8373dc9a49836b44f2b6395c046a9b7b1e1771614d151d993ee1661cc7b834a7

Sharing

Copy URL Twitter E-mail

General

Target
Saikonosutoka12.rar
Size 96.0MB
Sample260724-3taz5swbrc
SHA256 8373dc9a49836b44f2b6395c046a9b7b1e1771614d151d993ee1661cc7b834a7
MD5 ac98656aa16c88fd9eed64db3559ac14
SHA1 c0829f466a09aa295cf9064c9295200265a74202
SHA512 bdafd0e4d655163e24298f7c489450492afbcb84adb016c81f631104b1d23a73f6c4d98771d49c6d18866b5c2b5446bbe96f4c020ceb7ddfeb27ccc67ddca1c7
SSDEEP 3145728:NMcCDoc3BiwbU7ekgxvaLXXKdq2ysog3vhrATss79:xCRceBJyKdqHwhrATs0
TLSH
T18C2833687ED6393CA406B0F6751C58657A63E5E3BD0C5F47F20321B1E1F89786EACA02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Targets

- Target
  Saikonosutoka12.rar
- Size 96.0MB
- SHA256 8373dc9a49836b44f2b6395c046a9b7b1e1771614d151d993ee1661cc7b834a7
- MD5 ac98656aa16c88fd9eed64db3559ac14
- SHA1 c0829f466a09aa295cf9064c9295200265a74202
- SHA512 bdafd0e4d655163e24298f7c489450492afbcb84adb016c81f631104b1d23a73f6c4d98771d49c6d18866b5c2b5446bbe96f4c020ceb7ddfeb27ccc67ddca1c7
- SSDEEP 3145728:NMcCDoc3BiwbU7ekgxvaLXXKdq2ysog3vhrATss79:xCRceBJyKdqHwhrATs0
- TLSH
  T18C2833687ED6393CA406B0F6751C58657A63E5E3BD0C5F47F20321B1E1F89786EACA02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Saikonosutoka12/MonoBleedingEdge/etc/mono/2.0/Browsers/Compat.browser
- Size 1KB
- SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
- MD5 0d831c1264b5b32a39fa347de368fe48
- SHA1 187dff516f9448e63ea5078190b3347922c4b3eb
- SHA512 4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af
- TLSH
  T1EA3171A238DCACE0ED7300B3FA1F14897F1A897F5B8A1505748BA1560B019B443BB39D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Saikonosutoka12/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Saikonosutoka12/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Saikonosutoka12/Saiko Sutoka.exe
- Size 635KB
- SHA256 394e97098b780683431d8d98c24651d16247bbf33ce4ec8d9012bd9edf673c8e
- MD5 a59422b564c7bf299364fd6f4d6ceefb
- SHA1 c169c5b5854729cbf0c21908c756f79d32d1e2fb
- SHA512 36acbf120c6fad57568236526173580370911f9b5308ec0792eada6493b4148bbbb49d9b6004a164588b7692d1f1a6f7968b6a45ea84960381fb0ad7df97eaab
- SSDEEP 6144:M/7oYfSHQPWTUg4TpyLDI3pmhljVt46iafw/xCglbjvFo5sKi8YxkV:27qTUjG04ljVtd4j9OsKi87
- TLSH
  T176D4F091F38C5CCED41233B6B836E9916156959AF47B8E1A113BEC22F9531C31A33D8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 616KB
- SHA256 5bb3034322952da24caee519be90105a72f3ad3f5de07e288c67a9009b95cc69
- MD5 048b45abc50cf4cb483978d3939b1676
- SHA1 fcb23cf80bb57787ea62e33738e56ab1e1957159
- SHA512 56aacbe766685402e940181bb672fd287f726f23b42dfaecaee79067d1e155b61b209ceb85619c9b3133a87d9699803fda9079244892e72eff20774e7d233e02
- SSDEEP 12288:90eUKswxG67gjXqbgxe3wONLlSnvSLQXue:90HMwONLlSvoQXu
- TLSH
  T1A5D44B1223F81637D5AF5BB6D06A1815E3F1A457A2AEE7CE4C84F4FC68637618D02393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/Assembly-CSharp.dll
- Size 455KB
- SHA256 0ce72a8743737ceefce4260e019a13fa1ea82bfb760f3111e194985b1f420c7d
- MD5 e4ad4c6b452ffc0478cec58f2156d89a
- SHA1 76d90d7b6c2caaf93aafcc16d8cce196ce8d629f
- SHA512 4d881f2ceb03414ab7940a295c520358c7f5b8291e3ca11c62a1d1515c283b7c39de9a8ffd25a706f4fc7afed18f45eafb6c10636b944e6bd2c1620fe5f1df1c
- SSDEEP 6144:g+1z9DEekT6cNoH7AYJhm8YhcwSmtbGnn55+ZkCP8Ji1+FJFQgxDOuBc:gY5jswc76MYn55Kkkz+ZQmO6c
- TLSH
  T195A43A3276BC1973D5BF4BF6A420194DA3B1A047A9EAFF8E4DC1A0ED18D3B509905723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/Mono.Posix.dll
- Size 207KB
- SHA256 6e1c5db7586ab1796bcbefdc81375c215e01843a972020a5e08dcfe83570c949
- MD5 ab7ea63714b22a38d5a267a106d86020
- SHA1 5135687708ac619502d2d882a1546d7878ab003a
- SHA512 a0be050181a2550a712f5349c05b21aab51a42c1d5aa400da1191f313767e6d08c6e3c9aab7125dcc1a59525f074a120b12a3d13efca0eee7e40e474d04802de
- SSDEEP 6144:ec9wE0Q11JQ1S+OWMYU7nUXxOwblnsAPeeE:ec9wE0Q11JQE+kY1SA
- TLSH
  T191245C5457B44609E29D6738F8732F098379F88E7E13A39D3799EB391877BC488016A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/Mono.Security.dll
- Size 302KB
- SHA256 eb9fab2c68e7cf64db20f676353520344f7220dbe830c904e1bce82ca087b7ed
- MD5 2316c1c6703e487bbcf694880d7b7d1f
- SHA1 4976f4402b4d9c308b3c86e07c7b675581750ecc
- SHA512 f053845f50e620f2ed3bee11f26b294b2716c9f6a073bc543c977c9e880b806e837d1f71cd1f37e74bd92348c5cdcc1c3ac39242785c4f94df19051d77eef04a
- SSDEEP 6144:tJvWNTGENjTzSQfGFzPTzcyaksosrjn95Aq:KmFz9mj
- TLSH
  T17364592923E8632AE2EF9779D071441647F4F506BEA7EB4E5C8250FC2C437929811BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/Newtonsoft.Json.dll
- Size 395KB
- SHA256 830e019e1796b4eb5a8b0e72824972a70c4bd266428ecd1770e680bcb6861bdc
- MD5 b430e0b62072662df3bf84fb33ce6ee2
- SHA1 4d2d53ddd76c0ec4031feb2877f897f08dea9c8e
- SHA512 fb911ed5c136b33965767c2bb826a91dc7012bfb762cafd247f950114154ea42e2e7e1399d7ad82161b52834b8afecb2b90fc5c77cc788ff9144d5c4a725e098
- SSDEEP 6144:XkQIZDYZ3y/KOMKpghLQGgZRQxRABRFDngLy/1GQjdaQkgCY:qhtphZRQRAB6y/oQt
- TLSH
  T124844B20E3FC8726E5FF1735E434560887F1F947A27ADB4E1A50B8AA2C9775488603B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 6a23b3bd81ce8e5ea8681e92181e8909266da5b6ab5c414185cd2ace01bcc4eb
- MD5 f2c529744bf4a6b40cf08207e68a005b
- SHA1 759ae613b4dd05dfdc55482ba9e575310d3bef00
- SHA512 50c64d16e4485b5d4a14cf99e4bb76945278b4271b1f5f4f034a01daf28a075a50db5c86b3f86c75c46267b7cbad8c4a9accc08c54245da2b43d2fcb6c3ec5c0
- SSDEEP 3072:aH3xt3GrHyTALVXzA4k8y3Kpn5WJzL0MIegH4+:aH3DcSTSVDMJV
- TLSH
  T11DC3F82563EC876BE6EF277AF8B514100FF1FA0A6436D74C5D99B0ED1823B804662763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/System.Core.dll
- Size 1021KB
- SHA256 a8ca3de873188598bd6b870f48fbc85ca57d24ffe054a4963dcb9c9eeebf55e2
- MD5 4b2b01e0df1e90ff03d0926cb54c7f49
- SHA1 932d8fb3944b71486513fba6c169c2aebbece1f3
- SHA512 9b6c06098ad6db6cbc5fb3045d321050481722b18e431e664079ea566e5939e25f8f0ed48af896613f60394b4ea416138f9afd7ac46c07653f5cc10c72a5a68b
- SSDEEP 12288:DDQR1+Dy+BcB5Qud7DfVsL9KVI36owJKbYuB54wkHXdt:Un+BE5jVsEWIWYuB5
- TLSH
  T192253A5277D95A2BD5BF7BB7A038022057F2FC639FBAD70F124069690C62B40DE543A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/System.Runtime.Serialization.dll
- Size 906KB
- SHA256 f515ed871c5b5ee6c3aa3e5e44ee78d9aa6c995dfaff17d7a05f5761f0b2b5dd
- MD5 c6b0bf3fc4ca783ca75042f74bcb12a7
- SHA1 69ef3dd9cf5e0adf5597766ecb28682e0156a7d5
- SHA512 6194db571d690422b414bda18135ec890359caafadcc219d8c4b39e043709bcd6ceb6e605de06cb82d3378d4375089f41e4b4269f4fb9c338eb46a28892e5883
- SSDEEP 12288:TDxoDU2+ZxFnHo13Z1ODBCtQAvLlqvKL:TDc+ZbQZ47AvLlqvKL
- TLSH
  T10F151A0077FC9617F1FF7B76A8B506948BB5FC1AE9BAC70E4600916E1CA2B409D513A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/System.Security.dll
- Size 180KB
- SHA256 bf12669bb93a6b8971ffe69702d9d8a99525fcf025fcdecc1a19d6d487f862a4
- MD5 2eb690f489620006c6008b0442933a7f
- SHA1 0a94d235b94091fc9361849a42b70d91f8b29378
- SHA512 9b5a23f1858c92e494c2c22350d82a6b76401aaa2ea6f06f7722a91be8032c6f9bc36ca8fa9e3eca1a252db5c24bfb625392827f7aedd21489172cc31d948413
- SSDEEP 3072:rr8JG/QlTReXnVzW72nDLR1RNdxz9nI/K6ZoedXHpnZQeU1GGeEebgUKFzODhSKh:rr8JpeXnVzW72nDLhZz9J4oQJZQeBGeG
- TLSH
  T11F040824B7E84319FAFE577DE0B411065AB1FD06BA7ADB5D0E9112ED0872F808812B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/System.ServiceModel.Internals.dll
- Size 209KB
- SHA256 6dbc7b2324089821ed32b8dc716983672f3e69dee1ebaec7a87066df3b141521
- MD5 603180b58a2f1347e474032f5e425e06
- SHA1 02a87e85f33e4d09eacaaa8cfadede93d18b658b
- SHA512 a76a76184bff77c8eff5447d7d0589b4185f97363afdbb69dd849abe78a32a7b7c992e60cf42838b1697ab28e06f267dc6fc0cd73250e8dba1552c2b6383417b
- SSDEEP 3072:rTFWqTJtv5WbccyM78vqcqO9jft/ixGVZNCVlyDaD9rvVk9Jk268Z+hNVtUXE+mb:VhyyM78vqlmjfF58lIaD969Jk2KQ
- TLSH
  T191245B24A3CC4F22FAEF0B7BFCB1649053B9F512F89AD74C6D8451B94822B54CA51B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Saikonosutoka12/Saiko Sutoka_Data/Managed/System.Xml.Linq.dll
- Size 116KB
- SHA256 88cefa16fb0042ca4efd9acc63a476a96dac91513153facb8e274762d56a9599
- MD5 047ccbad12a5d138a884a4ea3c17c217
- SHA1 5f62c9a133f2cb0459fb58e9dd17dd2bd918c2a7
- SHA512 b6f912501be8f963d6254002a256e043779a4f078e7c7e4d0258019d9f5a9a03182a46656f4f388976440e9a37378fd2a2eb237864a611ebef6964bcb495fb40
- SSDEEP 3072:RNU5ioEWuB91Z0S2V9Pv4frb8QfE9Knt8ZtSa:dBEzPvsrb8OQPt
- TLSH
  T1BDC34A243BED8B27DBEF93FCF470651557B6B466A502E79E6854E0FE18437808A013A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32