b55890350ba462de16f34836b12a56692fe165a8b2a5b29b73da08aba50087cf

General

Target
NJM_Setup.rar
Size 80.0MB
Sample260727-qckf2afl4v
SHA256 b55890350ba462de16f34836b12a56692fe165a8b2a5b29b73da08aba50087cf
MD5 ac94fd4d446d42a7ba7872603dbf2581
SHA1 0a44d6ea7068258032bee1cbc831ae1dc13e8994
SHA512 149c1623248c1e042007735d0df38035e0d4eb2b1cb54d4b291d2595ceec75f47a6c31f2486d1bba8c27ee7bab940c3b4a82330807c5cc8c4f471205cf5aeecf
SSDEEP 1572864:75oUKMbj3dIT3JLpsBKcQZO9/kTqzrDVgnQi+rYkzHoY++4ci2yqJ:7LjNIFtiTQqzrDVgJ/eIY++4cixqJ
TLSH
T1CA0833AC470588283970B9EF51FEB2BBCFBB1076A034F3DFC1691AAC26DB9915584147
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NJM_Setup.rar
- Size 80.0MB
- SHA256 b55890350ba462de16f34836b12a56692fe165a8b2a5b29b73da08aba50087cf
- MD5 ac94fd4d446d42a7ba7872603dbf2581
- SHA1 0a44d6ea7068258032bee1cbc831ae1dc13e8994
- SHA512 149c1623248c1e042007735d0df38035e0d4eb2b1cb54d4b291d2595ceec75f47a6c31f2486d1bba8c27ee7bab940c3b4a82330807c5cc8c4f471205cf5aeecf
- SSDEEP 1572864:75oUKMbj3dIT3JLpsBKcQZO9/kTqzrDVgnQi+rYkzHoY++4ci2yqJ:7LjNIFtiTQqzrDVgJ/eIY++4cixqJ
- TLSH
  T1CA0833AC470588283970B9EF51FEB2BBCFBB1076A034F3DFC1691AAC26DB9915584147
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  NJM_Setup.exe
- Size 80.7MB
- SHA256 8fd2f9c7c1510347303e592bfb4a25f3bbe8283ae7334a85cda5dfdf60f8a9bf
- MD5 54c352815edb27e4866320dc3d22825f
- SHA1 a5a652262bb4227c2f1c0a53622c77aeee2de0aa
- SHA512 766eb3cac5b49a3c02012eaddbe5f1655f05137c3ad8940c21256de4a8c12da9222f04453fc8428e90056c6458e33fe15fded15d793f54554e4419a964de2c06
- SSDEEP 1572864:Xg80U7PdbSZ0X3BWzZw8pa9vOBkbZ5VUnWm67L8TLsQCOUWoWQeL:hPRSSxIMqkbZ5VUX0YYQCOUWozeL
- TLSH
  T18F08333F7B4AD82EF671597D69F5A11A953F51226823880ACBF089BCCF724B43D5C241
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4