541def175b2b884a92e0a6cf86133edf3c18e3c8705527b85ecffe8fb8e4b3c5

Sharing

Copy URL Twitter E-mail

General

Target
Software.zip
Size 346KB
Sample260729-anpl5ada26
SHA256 541def175b2b884a92e0a6cf86133edf3c18e3c8705527b85ecffe8fb8e4b3c5
MD5 a44b42a4d8d8cb9fe4b0c06898860068
SHA1 cc4d85f11a4dc8e8cbe3f49f758bb8100485bd84
SHA512 0d4f4788874d453e9c2910da611e5721696827ad55d00aa187e8d719ba12b941b2ced6a627424e1c4b0d10f86cdba492754d7eb1f7fdde4842e8e9bea3c3d0c0
SSDEEP 6144:Ic/gVcQxwbrrF02fcm35p+8iFw0PBAgBenK705aQK0ZFcQRlrbiVzLu8zfkTNFHf:hgyWyrprfX3hiS0SgBCWfQK0Z2Q7cz/E
TLSH
T180742302F13FADB41ABA269C4E17795F813F3C94611D902EAFCAEB5E82474E588436C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  Launch.bat
- Size 93B
- SHA256 dd2096844b467412ab426f3ffbe40422086de5b94bc16fd43e669a364ad9912f
- MD5 f4cdcb1263073d59a2cb83ff8c54e9ba
- SHA1 b9187a2540edc9880646fa377f0cf02f42805d50
- SHA512 7eb391a93022d0cea082cb6eb9530ed8efdb2c7f75341db408be0366ab11f4917de787b0c088457fa3f263579f04eba2f8723fed4223cbd73c348e29f80f3021
- MD5 SHA1 SHA512
Score

6^/10

discovery execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  lua51.dll
- Size 413KB
- SHA256 012e772e3c72c5f500aab86e78e99afff222bdc8d914bc32bb244ade03d5a486
- MD5 2f0394640486f2ac8dfb23ee05f904a9
- SHA1 63b5af9791a1feebafd0be67f2a33391025bc887
- SHA512 af1c033162b75b4fbd28fc8ea33f264aab116dab0054ee6beaf899b23eac65aaf0303825f9e133ba7645f2f9421d5586a841e34e14c196c2c0b7e74e43821b05
- SSDEEP 6144:rQfFVKb26ouykP5eNASsJtQ9Se0mTdXyR/XcL3UL106wDo9ZOF+63DGl/jQI1L:rsF8b26XyvNAHJW9hXdXu/ML3UGyl/0M
- TLSH
  T1EB946CC169C744F6D19755B094ABAFBF8A358E024025C8F9E5E8FD1DED33B82142721E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  luajit.exe
- Size 24KB
- SHA256 30f7bd2e98df2ec3405f3ab4aab5be8f0dc1d9ac638286edf390c4ddb74b4316
- MD5 e1bae2b33bbcf7d1dad46f57fe537141
- SHA1 56cf50befe699b038df8c4a0379a11a904e22401
- SHA512 d4e8e72a850b4aa1f5709dadcbe649fd3dc7973cadb8aa158c3396b9ed03c24e49cf5d1c8823cb2d7234389fe1fa13c6bc29174a5e46e6f4cc4995a9ca065b52
- SSDEEP 384:aru40kZ6Ctgp4t2bW+J3Y5C+0mnoTIhNjgiKM0/Ik4ACDdXH6:aqtkZ6Ct4FW+J3GC+znyEAE6
- TLSH
  T1B9B2C6A97C8A7CFFF4965278D8E1027ED27F99830B22447ACB68DA34D5B73F5445A002
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  userdata.txt
- Size 232KB
- SHA256 8e8173f0411f8c052959503db6d2cdab651ef122847e2fe61758b50f9fb8a649
- MD5 a75d96a806a5f8585ccd282afbd09830
- SHA1 c36e15f0532569d789ba9fdbfccf6a1bb5ac2c75
- SHA512 70b4db899b49ec37989255cd638d43990b08bc390dbb06efc61f19b30b4dcab058e16fe0229aab066847f1146364d358da145e0e6fd5ada2edf430b821052203
- SSDEEP 3072:M48/rrC6tPGo7fPFl9pf2Kcf5U5j2l0Gno+NVBYmbpcpvh9XKtDl8h:y/PJtPLfr2KcBU5iSGZPYmFc1h9olO
- TLSH
  T15F3439E07E30198006BA5BC5DB775E21412D29B3D2472DCE0A5DFFF6B2005A5D62EA2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8