91326e44042c9f02b21c8c29fb32944b57ff2ca7d8639827578ee07507c883e4

Sharing

Copy URL Twitter E-mail

General

Target
dwmlut.zip
Size 92KB
Sample260726-2sdh7sgd39
SHA256 91326e44042c9f02b21c8c29fb32944b57ff2ca7d8639827578ee07507c883e4
MD5 865934e91f9096b32253f3882a1cc43a
SHA1 2b696db69234cd69df49d40c59093ad534fd9893
SHA512 dac6e9af9b38c66f6e98985a370bbf06d591b6f660a788bf18b22c6f9062a3914362cd105227641c4e9ff365cf3828696c3cebb0051e79ef35242bee07b4cad4
SSDEEP 1536:mk0Mx/ZiWf5x8kT8C2KdyYXh8EfT2YX48JQfw2wIehe18QOiXse8sm8uZCVLJwj2:33nLT8ChSEfTghfJ9D18tTeW/m2j2
TLSH
T1CF931251E6BF8D0FD1F79B95000D237BB73E1886098CA24B2D13A78F9D928C8C95E4A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  dwmlut.zip
- Size 92KB
- SHA256 91326e44042c9f02b21c8c29fb32944b57ff2ca7d8639827578ee07507c883e4
- MD5 865934e91f9096b32253f3882a1cc43a
- SHA1 2b696db69234cd69df49d40c59093ad534fd9893
- SHA512 dac6e9af9b38c66f6e98985a370bbf06d591b6f660a788bf18b22c6f9062a3914362cd105227641c4e9ff365cf3828696c3cebb0051e79ef35242bee07b4cad4
- SSDEEP 1536:mk0Mx/ZiWf5x8kT8C2KdyYXh8EfT2YX48JQfw2wIehe18QOiXse8sm8uZCVLJwj2:33nLT8ChSEfTghfJ9D18tTeW/m2j2
- TLSH
  T1CF931251E6BF8D0FD1F79B95000D237BB73E1886098CA24B2D13A78F9D928C8C95E4A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Release/DwmLutGUI.exe
- Size 61KB
- SHA256 ba4b9220104102cf5b41c1d8117d5dafbae1aeada66af563cb3e4d7819b0a792
- MD5 10b8482d583e1b08f453570adbb47059
- SHA1 2336626567aa5e24a3b09f06e8ead1b2787772ef
- SHA512 7bf08f23bbcf33a817e0fb69e1600283da136f77b6a72033a563f6e32b0169b890497a9eb2bbaab7ca3e72eb52f5faa18edd447b108da49ffa480005543802be
- SSDEEP 1536:gaxJZCn5ohQTbKerq3jI7UhIJsBpVJQ2PXwVcl:gaEomTbEIzIJBPXqY
- TLSH
  T1DB535B4173A8C521CAFE063A5871934467327A8F6B92DBED3E8D14AC6EA735142133F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  Release/DwmLutGUI.exe.config
- Size 187B
- SHA256 f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15
- MD5 15c8c4ba1aa574c0c00fd45bb9cce1ab
- SHA1 0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8
- SHA512 52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4
- TLSH
  T1B4C08C4940A8BD278E334B235752C52AEFB073A3A424140CF02FBA660F3128D865737B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Release/WindowsDisplayAPI.dll
- Size 65KB
- SHA256 b53a976a8e669cf59783409fbe453222eb736d4f9642e374f8c52087dba8fe86
- MD5 42b33b211f83246d7ea53420869d1733
- SHA1 1cbc13b2f46bd04f93ed5916b3a0f54d160e2a94
- SHA512 779451e87631f4cf6ee789f57ed1ba76e63ba1ee77bb31a72c06758fd3559fb2d5327ec6c8cf290bac08f957d4f3f481c03d33ede65b6566f1143ab123ef347f
- SSDEEP 1536:TkXKFDm1eNMrX5Y5SdQB6PBAiCs4mRTZ4CoKnVI2FM236:tpNMrpkAPcZmRTmCoK4/
- TLSH
  T1D3633A25075C4BA7E68F4639F4690A2217F2D74E3163DF5A1D8CA8FA6C83F8506213B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Release/WindowsDisplayAPI.xml
- Size 107KB
- SHA256 338806b7f6e4b64181ba3608412aaaeaa942da28e8c1576dac7c1036691750f2
- MD5 fe8c19d56a84d2ea829943fdf453db12
- SHA1 d63eb79d054a79c70f998f66df7c67ef080fb132
- SHA512 3d6d57e7b80d3a35ab4b8c736c5ed2a85b531280b1eedf504b28c4338c0a22a91476c692f2743c78ed63930576505127002329db78fc95d49f185ce615a9bea6
- SSDEEP 384:ZJ76747YKZwgeWmysTq0Wodyb1DrhYyd1eiZ3RszsEsfsiwfJhxmmm7GrZgtiLFm:nS+QE4tePmjy6Q
- TLSH
  T185B3891666C09D11093393124D6DBB86EF750E33108A5A1A7C8D3E776FBBC87939B892
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  Release/dwm_lut.dll
- Size 56KB
- SHA256 342c564c1a64d5764f3ea0e03e809b0686fa128ec7e314edff22af0a98e23b7c
- MD5 a5a79acc9a8c5a9a5e23919393fb9880
- SHA1 3ec235cebe3facb6a482b003f04a43e6facbc606
- SHA512 fab3e9bd4ba21fb3a3d1ca17c6dcea04d58ae7272656cd451546969b20d1f76845a9cf7e738ad6f7d7ee6d3371c3fdd91a25616cb3c5e06f2a706996b4882517
- SSDEEP 768:xjLhf81XCplL1ulucrnx/tSABVR96c9WtYqyA/P4oBHlKEmiudqPGA8Q8JLCz:NLDplxulucrbx9j96xFVudsZCLM
- TLSH
  T1F8436B5B33A544DCD929827CD9935606D3B1BCA40B119BCF73A4C1780F237E9A87AF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12