031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352

Sharing

Copy URL Twitter E-mail

General

Target
tenis-team-km.zip
Size 5.6MB
Sample260727-plcbcasvgx
SHA256 031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352
MD5 c3cec70c65f28d3ecfd075af7ed0cdc0
SHA1 8a34ab30c6c4cc2c0e58c5765a78816628c81ce9
SHA512 1c7c623e0110d2d70212f654b69602b7434e87b15fc4a5296c58cebb2a4ecdda924cea0138d8024789349473594a629ad33d1b5e558bcd667c80c540fcb99b7f
SSDEEP 98304:vK0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mSU6oIBYTb1Zu4z5zLh3ruJr:YjbCxETKQd3RDh9jTu40FTTbXugbud
TLSH
T17A563342C478C5A8F195F87EAD6E94A8FA592101EC671FBF1F2502600C9F8C9F729678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  git.exe
- Size 4.2MB
- SHA256 cab4c4eea1d869cf9f7be73868dc9a90ad2df1b1b673e5f8c8714a576c25ea96
- MD5 6ff84a2fb05d06f456578f5afa902945
- SHA1 f60f869462fb6ef384f193e0e0b74e28d2aefbc6
- SHA512 352428d1cb49ba194a076cb924435c2e941958c35e25d25e05de64bcf53f9d5c8712b389025c97997b968e03421c5c2aefc5dbd1b28b674d7a805bed5b696790
- SSDEEP 49152:sQ/JXZZnKYimQ8SN0K3Y+kY0k7IOfSl+DBYx4CQ2Avwq8eKSIWLOFo5zOMcdFBmX:zo4IP7xW71dpTmO8lQJClxPPw6
- TLSH
  T112262907E2A360ECC96BC13996966732BA72F85801347E7F5694CB302F71E50572EF29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  libiconv-2.dll
- Size 1.1MB
- SHA256 7a282a854e01be726c6cccfe46f548c716aa45b3014818468253aaa4efbcd067
- MD5 987a6b7cd60f6c108550ebfc1771b911
- SHA1 10ed03a50b0c5e4dc3acf6374328424474213fdb
- SHA512 81a3d038bb4d95800febfa48fa478d4ee65e05abef190a27bd670bd2b154b07359b41964f063bfed5e8d3f5b40fb5666d0072f5f52595d93d5645295470437ce
- SSDEEP 24576:SI1BAUZLY3wPKU7VbbTOZGavkg3NyeuQ6l9fH+fxr:F1BAUZLYgiU7IZGaXBuQQ9exr
- TLSH
  T14435CE62F3D3CB2BF263C6B0C96A5B26E427EC216B0605377664B3BC5D337A414C8566
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  libintl-8.dll
- Size 291KB
- SHA256 0537c3dd2378218508ebe3cc416d72a99ee2d24ae1c5525e23458f32544ef861
- MD5 edf8f1b85f2f01ff0a28a6a31c3e427d
- SHA1 ff1bc2ec0a952a27b728f32c0c00c7c066097614
- SHA512 41269d7ddc99104e950934e0eff78c306a8a73bdfb34a8535f133b0442001e489ba8a7a6b3d399a26f83982f8c83070afd8393ebb32cfc529549417be279e9ed
- SSDEEP 6144:ZqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJo:0WcOXow+8Wmiwd+TuoJo
- TLSH
  T1B5541907B247A9D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E318515B19B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  libpcre2-8-0.dll
- Size 701KB
- SHA256 c135a87ed0f11eae8ffc4cb469671ff0b3f5d71fab5fb024e9b1e7241ca25b52
- MD5 86f36fe5c094d844ac79cdd58dc6c8dd
- SHA1 3484ac473e6a60920b26f6cad06fe0ec3bd34467
- SHA512 22303f09216616bf7026d9cc5e8a788076d11107814dc1ec43fe0390116fdea58a5ed11b53652020576d8c6232a2cd524a23b4bb0455df1568763913da21e78e
- SSDEEP 12288:c/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUW8:c/Cy7BDd94/6sEXI3fmjFUW8
- TLSH
  T142E4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3322E139215A5AA1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  libwinpthread-1.dll
- Size 3.0MB
- SHA256 3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036
- MD5 9e4d0677fa7e5996bb0558558f8250e0
- SHA1 9b8bfbb4cb8bd2ba0e9b0c16957bf54936ee254a
- SHA512 0cf88c933e01854fef4a98e0465df08e12b3e6203bf47550b036e4fd28bd367ce8a74136344cad2d89df77a45ef19b0856db7ab326f7e580f77cffb635079d95
- SSDEEP 49152:TCKosFyJxIG5oPVWk12JVB6iPQTUrrzAP11xy1rBLcyRGzaFjKWE5wtpFCzro1/G:CmOVnPQTUrrzAP11xy1rBLcyRGzaFjKD
- TLSH
  T121E5BF55A3D859E9D463DA349710E332C2B279634B75E08B0A9AC70A1F77D924F3FB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral10 behavioral9
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  zlib1.dll
- Size 125KB
- SHA256 93e9243a44c29200eeacaf9658efe2558581770e4b11ca4b500e18e424a6e3b5
- MD5 30a31b969a3356efde11078dc635baa0
- SHA1 331b61df1d5378809df58cbcfa292002d4adb06b
- SHA512 66fc99ddc77df71ff01516f9b6a594987041f83e75e90fa62c74961c446d82a08ccee0ceafa5eaeb260a328a867a302a168777d69eff34de311b625619a51345
- SSDEEP 3072:vGsOJXTFCi6G6Q8Kw3Ee+NFH+LdTGpaAt5kwxlZX7tmoh2NiDSR2F3e:+nSiBJe0FwGRUiOR2F3e
- TLSH
  T1B1C36B6BF6A364FEC6A7C17082E38BB1F031B81107246CBB9154D7752E20E50671DABD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Suspicious use of SetThreadContext

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19