0fd1d44f1939413d4f19158261b13aa54baf3d3052020f232a042e9574a0f1dc

General

Target
lvion ware.zip
Size 29KB
Sample260722-llw4zagj3x
SHA256 0fd1d44f1939413d4f19158261b13aa54baf3d3052020f232a042e9574a0f1dc
MD5 6302b153ddd0674af667808fd6b93297
SHA1 ae5d0300225e97b046fe31082da87a3467d0db30
SHA512 d8558cb30e39c4659987c354b12ed878a4247db0077345ab4256254d8501cfbda5391bcfd6b6ce9dc4dc66520435574100b4b9256e1e735ca6635f161823dc0e
SSDEEP 768:9TO7JjcEObGEEbQCvv6U5yZ641GyO7OtAdQsaA7FtpHZBQR:mJoJGEyn66xyO7OtAyGu
TLSH
T185D26D7959D874C1FB1FA9F4D55DF2C50CD9014508E23B52B7CCAA268EAB1C23F32A85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  lvion ware.zip
- Size 29KB
- SHA256 0fd1d44f1939413d4f19158261b13aa54baf3d3052020f232a042e9574a0f1dc
- MD5 6302b153ddd0674af667808fd6b93297
- SHA1 ae5d0300225e97b046fe31082da87a3467d0db30
- SHA512 d8558cb30e39c4659987c354b12ed878a4247db0077345ab4256254d8501cfbda5391bcfd6b6ce9dc4dc66520435574100b4b9256e1e735ca6635f161823dc0e
- SSDEEP 768:9TO7JjcEObGEEbQCvv6U5yZ641GyO7OtAdQsaA7FtpHZBQR:mJoJGEyn66xyO7OtAyGu
- TLSH
  T185D26D7959D874C1FB1FA9F4D55DF2C50CD9014508E23B52B7CCAA268EAB1C23F32A85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  lvion ware/build.bat
- Size 1KB
- SHA256 0ac6784f5ca193a920d001bc5990ac83400ad4f4eb16c2558039716a1fa543bc
- MD5 78845b01e1f111f891911dc76d33b227
- SHA1 fc596eb7eac48a06c0f2ca2a4efb1b03c3c2c4e5
- SHA512 cc4f3f68722b77d8cb1367b40fc5ee97d2c07b4f37324e6f95c555b016833c451a566a3a80be1c40f5c8bab78921538c310d52ffb0d0810e384d86783e3f9804
- TLSH
  T17F31022B752C463254A89209AE45A9C3F584929F02A06DDCF0C3A0656EE37C47FFDBD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lvion ware/resources/setup_font.bat
- Size 1KB
- SHA256 84f02f5b3ea36c42a3b76a086ebd889ba5247d23089d781fd02c3f8437a859e4
- MD5 3ebc94d84dcb500523b22d0a614507a4
- SHA1 85c29ed48231bc6f71ca63f1bfecd572518ac87b
- SHA512 9fb709dff0ea99e2738e1928c006d8cc23304a9562035638c14abba41035a2e23b35654a5a9af7533e46f9f872c67fb1488134ac6ae9d51d38aede6fd5973ec1
- TLSH
  T17F31CF03313C103A5AB46515DD83A095380F609B5938BC9DF9579568AAEF7D093FAB84
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6