0282311ae96091e8ef3b212bc5ecd7d832377aeda354064df1d7b71ccb7e1956

Sharing

Copy URL Twitter E-mail

General

Target
file1.zip
Size 27.2MB
Sample260727-k44fbszbne
SHA256 0282311ae96091e8ef3b212bc5ecd7d832377aeda354064df1d7b71ccb7e1956
MD5 f0897e6226b1268882176782614631c9
SHA1 74f51e2d3538a9d17e12b0b21b16768d23d2e0a5
SHA512 06463fd6749ff81595070cbe4bd109506ad5848b9adf77acd8ae456ba35ceb87592064e54b0cf4ba6b345492e36f5f9b45bad0d4ab250c2a40ce1bb55f527b1d
SSDEEP 786432:l75elDaeLkFSGFcQrZ5kewsihJ6UqmfdG:aldkFShswsiv6/OG
TLSH
T118573324E40A7A92E85ED6F408B00D5407E4BD7122AF53C92231B99F8E53F79CFB5A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  file1/Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  file1/data/.5nS
- Size 332B
- SHA256 b1dde888676228157c4aad8e9cbf88fd1c0e5fbe681b83031c1e345c26436d18
- MD5 a8ca743db66c91ceda4c79cd7ed04c35
- SHA1 60dd8efedc7e9d3d85750a59592449dd01bd1902
- SHA512 353cf8181fad9c7e9cb80ea568c57f6c21ad9f8da601f09166341c0904f675715d044e9e592a30c11fa213d662aaa8e97d1de8a80ec8ff1e0654d86e8006f17e
- TLSH
  T14DE07DA0582CEF712D0FAB41E262099C3758642958A8A6BE624912ACBBE4016332E548
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  file1/data/8mX9KDzsuwoE.GS
- Size 13.6MB
- SHA256 6516f6c9374f431f898f6ea19ffc081d4358e637cdb52bbca6985a8012baffc0
- MD5 246f400582c7fcee91fbab98406b2170
- SHA1 85d24e3c2e6d3eb604588a5a950b435aac4bc99c
- SHA512 28576627ae9a3031c78b913d926fa148b0a3613b939982d01d6292e3f7c1df427bdb3520ea229002e0b16c49a330150812665b346e6d4a54e4b939328e5026fc
- SSDEEP 393216:Y8WzzoL4JSBSTdHvE6cRtWv0vRTy8vUSdL:Y8WzzoL4JSwTdHvE6cRtWv0vRTy8vU2
- TLSH
  T19EE6C6A6DC86C60C598D20D438AC2B563B6769EDD98CC238511BA2FFDF9362B7403F54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  file1/renpy/warp.py
- Size 5KB
- SHA256 d4e4f2486d10f4cf243d2356535b745f812c1fc374cef4e1be619bf147f9aac8
- MD5 dbdbc6311e0f58f3c34c6f0eb624f1e2
- SHA1 06723bc833c809af4cfecb7fb80ca1f47e20fb6e
- SHA512 1ade12cea9e0f5dc677a70f22d08ccbaacfe9adf3cd8f22c3cc1622f0fc57890c6be768d27897fd2fe96d86066dc4c8c7d8d9f632c9d023452a79e1df0473d20
- SSDEEP 96:w1zPjdwQHj1/Z2EUga1hWLH9nmbNgKyB00ggTMqFDh0yl4Vf/Veyurh:w1dwQHjJZmxWD9mbN0NmpVf/Vxu9
- TLSH
  T107C1B52B69251365A31714080DEBA19DB31BB86F1AC115E4BDDCC3146F92720A7FA7CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  file1/renpy/webloader.py
- Size 9KB
- SHA256 3b51404342abec20ad616e5e448dcfec71b54570552d0083d30792988bb27001
- MD5 c9260040c2057f8f909f0f299af595f8
- SHA1 ead87e9734e78c785c2dae2280029d5410e12e7f
- SHA512 379a0548eeea084899c8ee91889cd51cdb25a470f8d459e2c0b1274b1b6cde9ff4b10a7774ad3ba6faf04c789b29a41ccfe700de57dd21412347fe8561386a84
- SSDEEP 96:w1zPjdwQHj1+y3vZqGk4apLgCG9WTtX2u2OETxouJzxBb7chClqQ9iL2HoYLNoaF:w1dwQHj3Acap0CGYXGXBOW9oI7EJWv
- TLSH
  T1FA12190FAD679092C303A254EA1BE086B71918D7230CD97574BCE1A06F92570C4F7EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10