08f98380fc28e516398f1e5db79be856f0ceeb5d5eb553c06bf3041697730f7c

General

Target
backend_homestead_new_v1.9-beta.5.zip
Size 534KB
Sample260729-w697fasshs
SHA256 08f98380fc28e516398f1e5db79be856f0ceeb5d5eb553c06bf3041697730f7c
MD5 e4f0fc29322640a13934b97c788dd4d5
SHA1 6b7d947234be7fa2aa48ba770ef34022996b2333
SHA512 5f42635017e44907f67d1482f0962ed4ac2be48a30457593aabba3b1eb210ce4ae67cf1f80646d28ea1b5b8c0197097fbbdb6f4bf0ef2d5bce43bd63a5f9bdb0
SSDEEP 12288:KOCBcIqBNliubzqtYBpfsz4TKPozt4CTo4Pl/2Ar5G:KZ+mubzqyB9sz4TKPE1l/ZrQ
TLSH
T1F7C4239603289664787407B197BF9F8DC6028E5329921BFD9FC8BF0CA1356489D5FBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  application.cmd
- Size 24B
- SHA256 037affc90a4bf1d6b5263756945fa92795f5a59630cab95ad17260711d023fd6
- MD5 3748cd334a64b8be2ab5fb31c7c8c403
- SHA1 c8685b932cb584ccef070098a59a8c32fe5f465f
- SHA512 cbf0f10b932ff4d4784f73f8ee8ce1d33043ef9f77f2bd7b5917c581d24e903af942e86c0d9534a9355b76ddfd875b9ab8150ace493bc3c57f43d39ad0de2308
- MD5 SHA1 SHA512
Score

7^/10

discovery execution persistence
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  ico64.txt
- Size 300KB
- SHA256 5762d9a95e545a70de685c3ae9e1d5bd6aeaae7615f5b8156da65e894a028009
- MD5 927cd1c732645b444374139b3de38857
- SHA1 93eba43520b7e99d74d59095d07c24a006a159a0
- SHA512 5afb07290a7a6674f5a364073f00c3f739180387d86e0c6a1d54edd088b47e8d95aa5b9eb8142633defd7c9ee04cd8780a83733cf0c05da96400c5044b86fc0a
- SSDEEP 6144:QdblPiZUKuxBA5jfKuDxhHzKJqbZhvSN6nnPaV6hkT5:5MojfKKbbZA3ikN
- TLSH
  T14E64F7E0F5C409B6DBEF8682DE6E8DAE15B724E2870A168E0E1DF4E03B151D1D7CDA05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  luau.exe
- Size 753KB
- SHA256 5b2009af04c34eaa891b4fb57a7b79cb94b104ff7db2b3ba7eb66446db6bf929
- MD5 99ee2d496c71b1917130a677a68e4c33
- SHA1 c086e86ac35bc5e838804984c63dc1a2182bee69
- SHA512 509655eef24a4c4b7ee9a55fd2fae004ad7182f8055435670434f35fdd61a6d38c5ef89728ea65d087b6169caa326d2b5570ed093c97e921a78e20427fe5bca6
- SSDEEP 12288:YIxb6mgscIPv+xPBPx3ph7WfsnE6VTdUZ9nUt2ZvIX/19X7BrorkLwqG:RlRcIOXrh7dEiTWZC8gXTFX
- TLSH
  T1FCF49F19FBB101FAD5B78135CD16A90BEBB2BC050624566F43E06AAB6F377210E1F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6