90acf43251787a9f67eee1eeeda395d78f20fbe733a73ccca21b3ece6ddc8548

General

Target
figural.7z
Size 75.2MB
Sample260724-2epz3svbpc
SHA256 90acf43251787a9f67eee1eeeda395d78f20fbe733a73ccca21b3ece6ddc8548
MD5 bc024fc8fd3cb2b2af8fdde2861b1c1a
SHA1 ab579f212258c1d523a3f9ff6d1dd52c9fe941bf
SHA512 6ae76df99f440655064f6431819bd8863e1c2d8032fad02fc77a8b31718ccacf77e5816ba226dfc7a3d0c3e2f19186d0b078f2f6f27d1fd00c62f4ec6155ccd0
SSDEEP 1572864:cHpdYY0GA41IshGyBxX6GQEnBxaEzUdNyv+u4/5u5+VZNEKDiFeqQ:cJdYKj5hmG3xYryvzK5uwV1t
TLSH
T1F108338A6E21F13FE412D473E10866E5728EF184E7338FA6513F85DDF8E2A116B444A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  figural.exe
- Size 75.2MB
- SHA256 a04601e2790d35726d6b76935323e5d8c67a7ce376028f6dcced885d7220cd87
- MD5 5b80ec4a6af71e13432552b32a8c0a92
- SHA1 9d7e975ba90242a1204a2d491f4f46c8f7ee10ce
- SHA512 d2f3ee5b572474c451581b3925bcad0f24d0c8a0e8baffa4350ea34cd3c3a1da7b010d8adcf2ee11a3e16c64812a18f54fbded070b6e1481eefa1d987022694f
- SSDEEP 1572864:VC2um44HiVzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXykY:VCTm4vS9NYJo+sUifljLcs22/Z
- TLSH
  T1BE08338A6E21E03FE413D473E11866E9629AF144E7338FA7113F85DEFCE26116B444A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  Installer.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
- MD5 df2352fff1deec3d9690c5957093130e
- SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
- SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
- SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
- TLSH
  T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2