbf76739
- SHA1 fc2350e45b0c7bdac7ac35f42b65f5fdfd622464
- SHA512 411b5440ce5321e07a1e0ca3cae8699132792a5deeb348a0ed1078b9f43f4628568cb338621eeb879416e33e4c7e4f8db7387b5e244e1e1e57712d4aa1ef4bde
- SSDEEP 1536:jgqY+rhe9vVnupJvmOtY4l7apazAexoxDYruv:jgZvVneBYGJAexQ
- TLSH
  T169835B11B380A7AEECD631F461ACB376286CD0A2AFD456CF57231BE4CA743D0667424B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Debug/systemdrivers/PongoOS/amd64/winusbcoinstaller2.dll
- Size 979KB
- SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
- MD5 246900ce6474718730ecd4f873234cf5
- SHA1 0c84b56c82e4624824154d27926ded1c45f4b331
- SHA512 6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
- SSDEEP 24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
- TLSH
  T16225124117A48478E4F2AB74A5FB8A11D770BC111735C3CF8285AAAC2E727D9DE38727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32