d0edb2636c5da5cbd831c68ad995d51278b5ef72e5bd0e636c74331b3d504a37

Sharing

Copy URL Twitter E-mail

General

Target
troj do not run.zip
Size 125.8MB
Sample260724-ln94lsxbre
SHA256 d0edb2636c5da5cbd831c68ad995d51278b5ef72e5bd0e636c74331b3d504a37
MD5 067d912a796b33985ed97d202abf5fda
SHA1 4dc32f33fb5b58919eed09cff2e6b5a3e931aa81
SHA512 102f3573066860b08339c0c93a7ebb2577cc5c084cad00bda0c2ff73af7643bc9ef7aaf556def71737bb9c4faa0cfbc53fd7267e9a30b2312c6c9eda57be6fb4
SSDEEP 393216:RSswVFTAM5zXR8z9fu/TOVCEE0oG2mYX0RBt3QJWJQgYgOOiSH2tw+0rnZ/jO57h:ks2Dihug9otX0vBPYz5SQH0TZ/ihp
TLSH
T1F3583305CD2CE7D6FB9376B8B8B09057D92F51B2368D919539E831F4AD8AF006F2890D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  data/.KYC
- Size 176B
- SHA256 644a42f1250ee2cbb51319fcf77d0c750ce065300c60278f686f854eeb6398af
- MD5 28497214a94f831afb02870df8f7cf70
- SHA1 69f7510ebbeecf780d261b572ca707a7050c430a
- SHA512 119ff3f83c02329bee107cc486183e523314093281c14d5c3f6a3cfcaac70a895bc269adb81d7f10c9dc63a8f55e4fd3bfb6c923d74df2d50333ad9f99b23730
- TLSH
  T1C6C0C08B12063088D4042176F7CCF52FC9042892412B682C93C4A28841B9026F8001F4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1
- Target
  data/python-packages/planner/file_sys4.py
- Size 16KB
- SHA256 ca69ea3c9ee80d973560a0179723c8ac4c017c1df143b1c842e7bb8c68de4af1
- MD5 eeb566b93819636558513c2085ac0ffe
- SHA1 92e3a6da9ba511fdf2cfbb11b820ad43fbf69d2c
- SHA512 4798931b2e5944c6e9b1c17d720d269be0a678b9d3049b1cd2575517c2de65c52afeaf2bf302adbf77205fb6ab1ad2dc0a46a16f576f5e7b6e8fb6cb79a47891
- SSDEEP 192:MbEB5E1xnCHPsuWM98GSdwGrXDwgZUuXPzbHrfs/oCJkcA6U:FuXn2oCJFg
- TLSH
  T1FC72E0C3874C5AA5F322430E1C8B778640A57C97162CD99C7AFCC94EAB81AFB16E7474
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  data/python-packages/planner/internet_acces4.py
- Size 1KB
- SHA256 b18a7fd0b8d76f60c91c8d670c6992d5c5871fc6f89f9d3c24d98bd0274cba50
- MD5 037e65169d9a5e2b7e36dba21188d54a
- SHA1 e56e9911408a1a24e993c655f7db41e704a7b675
- SHA512 b629b788e79eb2e07f16f2547b0d86d5214f7335b46a3b1114e6ddc345e908f6a255642e886fb67058c4202329b07f2bf9af269bc6fee04152724556612fbea5
- TLSH
  T17421D1C7834E9855F312831B484BB70AD0492CD2266CD95CB6FDC80D1781EF395C74B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  data/python-packages/planner/sand_box4.py
- Size 6KB
- SHA256 e386e9107a161c99a7ceeb05892fed551b8ecf8a17a6f9f864475552387f3a50
- MD5 8061528605d040160db69bc99619625f
- SHA1 fd6f4c770a47d0acae69a3d37906a8a2eb2e8f69
- SHA512 3586127841a8aacc63eddd3bc09f07459127040d82acb6174c2c58d61eb8bb3ecfa399c6a8d64c665e88b01b769ddb9f157e7be4a6a5d6a543fdab2d94e4cc78
- SSDEEP 96:gMML9Kvjuy+zJyT/Byf/u4m74GbDYNFfr2FaFfaOAPhjav0CR2iKLJx6OSdmFZI:WKrGJWBei44DooasCR2iKLJasvI
- TLSH
  T159D11EA28A0BA820E34BC5195CC7A75653393E43064CEA6C7DFCD41C6F116B39AE7CB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  data/python-packages/planner/spec4.py
- Size 22KB
- SHA256 3762b4261cc85cde5795c52ea80e05ae3e26a172cc9f29ba39836b6f6f014dd1
- MD5 ffc931258d2791b869d0ccb771a76d10
- SHA1 0ba08979d60aa68d0d442df16c99a2622d7578b0
- SHA512 65b6908c63ef9e5b706d5088bf243f95e306247746f9ef8f52704f98a49b358f8ee10eca3ad6189a66f93edf9ffc2ae0620e4ab3077c00a6235cd7e43c910619
- SSDEEP 384:+rYlC3x95NtEEjtVtaxatwy2Pjk1WhZHM:+rYlcx95NtEItVtaxaay2Pjk1WhZHM
- TLSH
  T188A267C3C38C9A95F322435B18AB734A80856CD6165CD99C7AFDC80F5B82EB766D34B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  lnstaIer.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral6
- Target
  lnstaIer.py
- Size 8KB
- SHA256 5a2d8e648e3f4cbdcd32cbd2bb0ba48d10de32fe14042e201a8bb7088cefad79
- MD5 f82bfb01fa17b87134b14fc21ddacb74
- SHA1 7b2c9342a390253dd012d278a2b9ea83e1759827
- SHA512 ff3d5de26bf951e00cac2c8bc13fb015235de569c6edf95e8b2800ab3a4126c974d817dfbf475b4a9b57ff0b0306deb0e389411f43162fc7aeb8e970b50d8aa0
- SSDEEP 192:7X1dwQHjiJqdt2RqEq1ShhKBqMJx45KB/H/osX3qzbFsqLdx+aHv8UTri:7wKiwdtzvMhhVMJ2KNf9XatLn+A0H
- TLSH
  T10E029696B5D536918313AB58D8D6A0C82217E9E73EEF11783ADC33647F6091043F36AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  renpy/common/00start.rpy
- Size 8KB
- SHA256 fd2cdcfdf5247d45037e93fdb54200c2bd56c4718edadbf343427a3c922fb920
- MD5 752343739264dba232c688b7f06aadec
- SHA1 566ed36eedcc8fb38bc82c5189710f7e9f5b85ba
- SHA512 e96f50d74342d0de98977be887e57da67c189c9df3d97f2f05f4631de1ad92101a6daf4c42190f129b2a0002eec7af91fae489054d182612e17cdf1b5231f50d
- SSDEEP 192:P1dwQHjqSKZ+98TEME7pHTEQpTACYYQSfIYhbeFUYqmyOj1Q:IKqkJ7cYhbeFUYqmyOjG
- TLSH
  T18412B4A5301290339752990DB4CBB3687333A95B8FC624F87DEC823D7F9579085E1ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  renpy/common/00start.rpyc
- Size 10KB
- SHA256 c9afb98b06f3839d8a49c3c9b530a739ffa8d5233051d3fc5867554820e88fed
- MD5 29c89ad3460b07abb7e0ff26c88e7daf
- SHA1 b18caa0deabfb960a5eea93344200e3f1e01bfea
- SHA512 9e125f687756d1b04003ee1e88fc4dcc2169e8037dbdc8da61ec45faa39b9e3cf483de75dc4f801b81f990488f9de924b1995b8803d25779040bfaa66822678e
- SSDEEP 192:4x4dUdqZYtefvRnC8jfwBweXWRx4dUdqZYtefvRnC8jfwBweXW4:Xdck5fvRC8LwXWMdck5fvRC8LwXW4
- TLSH
  T1A2228DB744A31302E1105D9BEFC640FE809BCAB8DB409D4519B341ACE5F5A6E5C2E4AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  renpy/common/00touchkeyboard.rpy
- Size 9KB
- SHA256 24de5427dccb2deb89fc3d7ef0fdb163a3999a23b741444a948ba2d52aac526d
- MD5 02fc42da5266696c1ee27be996cec97b
- SHA1 dda8b03f8939228f5caf30d1a9dae4bf260ceb8c
- SHA512 30837c30c0024f74278606da944bcf70feb30f8f1d921e50882e0ec2fc0be5d27bcf6ec96af4c5e86c98f8f0756f5dc246658e94aa948fec9cf9657ee8dad33d
- SSDEEP 96:5zPjdwQHj1ohBgijwIwT65/vDvdYqDMEtm8FXFik0vG4k8f9M8n8q8Z:5dwQHj4Yqw+HmJ9I
- TLSH
  T100129767E14C5B10A75FD07C2097809E252FD68B0D48E880F91DE8D46F66BBC42EEE5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  renpy/common/00touchkeyboard.rpyc
- Size 18KB
- SHA256 87c1e750de157dd2e99996d9f1128fece2ec866c24702d02da0077ea28eb8a75
- MD5 19fb21b7ff42b2dd623686f3d1f90c5b
- SHA1 7df583956388b0aecc1cbfbfbfbc23c4109588ba
- SHA512 91083ef4f6149eb947942c9d7c56aea87bdf83a313778925a292adb084189cdacf22c7969f24956c9af568bd80bebcaede24deccb84929a22f72b97ce33306c3
- SSDEEP 384:AJ1eu7ycp4VrbXKyiPv5RqJd8bPN41eu7ycp4VrbXKyiPv5RqJd8bPN/:AJ1gh5G5RMdu41gh5G5RMdu/
- TLSH
  T1ED82BF1DC5F0363252FBFBD5CD9BB299FC8E15898159C9E882608A646633D3C9CE1863
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  renpy/config.py
- Size 39KB
- SHA256 a3bb297cbe266dd65252db518850c63e32da6b5fd4249fe90802b68692e9fea3
- MD5 79fef13bf795acb34c187530bf0acec8
- SHA1 e40236a9769832373481bf3d1e6e48d2b9646dc2
- SHA512 9a90fdec5da1198c35844845d2e46a71ff6788c846616c223b71cbc694bdcf27be4885028e2caf5a0c38077cbcf577be500d16c7d10ddaa778ea25d82d1c2989
- SSDEEP 384:BK9G4igkMgLbMT7yoq5EBhI+GyfxxgtJrwCfXiDRU7woJ7MSRvsC0FceuhF:I9L7+cWoqYC+GKx+rwSZw00FceiF
- TLSH
  T15603C83371E6333604667282F5CFB3BE4538C5789BA66160758DA11CDB09D2A82B39DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  renpy/savelocation.py
- Size 16KB
- SHA256 2fcd8f8dd88e85fd689a91db1f98c7ab7c5790d3b871b1f89420e27db3bba8f2
- MD5 f2ebeb1c88bdbf6a83d5a9166c5be4ce
- SHA1 7b0f81828ba628135936ad5b91bbe75c00c78154
- SHA512 e12ad95f3f90e752324d6242abe719c4af1ea11a38f4e09df601cef26c67a84d01c7d1e50b62cb150d55766c6b53da72fd08dd4d153772a4c4e6ed9446fd7473
- SSDEEP 192:w1dwQHjOO8TnRYMl+BnCuwJuf03w/qKQTQLaSzcXxYSuzgWdUUro:BKGNUVhOchUgaSzgHubu
- TLSH
  T1F87211ABE80A59A2C397E51988D3D057731BBC9B110D1138BDFCA2986F0427CD7E2DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  renpy/savetoken.py
- Size 9KB
- SHA256 85d5d1969488e29f41cd083882f338071ae372ce40c2c2a1c6c36061610b90c0
- MD5 64e38a4d1219796f141482fbc2fb712a
- SHA1 a0c40fb2973ea37b3251ed7f177839a544b33273
- SHA512 57024236399ff31340ce497dd6624de16693ecae03c33f0777f7591b2b3b5239d9d160bb271f442e27d02fbce3f981d3478bc877a4c8086bbff6bd89a1bda76e
- SSDEEP 192:w1dwQHjkddByXX0LcFQ5d8t5YTnVRTU+k+qt8CMdU3ESYfCzR2TfGs:BKYWEgS5d8tqTnHTM+JmUSqCYTN
- TLSH
  T10F22404FFC4656A1C65F886D89A3C050BB6AFDE7129056347D9C92FC2F8522093B35AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  renpy/script.py
- Size 31KB
- SHA256 87cfa665f08f093a2c51ec9ff4cb176c120629b911c72d541d6ea4d28a1bc432
- MD5 4d8f391a7c95fa1384856be4a1435073
- SHA1 94b2160decc7dfe2637a29360fae553b63c973f7
- SHA512 014b20ce69f32d7a53aa5917529ceebf89603ca98d399c67e607facd62e64bf58bd5b8362708b972a5bb5c6bfb7963a440aab21cb8e55bcb71d27c5ebd44a99f
- SSDEEP 384:BKnN2QDtd+5IT908WK8LEANmQBXXxJ9sHv86Hc5TM3VnaK75QA2e+:In9DbW+wHdGJ3VaK75Qz
- TLSH
  T1CBE2D70B9C055962C383A8A88DD7E426631BBC0F76541178BEEC929C7F00635E6F5EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  renpy/test/testmouse.py
- Size 2KB
- SHA256 252efbbe35dd3fcc4b21a955088f30c4e54edf97cd9c6025fb7d165e5d974e13
- MD5 f5fc2c126a2b100f7b31c9ec417ad2eb
- SHA1 1e6094f6878debc4b9acafdad802581c42af4fd3
- SHA512 71a02cc36be5a7114e716680040e66cbd390e64d97b248ff6d6c9017bbefbea420093ff210a9a8f02eb8ddcb38fb80fcaa35187c8ea282947ed6a0544cede769
- TLSH
  T11C51405FE0502B9317AB5BB821D7D8987779664F189838653CFDA2882F9082081FEC4F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16