364a28c6a888f10f3365dbd7a015aeb1e853fe78053bc9de0dd742193cc40405

General

Target
MALWARE.zip
Size 12.4MB
Sample260728-17akesaq2t
SHA256 364a28c6a888f10f3365dbd7a015aeb1e853fe78053bc9de0dd742193cc40405
MD5 4df156984cc7df3f07b40315aab5c330
SHA1 ce2557b812ee53d51577a1c1a2b8b2da0f221414
SHA512 3ce55884ecab03d220fc3262dbff0c744cd6096dc95d5018ce683eface0dcdf57e223100452e8ef97dd6e8767fe6f2b080c62d645c81ef79a8796576e769bfaa
SSDEEP 196608:svD4JHacP2mwowaMD3Mp1TQZYygkXIEF/btXFsEwCkbuS7YzgZ9by1JZOUZFIbnJ:taNRGWS4DtW6kmEnSZOWanoESbOXF
TLSH
T1B0D6331595C1B661FA88C2329458D76CED2EBEB472EF17DBA335440213D7F90A7E0CA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HLS Installer.892/WerFaultSecure.exe
- Size 215KB
- SHA256 31965125a9a6c4281f51210313a7c4653151c7d078a8f1c3b8d5f8a7492e4204
- MD5 04799fd710654f2c702c25638f773c00
- SHA1 813c2735d4b43971d2273cacc0f9ad71146984de
- SHA512 b6a86948773e48c2a61dde6dfdf95e43ba5d767fc81a28db2541797b6be54c8fadeec6f110ba718936ee9a70892eac1d9412e555fffbea084394be9ae761f0b9
- SSDEEP 6144:RkVe6b1GFJIF566Wr5yO4VJyB60OHyLC7vf7:RkVe6scLYE5c2HywL
- TLSH
  T1B224BF1E73A820E5D9BA8238C5524B66EB70B46113110BFF06E0D1BD5F677E0AD3AF91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

google defense_evasion persistence phishing
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops desktop.ini file(s)
- System Binary Proxy Execution: Verclsid
  Adversaries may abuse Verclsid to proxy execution of malicious code.
  defense_evasion
- Detected potential entity reuse from brand GOOGLE.
  phishing google
behavioral1
- Target
  HLS Installer.892/faultrep.dll
- Size 75.1MB
- SHA256 1ae614f671d51b530bd00d9c125811447574255edf100a6e75f3493e0f7bec7e
- MD5 0a1ebb789cc28ed660f2033ecca2376f
- SHA1 7b812013ed5c887c04dd99813a4d93ecc1ee8121
- SHA512 aa91d94f069ef8c5fbd09df12295b6bcdb23580ffde7e288e23dd70a1c0d6cf2de6e1177f1d0e5097cad07da63ed8be6a31b444c49675b85cd417b2fd478b836
- SSDEEP 393216:hHdeNl06wRud/4V8J5GzgRbYBkOKZAGED:h9t6wm464g4kOnD
- TLSH
  T1D00818E0E82AFE47F366D43CA425F668C5D950E5E712D07AB02AFA7451B3380245DB2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral2
- Target
  HLS Installer.892/versions.txt
- Size 1KB
- SHA256 6c31d956ac06f322f2542a7a318ae4cd062b8d91a8468b14e1618857e39d46a2
- MD5 2e911ed67435c9928b2b2de3d51e8eae
- SHA1 b5fc581e34e9af6b762f86dd067c44cb9c3922a3
- SHA512 94387552fa507656e305e52786c4dcc44df9e2a43da2c0c8cd826579b26b5a8777c535771c9ab3b68d0a9f4be28777a0510d6fb49d52b38d5e9ea48f03a4e538
- TLSH
  T1E511D2A10C0C4102ADBE510ED51BE171670ED7EB408564BB76BB62A07A1F4CEC88F06F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3