d0ce3a37913020b1b37b239645b254b04e4e9af8b50ba6b6c8977c4eec39a17c

Sharing

Copy URL Twitter E-mail

General

Target
c2b8.zip
Size 33.0MB
Sample260721-phrxmabl3x
SHA256 d0ce3a37913020b1b37b239645b254b04e4e9af8b50ba6b6c8977c4eec39a17c
MD5 75f411ed2c6cf42fa11015a26897f75c
SHA1 3410fac209496ec91488dc81db50299b872833b1
SHA512 a43e0b0203fca02defb7eb503290b13f8d5b5b5a0bb0ce1501a8b0c79475ecee42687fea7752178e4b142ecb68c18b52fbef9540ef0ff1af8fb1fc05b613a208
SSDEEP 786432:nM7YCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ea+:MJxbXnfCJMAYDi4D0C5Z9nT3D+
TLSH
T1F97733F1A442896BA9C1DCA0E7C5C184E28641E5CE743D77E16A53F3C2E7AC794E72E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  README.html
- Size 2KB
- SHA256 c430a6802aa574bb46874cd15321b27a4ba69c55c04f1f83072acce7b5e8a452
- MD5 ab3a8287f8e9ab6d80ab5870c9f844a6
- SHA1 5e521d5161bfab7b2c041146aa1e12ee85a1ba4c
- SHA512 1143e5a5dc825152d64a7af57c19f495a1a21192f3b16cd7aed9c6acfaf796d093f692655b74d7f516576acc96726b821cf8034978baabb9cbcd1783b8d48bee
- TLSH
  T11E51DC73D7926F37A163035E714AE3D82F11F1C19054AB18B2BA81D67DCA12B60673DE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  RemCom.exe
- Size 3.1MB
- SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
- MD5 3e298792e73b58dd0b0d81f91683d9e0
- SHA1 ed5066d483b7249dc75fa4b0578108f96b8c91fb
- SHA512 aa3ce01fe0f5602cc79fe8879cfd773e0bbde8a820f81baa95698a5346b4cc1c6bb36cd39839995cb308cf9248e566500fdf8c040e022130693f01e9a04c6f66
- SSDEEP 98304:qI4kvKvHx15RFAN4z4yGTpOnHNQc9xQrpf:qI4kU5RFRzw9OnHt92rl
- TLSH
  T108E59D13FE418471FAC2013B82FD5FBA8D7E9610136DA9E3669539B44F702D26A3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  UEMSAgent.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH
  T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  dcremagentinstaller.exe
- Size 194KB
- SHA256 927837f0b31d20c0ed7948cf6170b57b28bfd4bd118aa21853611062ed2678b2
- MD5 35c1ebfd236a2222141531829f67f0e3
- SHA1 c6be8310ad8152815bc74ce423a02b9360b0f493
- SHA512 732f95a7541b2aef592d159656d2212598401f21be00031a6a66080efa52ce293fc85f458b4f1181a8e5fece98a837e51dc121df773abf0dc210a87cdd54add4
- SSDEEP 3072:xDTP/OYHh9aGwsXOXhnyuGqmEiXyM9SUJlLxTU6mpPF1tE:xDLZBAGwsXo6EiXyM9SIltTU/znE
- TLSH
  T1E7148C357689C073D557153949F8D77B7A6EB8220B60A0C76BE80B7D9F702E29B3430A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  setup.bat
- Size 3KB
- SHA256 fe27ac5a7a72e2f380ecd90367eccec418f87dd7cabb3d3a19ba27f38871b13e
- MD5 efc869e1d2ec0db71eb82e86bc114b7b
- SHA1 066e0391da7faa969a7c506beff3beef74b9bd53
- SHA512 edf588d20a0a66f510a370ec63fb351054b201c091d7c26f0501197741911184b7c7dd73b7d8ef3aa0bdf19e7901935066ffaa031a655b22f668f1ee5c12f1b1
- TLSH
  T14F610F808F522F751454CF59E07A82C3E733D006A7C67070189DBC9ABB8D7A63D3EAA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  setup1.vbs
- Size 1KB
- SHA256 33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428
- MD5 0112c726a741f3351dcd1872ad6aa013
- SHA1 7f9f98f388abdc938fc0c2d162233b93c822b809
- SHA512 a2d1e96fe4f73772743e0f64d392515dccd124526fcd69c8607be71842bd95b8c184c58547c2f10f124ed1f9cdbb10466ecde7a2076b6d2ddd1f22630d9d1ac0
- TLSH
  T15431251B99644A07D4D2C65321F37C5C9F7A6A57000882B735A9DC9883D83639F5F237
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware trojan
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12