685648903ad01f7606999f7cd26adc2ae613855eaca618264066c3dced0948d0

Sharing

Copy URL Twitter E-mail

General

Target
SlinkyCrk_2.zip
Size 18.2MB
Sample260722-v3z2maaa65
SHA256 685648903ad01f7606999f7cd26adc2ae613855eaca618264066c3dced0948d0
MD5 0bbe3e997074e903f5bb12104cf3957f
SHA1 fc3fd77636a180ab96c4c191d38fa598a3a823d8
SHA512 00aa9fb2f28df4bee90a5001d6df2b067182419c93cf367d6e7338bf16f6f7d382c259c2022b3ecb09e95424428dd9d659639b7e8b8f79129dd969c9fc5c10e3
SSDEEP 393216:/kU5EbYfpnWQfwNLQlj7IuDsT6hlna3/W+YL25mfXPyBgnE+/d1Ti:sUSYBWRN0lj7UG/na3O+Y2mnv/Pi
TLSH
T1761733D2F0501E7641363A7AB453F0655283C7E73A302F55BBD69FF9EB98320805A87A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  SlinkyCrk_2.zip
- Size 18.2MB
- SHA256 685648903ad01f7606999f7cd26adc2ae613855eaca618264066c3dced0948d0
- MD5 0bbe3e997074e903f5bb12104cf3957f
- SHA1 fc3fd77636a180ab96c4c191d38fa598a3a823d8
- SHA512 00aa9fb2f28df4bee90a5001d6df2b067182419c93cf367d6e7338bf16f6f7d382c259c2022b3ecb09e95424428dd9d659639b7e8b8f79129dd969c9fc5c10e3
- SSDEEP 393216:/kU5EbYfpnWQfwNLQlj7IuDsT6hlna3/W+YL25mfXPyBgnE+/d1Ti:sUSYBWRN0lj7UG/na3O+Y2mnv/Pi
- TLSH
  T1761733D2F0501E7641363A7AB453F0655283C7E73A302F55BBD69FF9EB98320805A87A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  slinky_library.dll
- Size 18.1MB
- SHA256 16745ae6670eba8a452a5e75fa6142564d31bd3b7d14766e04f1acb214f65703
- MD5 44b5e89a9f7bab889a4df60042872f17
- SHA1 cfc40cd4fdbda75d3ed52952c500d8ccc12f4a36
- SHA512 7f18545da3e4fa726ec33345f7dc137eedf4961a1bd0582b51ee2258a6d5a115187a4e72ec3c7b6d29e33b0a4aa2560adec1833b4bda3f00a7b194ea71d95188
- SSDEEP 393216:kKRqNWNKROYkhkpXorNv+oXsDS3LNK3HOU6x0pW/lJktSrZPLAB:HANWKRrpYrNvou7NK3uU6E29dPL
- TLSH
  T11C1733E19BD49BD58353CA8DA697419EF2C15D07E6BF8F243EC7EA0212E0809518BD3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  slinkyhook.dll
- Size 228KB
- SHA256 7c4234fac3b6b3e96dace1e71c7a952ec67e3839f90f7a88a9ea283bf88d25b8
- MD5 6d8c17c67970cb5841811eed8adffffc
- SHA1 c869ab32318a035e51aff8e5e11b4cd25fb52a4f
- SHA512 7d2a0ffcd72c8bf4a96b2ed722d7119749ec14f5d7e6a601cb6ae4a5b1c4a652b694158f01da340e3ca4751cabd0a56c42bf739d8b421e36937f3691b3b80c72
- SSDEEP 3072:hXxN1I6PgabbAzVxPLI5oIa5amK/1o4ptgELHY1lNyc+m+e7P26g66OVuknsDe0u:hhN1GFZq/15tFc+m97ieuknsDu
- TLSH
  T1D4344A17729A0DF8D66BD27889838A19E3B7B8490711CBDF27E043371E67BE16D39250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  slinkyloader.exe
- Size 2.9MB
- SHA256 b4556b254ccecbd5cbc4f7d17eefbdbeaf2028b9ec8c4a6e2dca7143e842f18c
- MD5 6b2858988224423d7d96a4c661f5418f
- SHA1 5012c7a3dd884c75068e90fdfb91634bfdf42231
- SHA512 405e06611c78e7fd51bdf675d86303ffe57e2ca9e822a38329c67689dbfe29dcce897db3ffecc0011eacb6e67bfa48b39bc69c4a1721e7e1049a059a03bfcd49
- SSDEEP 24576:L2YXVr/TtIbcYAjDc085SpZjfN95GwTE0nirgEl7XBWtVs+Ec0xMki8UsU3AowaP:L2YXVr7tmcfc0iSpZp3kNan17vQEXL
- TLSH
  T1ACE5E64369DB0DE9CED267B8A5C75335A734FD758E291F2BAA08C2312D536C4AD1EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Command and Scripting Interpreter: PowerShell

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8