442b7be4a3fdc00bfcaf9ce84fbfda5bee783de888d003aaaf877a207628ca21

Sharing

Copy URL Twitter E-mail

General

Target
doc78258229.zip
Size 160KB
Sample260727-anglhsfj41
SHA256 442b7be4a3fdc00bfcaf9ce84fbfda5bee783de888d003aaaf877a207628ca21
MD5 161dddebfafe7de5daec985e6a785f2f
SHA1 10c116f7f9beb1470454343a191325e60ccc74c1
SHA512 ab8da7145070745bd583d21a552a8587311f001765fd1c1cdfbff69890c9b9d0eef4af7bb3e115f84d1f3eb570b285681f0d02e17180729e60398dc39b906c54
SSDEEP 3072:DVSo9hx12pNrYheU24zylImyM8OUH6YpIiEGqQHYt36T6gkz6oMQ98:pSChxEH0cu8XyMJYp9pnYt36ozPM7
TLSH
T182F312442906F32AAA9737364D69D14E98F2D961FB5D43844A34B500EE23BB27F10BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  _/FVuzfpS1pY42Ot0K/pTrRtyKRJt4fEek8gk
- Size 200KB
- SHA256 ec069df8210f33047a6adc832bad38539c2cf7a38d4b357ad91cb382e0632e2c
- MD5 5e0d3e4c0281612ae39a1e9a38d3bb2d
- SHA1 b6ce5805c8f4ae5c154d9b131316949dec027d2e
- SHA512 1cffdaeaae83aab79c1b8b4283250bdabbab6fb2cafd2251ebd2eabb851312852ba01dca042c5154c8dbd74e56722edd6f021e0fa330fdaa24a5fb8d5001fb90
- SSDEEP 6144:bEUXi4vGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGG8VjpCYp9pVYt36ozJzME:bEh6k9pIxVzME
- TLSH
  T1BE14C0418EA99317EDB60F7018B5C6131DF5FD201475954FB380BE6FB93B682AA1CB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/MoreInfo.dll
- Size 7KB
- SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
- MD5 bd393029cc49b415b6c9aeb8a4936516
- SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
- SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
- SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
- TLSH
  T1EEE1603263F441EDF9DB0B346C334B291D75BC21EA21957F2691098D3DB1A44EE227B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH
  T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
- MD5 a88baad3461d2e9928a15753b1d93fd7
- SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
- SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
- SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
- TLSH
  T1CC526C5421D84BBFD24156383ADB776346B9FB316C62818FC6A349CB6871693A93E302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/execDos.dll
- Size 5KB
- SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
- MD5 0deb397ca1e716bb7b15e1754e52b2ac
- SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
- SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
- SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
- TLSH
  T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/newadvsplash.dll
- Size 8KB
- SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
- MD5 55a723e125afbc9b3a41d46f41749068
- SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
- SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
- SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
- TLSH
  T17702C73972C169F3D26B05F82D526B2E0FEEA035135650228B33A4DA3DA0353FD26747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/newtextreplace.dll
- Size 11KB
- SHA256 156b9b583399faf13c4d46b89339fb0f7f38dc847ac2d7872178d8e3998b9734
- MD5 b5358341df2cb171876a5f201e31a834
- SHA1 df34750ea5504274be5ff8ddd306b49e302d04f9
- SHA512 821dc42e24fa2d44a1d4d16b26c3da2688dac0fa44a266e38da2aff706c91440d83a87abc74131930e6c38a44a0c5e627db2d045375fde147e0edd3276f4b014
- SSDEEP 192:GGhRfigbU26niqo9m+9k15AA1NrW0QfaDx3nxNLr6s+:GIwgSnhv/IaDx3n6X
- TLSH
  T11832965F729645F6EA2259B00FCFF67B8E90C005402B4F6CB79A896CB933E84710D195
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
- MD5 132e6153717a7f9710dcea4536f364cd
- SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
- SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
- SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
- TLSH
  T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/registry.dll
- Size 29KB
- SHA256 acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
- MD5 2880bf3bbbc8dcaeb4367df8a30f01a8
- SHA1 cb5c65eae4ae923514a67c95ada2d33b0c3f2118
- SHA512 ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
- SSDEEP 768:HsKZwhFkGOr0Ga4+8DFFHR4mmw5+64fuKwX13:HLKmGOr0Ga4+8DFFHRrmw5+m
- TLSH
  T117D20980D64091A5E4F678FEB7D2633B462D6BB00553A09713F33E57AD68704BB2392E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  doc78258229.hTa
- Size 21KB
- SHA256 d63df3e8082d7906a5f9d58014b6df19a07b549cae2779d0e1bb337d5c8a3961
- MD5 c5bf6c88ceb624bcaaa62d2822bc5d80
- SHA1 3df30b1e02f7ac44f5a4fccb4bb7f6b9b12c0155
- SHA512 42ad1b19e170274b2437a35cba4f7d78ff4914ab1267bc8df313bd2db49e81915fabf7a823a53fdf465e2dc1cf9d1adc19acfc4c941ec641e6ae0f4ddafad6a6
- SSDEEP 192:K9DtLtb0xuzBP+6JM7FBJMrPrZMD+IiPrfxsWH9FPOJ2na9VnLR9NfR9jYPJPgPv:A7FSvSL2dGS4BpE4ig96
- TLSH
  T1B4A2ADE0AB13DDE697186722674CAF498C733382C1852E79FA1D6D502AC9F21F1F911B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery dropper execution persistence
- Download via BitsAdmin
  dropper
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral19 behavioral20