5c54bc6bd342cdd3b814b3eb37428d794506eaa8fb17c9657c8c9e67b2c209b2

Sharing

Copy URL Twitter E-mail

General

Target
5c54bc6bd342cdd3b814b3eb37428d794506eaa8fb17c9657c8c9e67b2c209b2
Size 10.9MB
Sample260727-ewdbaavgpe
SHA256 5c54bc6bd342cdd3b814b3eb37428d794506eaa8fb17c9657c8c9e67b2c209b2
MD5 a2e8dea5f67938784fd849f24bca9dd5
SHA1 156563522674088402861bc0414eae375425bc95
SHA512 50f9f048f6225563a206b2b9b47a9150254b040bcd9ab56fa9d11339d5e98a6f0667450b8575220aa462dcb15915a109c67f599ef8a514838e47243eeba674d5
SSDEEP 196608:DfTr4EFiSnvUvw3zjUBy8HaFtCzLcdT5JyJWWFCbv+eqJDY//4s:/rhcSvU4E0UaXCvgkkWFCb+g
TLSH
T133C6335D8384C61EE9047C7A93DD2A3389511B5AD9D02804EFE0A7696FAD4F21BF343E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Public/Desktop/Google Chrome.lnk
- Size 2KB
- SHA256 2d15ba7b80c4b0d8ac05baeac4cdacef5ce84ca757ebf567d7f813f382d6920f
- MD5 428f7ac1575d2109e4ac584d1d052450
- SHA1 96b8df0ace538daae52ea5c81fe9fab796aedc88
- SHA512 2b34be4c123007f02c380434a6b38324d2f318aff2faf1ea9b75855ac3769aa0056f6ad7fe78c858acadb303bf0bb7fa01d161261d992cdf86edf665d5fb74bc
- TLSH
  T110417C1577FC0A19F793D631A9733B218F7BB8179218292E11C9428808AA2D40688FBB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral1 behavioral2
- Target
  Public/Desktop/Telegram.exe.lnk
- Size 1KB
- SHA256 3c01c1d32b421af06701ead88be001774e4f854ff3a58a9ee8c60ff82df35ff7
- MD5 8eac599cc1df59686fa711dbf36f9632
- SHA1 2abdc6dbb914b14a6d729b0145af4c714aa7393e
- SHA512 77724102f60634f855bca3e5b65368828df92d9de834dbe015d68f7be8ba5bba481b31a4da725d20755fdb44c42bdf62668d9805e7528db757b9865f71934c39
- TLSH
  T1FF2155491BD90A19F3E765306EB2172699FBFC01A66463BF02CC1568047B684876CEE4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Public/Desktop/微信.lnk
- Size 906B
- SHA256 387e45c6ba33ca4f8a25da242f73dba1eb9fc346d8ec9d84dcb1a24bb7588228
- MD5 230ece21fea19971b4affb8c4eecf065
- SHA1 ad7faa2cc375e2f8e09d397198f04a1604affe37
- SHA512 93e23b9c7dbf4f83b78f1d1c86320c51ea7250e8376d7999042c4f784aa824a7f513c0c4aba907aacfeb373ed484f8ddf6c9bc1d9f8bbf3620c4d2dae5a569af
- TLSH
  T1F211682227E80B2AD27B36701A325B92C95AFC5A9FB1A36F6185418C08943D94B0DBE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Public/Documents/123/PTvrst.exe
- Size 1.2MB
- SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
- MD5 d22cfb5bfaeb1503b12b07e53ef0a149
- SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
- SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45
- SSDEEP 24576:236U2S3pGraO1AIqgfhIqI9kdiBagYov0YmUZm6:23XuaOBIqIO5ZoBma
- TLSH
  T1E3453355E31EB40EFD003E7414EB9FD87A0B41216A47994AEDE373DE2CB017269BC859
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  Public/Documents/a1.exe
- Size 5.6MB
- SHA256 47d874192d3a06e8fa990c7eea9600d922ac3ccdbbab8ed3d0f44ad42f4395ca
- MD5 4b09983314f71eb159ed0e153a7d0408
- SHA1 c2d6ceca9cf667cbe0b18e68cc971180ba612a2f
- SHA512 97a13aba9f1a0c0544e3b60da4e0cd50305bda3b5aa0663a91cd0d60f5a38db6590dea66c4a663dd8381dee1546dbf4373d8a1f69026753364264621fba3e656
- SSDEEP 98304:rdsQyxTgS8ki4urC7+FhvTNV6uQclkkZ4b92Fd7RsD61xPW8y9MbEMCfau:5jyxkVT4N+FhxcBKyb29LyKbL
- TLSH
  T1484623632A658047F4E5DC39B5277DB030F23F578B41BC7A65BAB9C215238E1B31298B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  Public/Documents/backdoor.exe
- Size 94KB
- SHA256 f37ce41c30a747fbf5fd08b4a02fdd4affe8618ab320b1deaf4e6e414c190807
- MD5 86a3ea2f2de92f83cc764d784341bb7a
- SHA1 dc7e2bccf77ec442b892e3fc4c9cf2510d204ba2
- SHA512 d59a99368c4372995987cb4539b26eb920ee8388e2f30926832efd3e0897d822e06868e4778cbd035b994a6257151a4188a5e54a619496b743b60c1a9ac1d98b
- SSDEEP 1536:9QP06nTyJptrZOuqEl6M4BvoGi7YPQrG8l+dc0sWjcdbqNPhAokVySyo:qMHtrFdIXvoeM+obqiVySyo
- TLSH
  T103937C1376E294B0F4A7023669759F018A7EFDA55B705EDB3388128E1A352C09F367E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Public/Documents/bitvise-update.exe
- Size 782KB
- SHA256 e09d50599131145de6a87e8fe8d832899fef4e232a9ae76f31f6ed90768b5663
- MD5 0c0c19d98b9075df67b10b499ca9a45a
- SHA1 15069e1d503e5b3fec117ad7248b8798c10406a5
- SHA512 552b158e5386229bce1c9637c00ca9eea32add9b6efacc09fbb3af79c34604e3d6e7ead8f6e141c30659e713a71848c50bfb3cf44686d5776636ff82f035075f
- SSDEEP 12288:3Qnk3GDYKGcblWYH8s9/KFBoQuQrcnGPrpN0hC98gqQUplRXlWUPJtLc:5AOcZtHtiFVvDUh9zXB/A
- TLSH
  T1D4050202F6C2C8B2D53319325A2A67299A3D78301F149F5FF7E44D6DEF74181A225AB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral13 behavioral14
- Target
  Public/Documents/t/spolsvt.exe
- Size 16KB
- SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
- MD5 cdce4713e784ae069d73723034a957ff
- SHA1 9a393a6bab6568f1a774fb753353223f11367e09
- SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
- SSDEEP 384:fnUgXcCS4RI7nHhhZEAd2ouJNYFYPIN/qHMEU8gWmmW:sycC5R8nlEC2BEYPIMHKP
- TLSH
  T12A72294133F1C87EE06358B29D72274BA7EAFDA44C306B4F66901A1E1EB5895C4367D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Public/Documents/tss.exe
- Size 94KB
- SHA256 f37ce41c30a747fbf5fd08b4a02fdd4affe8618ab320b1deaf4e6e414c190807
- MD5 86a3ea2f2de92f83cc764d784341bb7a
- SHA1 dc7e2bccf77ec442b892e3fc4c9cf2510d204ba2
- SHA512 d59a99368c4372995987cb4539b26eb920ee8388e2f30926832efd3e0897d822e06868e4778cbd035b994a6257151a4188a5e54a619496b743b60c1a9ac1d98b
- SSDEEP 1536:9QP06nTyJptrZOuqEl6M4BvoGi7YPQrG8l+dc0sWjcdbqNPhAokVySyo:qMHtrFdIXvoeM+obqiVySyo
- TLSH
  T103937C1376E294B0F4A7023669759F018A7EFDA55B705EDB3388128E1A352C09F367E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Public/Documents/u/spolst.exe
- Size 16KB
- SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
- MD5 cdce4713e784ae069d73723034a957ff
- SHA1 9a393a6bab6568f1a774fb753353223f11367e09
- SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
- SSDEEP 384:fnUgXcCS4RI7nHhhZEAd2ouJNYFYPIN/qHMEU8gWmmW:sycC5R8nlEC2BEYPIMHKP
- TLSH
  T12A72294133F1C87EE06358B29D72274BA7EAFDA44C306B4F66901A1E1EB5895C4367D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Public/Documents/u/spolsvt.exe
- Size 16KB
- SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
- MD5 cdce4713e784ae069d73723034a957ff
- SHA1 9a393a6bab6568f1a774fb753353223f11367e09
- SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
- SSDEEP 384:fnUgXcCS4RI7nHhhZEAd2ouJNYFYPIN/qHMEU8gWmmW:sycC5R8nlEC2BEYPIMHKP
- TLSH
  T12A72294133F1C87EE06358B29D72274BA7EAFDA44C306B4F66901A1E1EB5895C4367D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Public/Documents/u2.exe
- Size 1.6MB
- SHA256 d51ceafdcbfddd7cfb9105c70a8d8065dd9683b60f78e4de856293d3c0816882
- MD5 7d116a2c1a0465d0e8a5befb3a6ad4bd
- SHA1 efff2f04f915a6d47b5e764e11be3f93ccc5b6d9
- SHA512 d3a8266ad3e5c233a8cf2810a9455f8e68a03bf193856b0ee240ca25fbce91fdb9d25c09f2afbedd1378423d0cb9cccf03ae84b59896a2fe4a1241c93c592507
- SSDEEP 49152:LSGrfAbTU3H6gqA56Cpqpc36DBNoPHWSnUVsw+:LVobTU3+46CS9sEs
- TLSH
  T1098533E51B69CD08EE006873C6067FE673404F2BAE450863E9D07DA9F5B07EA8566337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  Public/Documents/u3.exe
- Size 1.8MB
- SHA256 7e5f743f3e67ddac0ca76764b9e517814b6e8705b5bb6182a4be9ee37c9f0280
- MD5 776ad0ddcd0f523f309c173b6268def5
- SHA1 07bd0bf1596e7fcf05aea40c7e7d8d1d89633b66
- SHA512 f6484296ac8f20929c37f46f09bb300efc893d685396d8373eb84c3e88d8b350747e36d0a8c21b674ac7b38efaf1bb0fbdaa0cd57b7d0d05d20ebc2de9255f86
- SSDEEP 49152:TzMOAbKWyfDCZSagwnnUg+lYwR1/m9dS:QKlkhUgSYMOd
- TLSH
  T1C38523C5DE494558D1080F3040AB2AB4D4AF4EDC2975FB6F28E876AFAA7E0D760B1C1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  Public/Documents/usd.exe
- Size 88KB
- SHA256 031dde8cd3af38e9a687599734bb53ecc973803411482b37541035badba860db
- MD5 40ab8b0fae3776d1fa993fbe9510c93a
- SHA1 bdac44a829b8552cc820fe8c60f3db8a8562a6ba
- SHA512 a4b084f8b8fcb3bead2856dab0af8283320535e8e60aa3c56e1e94ec1ebaf9e9d75d866fe77e6a8c9859587a981c045d5ae067e92ce7f5143a284fcceed2fde5
- SSDEEP 1536:aCosTlBwDyhEDzIJjXpG64AS54umsm6DhDNXTr8vxnubddZNkysWlmXcdBDyYjYm:aCiWhEDzIjG64AS5XDVNXTr8vxIjkUBF
- TLSH
  T1F2935C2275C1C871F57619325874EAA08A3EF9501F619EEB3788163F0F342C19E36DAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Identifies Wine through registry keys

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Drivers directory

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28