e8728029adf3613c5c61d83745f45aa2f883e61553aad6b1951887b0bf39fac6

Sharing

Copy URL Twitter E-mail

General

Target
7-Zip ZS Release binaries.zip
Size 22.9MB
Sample260722-l7lkcsde36
SHA256 e8728029adf3613c5c61d83745f45aa2f883e61553aad6b1951887b0bf39fac6
MD5 6bce10147ff5810e40373e73dd42c88a
SHA1 f03c6802f87acb363c48ec79579e7966fd6337e4
SHA512 153535670309c7d7459efa5897d5671278bb85ea7daed3e2be2f634c3cf8963375e9e381206ee6b51245fcd7cb61e42a72b368b9cb83b9235ad5ba3708317da2
SSDEEP 393216:lUDMaLPYPad9M5fHWthod9eX7Wq0r/7lrFp3gfDrQ7nhTkEs1Y+m/RIk6h1rYhd4:lGlLAeAHQhoXs7Az9FBqDrQ1o1Y+mpDE
TLSH
T1D93733D89CB7F49DE5597930BB43DF38E7B13E4683918F392A738052164FAE1214B868
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  7z26.02-zstd-x64-ndm.exe
- Size 3.1MB
- SHA256 305a994fc3dc9fc0b252767a9719fcd9899ef652e46aa100514731af0b558a33
- MD5 232c7dd30545d20af09305427bfc671b
- SHA1 9aad64e19224f646bd2a14faf4860d56f09b838b
- SHA512 95868edb960c5501265be02ea18f9467afe1b414b54177eb8529b6e49f493b9e95a5ccdd5f16916d0eecb325c6bb2d4cbad59b0398a90afa812b20e80e1e9b85
- SSDEEP 98304:yYpDtSfgaf6TLYkyOkmjNyN63SPtAO9HpkRRXZIScK:j9tSNGBjSH2RpZIQ
- TLSH
  T1B8E5331275F2E0FDD4BAA63858554102FFB27C2243608BFF1A60C69A2E636D05D7EB35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  7z26.02-zstd-x64.exe
- Size 3.2MB
- SHA256 9e0c38a0ec0333dc7f3e1cdb15df103f8068cb1bb9dec4e625993a55b43a6ee4
- MD5 cc2ac6ee0e13da31e613cb832b0e18d5
- SHA1 bdc2bc5baf58af206dad2bc730301352645a1c9c
- SHA512 9a3487a840b674fcd206163a0456b9e93ca45b25a45ed4f0703b3bf9f50e6f4534c0981894c83d15a66e5f524a4faa511d8927cab01404b0231ff9b5a1555a90
- SSDEEP 98304:D9M8O3VpTpF7ls6lvdPtFK+b3L0kgH6K5:ZO3TpZlFPtDb3ZJK5
- TLSH
  T183F5335ABAF9B8F5F176423451B10617E77238A487B183EF05B440286F372E25E3EB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4
- Target
  7z26.02-zstd-x86-ndm.exe
- Size 2.7MB
- SHA256 f53fdc4326087e703c72ded5e63ea5bf288f8511f900988116c5d81a3a45fc40
- MD5 6f066541fa9cf0507a08a0fee7f8873f
- SHA1 2b582948da829c5db490e0fa0b046a38df338a74
- SHA512 df90a517e8d16bc341b9e1ec6c48ae4da593e110ac302c15a9b926ebfd094f94ff3b3abe268e704b1120d6653d68cb9882dbdbdd4bd9d7a8c24ad1cbdde1af1f
- SSDEEP 49152:rKVwzePLmORWZH6JtxUVjxynn55Nzz+dN8MjK4M4CjeU8Z:1eDo8xsjxG5z8bjKOCI
- TLSH
  T102D53344B9C8C079F0279438A956E6755D36FD600F208FEF73A206F94E746D01A3AE6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5 behavioral6
- Target
  7z26.02-zstd-x86.exe
- Size 2.7MB
- SHA256 c83871e2b002aa156013482a3c05dfd7e171f2e3b66e9f6abe868d94e04c932c
- MD5 160c9d4d60df4c59b10f14b0783b6e77
- SHA1 73c99b0831d328c59852d5d2da0a31db1db13f8c
- SHA512 83292f17c77d0ad0ed4fe23a54666bef7186ac28fcb438fc8192486102f66450c7c9944f2b475d281a81ec0445f03510788ffd84c5fc619b9ef33f029441b95f
- SSDEEP 49152:VKVCHmVacySn/Z7t58+UsT/RRvBhUAyBL7QcgJqk+0HbSlk/6fIc5Na:FVcb/Z7tprD3vBS1XJg7jHb4kCtu
- TLSH
  T15DD5330036D19230CCB17835A02BBF574E7DFD305B249EEF276515AC493D9E12A36BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7 behavioral8
- Target
  brotli.dll
- Size 908KB
- SHA256 4c64024d103b9f0e85ffac6e8b4a283b6b54928e505ba9f95ce35ff33f3fbe90
- MD5 6229f6737850b74cd18c5b501853e350
- SHA1 31cb336c7b960ac8c44a4a746c831179bd40e94b
- SHA512 92c11f95bb82ee0a6f1c80d3d11bcfbdff45bff0ef103fba4eaa9be19e7067781dee5c7628153b3164805d2a1a6de6ba90f1275379b95d3034d9aa4938b8ca1f
- SSDEEP 12288:buk0EpyuGWv+9F2YJqAHFESAHhlyd8hnnb3xKWulsONRf:fw9IQHFDAXlgWulsON
- TLSH
  T11E15C046F91E6F33CAD6A17ECDA3043463382DB4D611844B6249F139BDD3B544AA23BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  flzma2.dll
- Size 262KB
- SHA256 a34c3f9c1078fc7ead2971eca88af8fe348a5519461f0f9cea55d0c6eb9acb77
- MD5 70d643de97c0c269f0a787f06e4389b3
- SHA1 31d5d9bf59579ae5e3c26732d654fea45160cd50
- SHA512 7eebf1ced1869d20488890afc35fe09583c6486f27794f5d342e60bd2e17c5a27b203089d880e9f3ac981a1e36f3ebc62c1f3cb10ab027e4417d8dd7822d56c3
- SSDEEP 6144:y0S/kDbbNQvhHzEpd2YADltVswXmPn8bDz:y0SLTt
- TLSH
  T11C443BC17A8CF8E2EAD5CE3BAD534B1D21676DB48520C44A119BB10EDD7F7E08A60763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  lizard.dll
- Size 346KB
- SHA256 ebc359d16df64054a0f7e7e5e31b0626e421f8a37bbcced160cdc3804adfda51
- MD5 aa5b47f27d3d0dfed48006a075e8aa40
- SHA1 3f41687c0839e0c813a9bb9050f95dcd8a8e4b2b
- SHA512 675d8f14d0740b5debfb3d0ddb8802e327df8c4f8f5bc23011d01c70601788db3057feb85398c4d2885a2480e9658699fdd3b69c776d43380125c423ed3cbc61
- SSDEEP 3072:87tDHUpj6OW2P+G7eM4TO0rP5H4rvXZQjwKKTMF3nFhBQmxUdc1FMDr4BbnoltVT:vMOEMR8pZpLZ1CQBToltVsw/mFx8bDd
- TLSH
  T178748E846B9D9CA3E2C6973EED130918613E3DB49521C04E6183B10DEAFBFF5C661963
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  lz4.dll
- Size 239KB
- SHA256 367d1051dfa7a4c1e39497f7b0f47182775c6b9b994c8beb45c81a89bb395a8d
- MD5 8f756242b3f8f45292eea7bc354509e7
- SHA1 53a8ac0080d063e505622e222e2fa06631524b6f
- SHA512 8fcd3bab187a59ee418e36f16078a761d4972a097b8019752e2c22dec6ffd056b0e5b163b7d0732321b28b1c2af9b0fa9c16fdc053f934d5f97df332d87a326d
- SSDEEP 6144:JextJa7ki9yxqKQapX9xI5jXisfKkHNsnL5ltVswvmXc8bDS:A9a7X9gpvEimHa
- TLSH
  T139345C817A8C54E1D9EBD53FFD43494D61277CB48720C84A2293B21EDEBE7E089B0967
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  lz5.dll
- Size 219KB
- SHA256 4986da8ae763d0e67aa15a237e1c80ecfbacbf3d2e4d15a3aa31eb9623413d11
- MD5 574a788bae7d15ed32b1ba5dd39a0bf3
- SHA1 2a9ff8c72d2a7542fbd451549820d91143287c64
- SHA512 5747d25e5d443752e3c057daf44c60d4d829b57d0596ff9709114f2931e136f97e2a8c008d07d254b3cffe598527fec303846a300c5b0aa909be33f415aedcf6
- SSDEEP 3072:X95d+icA/arMhuM1zcRzW+ovNJfHROuB3WDmss6b+AHm1FltVswrrmb5M6J+8bDx:XvQ6aIhbVs0NY+mHAltVswvm9S8bDx
- TLSH
  T1EE244C81768C54E2DAE6DB3BAD53490C21277CF88A11C4597293F21EDE7EBD08EA0573
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  zstd.dll
- Size 633KB
- SHA256 846b0c3a6fa406e040249933ef1e1256424f161b49f414f78a6b343702c837fc
- MD5 56e5edac1f8555892b80f4620d1c80e0
- SHA1 370a8204aa0926017c0ea1e87f2f75208f9fe764
- SHA512 d540e09ee7113dc36b4303a26d5c416130ce5216a1222e4ce98fe3729a218a8d896aaa8ed2039edd77e8764bc3587b17cac0ee75259724b67346be0a22936867
- SSDEEP 12288:qrATehH8A0Mbu9DatEpPSISieeTzOrlwv+e:qrAauMb3rhUzgw
- TLSH
  T1FFD4AE809A4EAD6BD3C5EA7EFD134F6571393CB09021A45A9253F10DDC66BE1C6F2322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  brotli.dll
- Size 908KB
- SHA256 f21842211156eda48fd755e08a2f65930f6726cc7460544b8845ea4d21a4fa70
- MD5 beb26a303450fd4f581321264c453378
- SHA1 49576783ad94d514c744893d7d4ad78bc96cf361
- SHA512 1cde3900f102aa7148183b5827d2b869da17a8c6664e6702b9569e99bc84c03046b1a8afd2f8466721bba80faba91e5a5f5060f1d986efe224a953b7741c27d5
- SSDEEP 12288:cuk0EpyuGWv+9tqX2w7H9DDAHhlyd8hnnb3xKWulsONSP:Sw98zH9fAXlgWulsON
- TLSH
  T15015B006F91E6F33CAD6A17ECDA3043463392DB4D611844B6249F129BDD3B544AA23BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  flzma2.dll
- Size 263KB
- SHA256 322abfe118c386783d2f8c2eee42ecf7686561dee700bf842e183c0c87c38a8a
- MD5 94f87969cf3b9ccfded72c5038029b40
- SHA1 16e4ecc3bf448c9d05ccc23d1fd44e8da3d48647
- SHA512 f7c4277fb262dbb1aac18f2f87ff74d1ebc3d44857bef592ba2201acee3656f380777ee6841c8b9ae882957680806e7121a499f40818e7c8ab1e5492d76db0fc
- SSDEEP 6144:M0SfkDbbNQv2jnEpWmE0YtsDltVswXmPn8bDz:M0S87Js
- TLSH
  T188443BC17A8CF8E1EAD5CE3BAD534B1D21672DB48910C44A219BB10EDD7F7E09A60772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  lizard.dll
- Size 346KB
- SHA256 139c82c80c04c3b291b07ebe841933560dfd1e96cd31f2b1151545f24698c3cb
- MD5 db6f5e835ddc670ffecb3d41a81a8d26
- SHA1 01cfc86092aee57eabe25cd4fc5bc2bd864a3263
- SHA512 596655f430ef27d41450649a2819f262930d30decb2ce57419d32c552cbd33564448652aca4dac05b4ec2e5f90df47cd0cf1a040afb97a07727f06641c410d63
- SSDEEP 3072:PbDHUPN60c2PsGXeYO1MmKwF9l1vpO4jYKmEk53mhBQmxUdJobMzr4BbnoltVswr:ks0cYbXsxLsogABToltVsw/mFx8bDd
- TLSH
  T15E748E846B9D9CA3D6D6973EED130818613E3DB49521C04E6183B10DEEFAFF4C6A1963
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  lz4.dll
- Size 239KB
- SHA256 e2ce40f9819e0746751003da51e5654fc25dc6997dd47d37d7381641960f7bc8
- MD5 010288939e5ee72d11c243e2c2fdad48
- SHA1 63e1f48ec23ecb9d8b92ab4eca446b3f9fdcc03e
- SHA512 77db1ac6cf59fdfbf7bb1fbe6e2a74ad9b669ffebe330071faf4863477eab16151429182b8e37b0a1c8cf081d01b1c52e40fbdf16e12cbce59dd50acaf6d3cee
- SSDEEP 6144:TBoghY3Aki94xqKQapX/tgbjNSzXwwnN4yn5ltVswvmXc8bDS:TBNOAX9+p1USXnR
- TLSH
  T1DA346C817A8C54E1D9DAD63FFD43490D61277CF48720C84A2293B21EDEBE7E18970A67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  lz5.dll
- Size 219KB
- SHA256 29d1bbdb9cbbc100f099a57fe1e407f3e1b4d098d1cca16c8eaf1c19b0e3fa82
- MD5 7e877b515f10fb307262b0a0ad32dade
- SHA1 9b384b5d13ae41ae6b43927a17a6c2270434426e
- SHA512 b87d98ff0bf88a9a8424423b95ad7e317cb61ce32ce7ed875cd16b1c98b63ebab5fc4c645fce63ca59ea12935ff4fc5dc03d3cf6c2f3afde787cc3e0789e0dbb
- SSDEEP 3072:uD95BA0tLDqrVZDa1lTR7uTovNlf2BeW83W4EsH+AHm1FltVswrrmb5M6J+8bDXh:uDvKCq5ZejxTNRzJHAltVswvm9S8bDx
- TLSH
  T15D245C81768C54E2D9E6DB3BAD43490C21277DF88A11C4597293F21EDE7EBE08EA0573
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  zstd.dll
- Size 634KB
- SHA256 8638916ec4ed30a3d30986243956ccd12cb750d195d32be1c747afe975cda989
- MD5 f70ac66f795287f9614e2fae3c465052
- SHA1 912ca73b10c9b4d5a3dcae9418e28bb8361bd675
- SHA512 2513c2031a34972eebafc3c34972c371f812725f813b401426c366319942267e1cd28161f3c7cf851d5e7a4081d6864b77681946471d29b3b3c3e907ba436ac8
- SSDEEP 12288:kb1n4L8HsZo/k9ovGBWJHyISiOekKwNbA0e:kJnae/kzrJTK+A
- TLSH
  T167D4BE809A4DAD6AD3C5EA7EFD134F7571383CB09021A45A9253F11DDCA6BE1C6F2322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Checks installed software on the system

Event Triggered Execution: Component Object Model Hijacking

Checks installed software on the system

Checks installed software on the system

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32