dd075089c8e3c8cba2c74403146af31b4461303cbe0260927e33c6641f035b8e

Sharing

Copy URL Twitter E-mail

General

Target
c2b8.zip
Size 33.0MB
Sample260722-althasgf95
SHA256 dd075089c8e3c8cba2c74403146af31b4461303cbe0260927e33c6641f035b8e
MD5 80345e992421786561dc97adfe091b0f
SHA1 667f0ce74fb46ac78868b5a5a5d3d303a34ba347
SHA512 fc5f95ad73d5a23ec198e05d29227715658fd44e04f079721078624069f91be1d2980271aef51b9037728aea2bcf02e54973549efd8677acb6d1c937fa8176f6
SSDEEP 786432:sk7gCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Eam:9pxbXnfCJMAYDi4D0C5Z9nT3Dm
TLSH
T13C7733F1A442896BA9C1DCA0E7C5C184E28641E5CE743D77E16A53F3C2E7AC794E72E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  README.html
- Size 2KB
- SHA256 c430a6802aa574bb46874cd15321b27a4ba69c55c04f1f83072acce7b5e8a452
- MD5 ab3a8287f8e9ab6d80ab5870c9f844a6
- SHA1 5e521d5161bfab7b2c041146aa1e12ee85a1ba4c
- SHA512 1143e5a5dc825152d64a7af57c19f495a1a21192f3b16cd7aed9c6acfaf796d093f692655b74d7f516576acc96726b821cf8034978baabb9cbcd1783b8d48bee
- TLSH
  T11E51DC73D7926F37A163035E714AE3D82F11F1C19054AB18B2BA81D67DCA12B60673DE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  RemCom.exe
- Size 3.1MB
- SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
- MD5 3e298792e73b58dd0b0d81f91683d9e0
- SHA1 ed5066d483b7249dc75fa4b0578108f96b8c91fb
- SHA512 aa3ce01fe0f5602cc79fe8879cfd773e0bbde8a820f81baa95698a5346b4cc1c6bb36cd39839995cb308cf9248e566500fdf8c040e022130693f01e9a04c6f66
- SSDEEP 98304:qI4kvKvHx15RFAN4z4yGTpOnHNQc9xQrpf:qI4kU5RFRzw9OnHt92rl
- TLSH
  T108E59D13FE418471FAC2013B82FD5FBA8D7E9610136DA9E3669539B44F702D26A3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  UEMSAgent.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH
  T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  dcremagentinstaller.exe
- Size 194KB
- SHA256 927837f0b31d20c0ed7948cf6170b57b28bfd4bd118aa21853611062ed2678b2
- MD5 35c1ebfd236a2222141531829f67f0e3
- SHA1 c6be8310ad8152815bc74ce423a02b9360b0f493
- SHA512 732f95a7541b2aef592d159656d2212598401f21be00031a6a66080efa52ce293fc85f458b4f1181a8e5fece98a837e51dc121df773abf0dc210a87cdd54add4
- SSDEEP 3072:xDTP/OYHh9aGwsXOXhnyuGqmEiXyM9SUJlLxTU6mpPF1tE:xDLZBAGwsXo6EiXyM9SIltTU/znE
- TLSH
  T1E7148C357689C073D557153949F8D77B7A6EB8220B60A0C76BE80B7D9F702E29B3430A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  setup.bat
- Size 3KB
- SHA256 fe27ac5a7a72e2f380ecd90367eccec418f87dd7cabb3d3a19ba27f38871b13e
- MD5 efc869e1d2ec0db71eb82e86bc114b7b
- SHA1 066e0391da7faa969a7c506beff3beef74b9bd53
- SHA512 edf588d20a0a66f510a370ec63fb351054b201c091d7c26f0501197741911184b7c7dd73b7d8ef3aa0bdf19e7901935066ffaa031a655b22f668f1ee5c12f1b1
- TLSH
  T14F610F808F522F751454CF59E07A82C3E733D006A7C67070189DBC9ABB8D7A63D3EAA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  setup1.vbs
- Size 1KB
- SHA256 33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428
- MD5 0112c726a741f3351dcd1872ad6aa013
- SHA1 7f9f98f388abdc938fc0c2d162233b93c822b809
- SHA512 a2d1e96fe4f73772743e0f64d392515dccd124526fcd69c8607be71842bd95b8c184c58547c2f10f124ed1f9cdbb10466ecde7a2076b6d2ddd1f22630d9d1ac0
- TLSH
  T15431251B99644A07D4D2C65321F37C5C9F7A6A57000882B735A9DC9883D83639F5F237
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12