Downloaders[.]zip | Triage™

Target
Downloaders.zip
Size 12KB
Sample260724-hmdggahn6v
SHA256 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
MD5 94fe78dc42e3403d06477f995770733c
SHA1 ea6ba4a14bab2a976d62ea7ddd4940ec90560586
SHA512 add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
SSDEEP 384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB
TLSH
T14D428E566546F363C363CAFA39A46F5CC8C572268875F283CC82A8EC25944F197076E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/4363463463464363463463463.exe
unpack004/New Text Document mod.exe
unpack004/New Text Document mod.exse

File Explorer

Downloaders.zip

.zip 12KB
4363463463464363463463463.zip

.zip 4KB
4363463463464363463463463.exe

.exe 10KB
New Text Document mod.exse.zip

.zip 7KB
New Text Document mod.exe

.exe 8KB
New Text Document mod.exse

.exe 8KB

Downloaders.zip

SHA256 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
MD5 94fe78dc42e3403d06477f995770733c
SHA1 ea6ba4a14bab2a976d62ea7ddd4940ec90560586
SHA512 add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
SSDEEP 384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB
TLSH
T14D428E566546F363C363CAFA39A46F5CC8C572268875F283CC82A8EC25944F197076E7
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

4363463463464363463463463.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

New Text Document mod.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
MD5 69994ff2f00eeca9335ccd502198e05b
SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP 96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
TLSH
T13EF10901DBD0C7BAC6B703B50C63A6408A79E3091A679FAF28CD41A7AD5639C02D3772
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

13542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

New Text Document mod.exse

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
MD5 69994ff2f00eeca9335ccd502198e05b
SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP 96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
TLSH
T13EF10901DBD0C7BAC6B703B50C63A6408A79E3091A679FAF28CD41A7AD5639C02D3772
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

13542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Downloaders.zip

4363463463464363463463463.zip

4363463463464363463463463.exe

mscoree

dotnet

New Text Document mod.exse.zip

New Text Document mod.exe

mscoree

dotnet

New Text Document mod.exse

mscoree

dotnet