825385110025f8998ee2624eb5a9caeb0a8bc8bb3909d913c05565e3b95c702f

Sharing

Copy URL Twitter E-mail

General

Target
3_1_Henerator3.rar
Size 249KB
Sample260723-pmgmfswxht
SHA256 825385110025f8998ee2624eb5a9caeb0a8bc8bb3909d913c05565e3b95c702f
MD5 2c19319511700c648249d8fb74981a09
SHA1 725522466db197e080b0cc69c5dbcb9365873955
SHA512 57ddbc6728f6f6a1364cf05d4009f158281e780034e1cda552547bd267e9409cecf1f8fab8fa2874100fe4a5893fc79b4b20cc58f0fc86ad19090c4af180861c
SSDEEP 6144:ryeR36JqMFxbhbRA898dgPXPriCe/sHMC0nH5YWzZ03o+:e26hvhTpPPriHEHGZR0X
TLSH
T17744235E014DBA16DD0EEE408921789FCC6032C5B36A9059EE7CF826CD7BBCA50EB134
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Henerator/!!!GET_keys.bat
- Size 108B
- SHA256 b11da3f884b1044c65efcf5608f3a9b025c57bc1a2f0e9383c60ac5ba7da4f58
- MD5 60c0a7539a9f7822bb7e871af2f814b4
- SHA1 93bb4b6eb728163c8fac0d9db8f96492ab2adcdc
- SHA512 7a8ab5a572a07bce89d619c1fec2ef18fa611db6f2d6d35959a29d1ef5124d4943c4210c490ecc3d56ac88395758f933efbef584b55611efe3c21383242d5a1a
- TLSH
  T139B09210D22B0200E41C2E40C34AD073A81A269A59444CEA095E90A14C1B83593852E1
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  Henerator/Free.exe
- Size 9KB
- SHA256 28dc8ae5733eedbc804664a30312e0106bf6e0f7dba7e7f7d43df4d3796cc9c7
- MD5 7ebef8a1e46df663e44303c82e4193eb
- SHA1 5001ebb0c57d0adc1f6fbbdf05bcb0264ecc4b48
- SHA512 8c6cc195e496248baaedb15a986c1145f83b4e7840cfe67628e5230297207e1f58d9162c66c2fce3938c2c8b27e47a00612506249acdaae35572d7ad48fe97f2
- SSDEEP 192:ZBVQ6pjnHUY7LYkG5cFXU00Lno9JFaNJhLkwcud2DH9VwGfctsuQP:rVBnHfLYkG5cFXh07o5aNJawcudoD7UM
- TLSH
  T18C125D57D1DA8B88C0AF423728DF7D170432CA09AA95D9B29FD43017A9857AC3C6C3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  Henerator/TIGER.key
- Size 56KB
- SHA256 7e557cfb2ea905b26bd49267fa8818cd98b3fb559fb43636f6c3a5f305453ce1
- MD5 2550a05d1477621469d9865a075bfa10
- SHA1 e4f560e266ead63440a34542ced80d3d58c07f03
- SHA512 8291d02ee9e95681f83c6eeaab03e39f1c73af58b515ee0686db2d895735388df9c50963759fdcca7a4a479e2d6540d6fb6ade97444bbd3041c68e684a0920f8
- SSDEEP 768:JSQnKJtf5NW/sf55eJJnDrQkyA3hfrjv8CsbGhzMqX58FxO6RN:WJtf5Nihf/piO6n
- TLSH
  T17243B45BE2F480D0DB26CA4409D4B8DF86687DE727ED05E5729862847D17F3BAB0B807
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Henerator/biss.key
- Size 32KB
- SHA256 fd75061ad67951ff09941144c58470a29bf2836466c9e19b5c6e4603276fa668
- MD5 0eba268a730dec0d256274449112c44b
- SHA1 b3a694ff354cb4ac2077dd81c92808a4765b5f0e
- SHA512 89a2c0e97d0563f46b3737082ff362eab25593df5d1fb3dcd6ca34efe9eec067612bbf9c7999dabff973a251f2af89ab74796b45e2474f2c8ffda46ccb13a243
- SSDEEP 384:kSewI8UqkotoSwi2mdgbvM8kotoSwi2mdgbv/Sys71LjmCfrmRsNW/bIf55eJJnP:JSQnKJtf5NW/sf55eJJnDrQkyA3hfL
- TLSH
  T1FBE2A61BD2E04090DB35DE4419E4B8DF82A87DE726ED45D1769876847D23F3BAB4B803
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Henerator/busybox.exe
- Size 431KB
- SHA256 a827eacdb488f3284c362d499c948bb667a0b4eb40c6b6c59e89efa40d6032b3
- MD5 598f03894201a860cbaed8a55b42b1a1
- SHA1 ce16cc07d72c646fa7255a5a0edfca9a4963f152
- SHA512 bd62e8c262b76acdbb587cada962ab7c82dfd068f60087308f203d57301fb9acc1ea3e14b005293c95b32d6f3f7737d3bbb8055f4f0726327838e6489fd92e70
- SSDEEP 12288:5VhJ0PSYJDTwqvGa00kmZhxDOrufCGWI:5VhWPNJDDlcmZhxWufCbI
- TLSH
  T1E9946B0CAF8790F7DC0325F496D7F2BFA731A928A430CED5D7AA1880ED57A53591E224
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

UPX packed file

Checks computer location settings

Executes dropped EXE

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8