e836a0cda0bd4af42a1194bbd75c94a8168de8f79db72ee89ccbc2b157365adb

Sharing

Copy URL Twitter E-mail

General

Target
canadianlocker.rar
Size 799KB
Sample260729-xtklpadd57
SHA256 e836a0cda0bd4af42a1194bbd75c94a8168de8f79db72ee89ccbc2b157365adb
MD5 21b4a5d86291f2c251873401ee1d3002
SHA1 7ddd1ec2ef3bba67f9d6a56f2ab79f041d280591
SHA512 243a8e7a7b94528aa2d49eab1325099dec2e212559b9fceaada4744f14fdf2b0ba43917b39b6cef525419cf00bb07e0af1de124300de49e4e087fa5cec1b74bd
SSDEEP 24576:Kh7qr5wgKKIUQI5HCflM7b6SLWqnA6m5Xb:W7qugYQEflUZikIp
TLSH
T1E805234F4524513B82A1165FACDC1322BD6F2F9217BAE91BBF7303D6A484E05A37711E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  canadianlocker.rar
- Size 799KB
- SHA256 e836a0cda0bd4af42a1194bbd75c94a8168de8f79db72ee89ccbc2b157365adb
- MD5 21b4a5d86291f2c251873401ee1d3002
- SHA1 7ddd1ec2ef3bba67f9d6a56f2ab79f041d280591
- SHA512 243a8e7a7b94528aa2d49eab1325099dec2e212559b9fceaada4744f14fdf2b0ba43917b39b6cef525419cf00bb07e0af1de124300de49e4e087fa5cec1b74bd
- SSDEEP 24576:Kh7qr5wgKKIUQI5HCflM7b6SLWqnA6m5Xb:W7qugYQEflUZikIp
- TLSH
  T1E805234F4524513B82A1165FACDC1322BD6F2F9217BAE91BBF7303D6A484E05A37711E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

google defense_evasion discovery persistence phishing privilege_escalation
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Detected potential entity reuse from brand GOOGLE.
  phishing google
behavioral1 behavioral2
- Target
  backup/pysteamauth/errors/__pycache__/response.cpython-312.pyc
- Size 810B
- SHA256 9c6ebef621d6c86200853a9d12b5428b65a0f40d98243f1bb0b6a066b27f1dad
- MD5 be2dfcf7a039cc2d6bd9239f133ee9d8
- SHA1 0be0e7186156f40d2503c6ac33d30fe031ed4f87
- SHA512 a0c4bd87dde8bd24cfd3d26285788ba613624e646f618997b656d604c1d70c2a36676419306e3628b504fc63a9eed8db8abcaf19a623479ac926b4c91fc69b43
- TLSH
  T188014481374A0A37FADC51F415B79B3FF5B99AE1FF5D56338180A2388D5454AAC2380C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  backup/pysteamauth/errors/codes.py
- Size 3KB
- SHA256 51f76f06fe97d5350e2ce98158c99513afe03473c5cd7c6935c232143e3ba0d1
- MD5 3419c170992003e6a4c2c53cdc8402e1
- SHA1 b4d70c1777d0eb52e0626c7e74084cc292588acd
- SHA512 7dfd57633c8e55d3e855958953fbcd09865ed1e2eac12b9472b4f51fb9c49a9d107cd7a5820c8a763b2fa00a04108a167cc86ba6bbc71f1be2ffdeb9ce4c0539
- TLSH
  T1AD6187F92E068DF7080DC299506D6017648125C75F143BF6BACA16DC2F9DB8DB2F9623
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  backup/pysteamauth/errors/exceptions.py
- Size 1KB
- SHA256 287c89e8e0d9c450b1309a280ecc55db24efc110616d35b23ea11e475dd380bb
- MD5 3b84d516ce5de433a2db96317d25d376
- SHA1 9fb60ad94b59787a29b9682599c7c8a065c49c0e
- SHA512 8e3ff67a4fc658f62b1bdcc9e82173896edd7daef272fb8f3fa8e7cfd4cd153d676cd863113c2dbb3d1507ea1ba55d262776c8b7e3547c2b6f15de951817d676
- TLSH
  T1DC21FE1717954F27872F40AC34695827426BDAA3C6B83D3178DCE3391FC1899CCB160E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  backup/pysteamauth/errors/response.py
- Size 553B
- SHA256 3930d644b06c0e9df2d6f387ff0c6fffa07ece48682108b18825b111a2f021e3
- MD5 c64d1b9359503e098315cf90fe49b8e3
- SHA1 73af60953a456b6b7ea6685be94aeffcf1bed4ee
- SHA512 a848cfc21be22b24b78b9cf1651645e3edf3972f2d54c2bf8cd8d5164a7d7712c8cd7f19bf831dc8dd97ecac056aeb01dfa15817ced4ad4d8ec4a33ab06491d9
- TLSH
  T156F090031AA90B23A67A05EC3466893D636346A39AB52D73788CD2399FC1499CD7A066
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  backup/pysteamauth/pb2/__init__.py
- Size 1KB
- SHA256 875cc87d4e08cbe23fceabc4fe98bc84f58d248b63ee8f048d9302b04117ef66
- MD5 2802ae15bbc9f1bcc6fb2c1abfaea149
- SHA1 5b8c80d91c4213ea61a570c3a926feed9eac0b20
- SHA512 5aa1df2630d8f5a7bc09109f28dd73147b3c3fb58b16ccb85a2ae7c59101285f967b0e030bf4c94650f78c3dd3f392d496d75877e9e43798ee065971e7f5288f
- TLSH
  T17C21D493CA814727D682C67791269A9357370A2B3FA4AE20641134091FA914F6AB70EB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  backup/pysteamauth/pb2/__pycache__/__init__.cpython-311.pyc
- Size 1013B
- SHA256 de9150a01781b87d640eb844f934bd104abfac0b766b972ed94e49a6bf6d1106
- MD5 77eb81a41db8ac65e21dcabc422b7516
- SHA1 4549a4a33874efaf188b443fa08151d6ceff7563
- SHA512 f80a85ed80457fd66b622324b29230db8028164771a85e3a584d2fc9db854e19893da8f470a0108c993ea901bfb35a8dfc093353dc26a6869849fc77711f1e6b
- TLSH
  T148115782CDCF443EEE91E2F6B06363464F32482B3F95CA151016380DDD51456CA6359F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  backup/pysteamauth/pb2/__pycache__/__init__.cpython-312.pyc
- Size 858B
- SHA256 b0a25cdee39ed45cdfaa48ba9b2178129729a95f82e323392a21b1fddabfdbe6
- MD5 a0228c9505c1225dbc14880bcc8460df
- SHA1 bd1344c3b7c5b46b5c6a6681728c07cd44738e95
- SHA512 2a2c3c27c10512e9eabff8724854a1f647e3a7b95259f1e328f6864a854df289406e31008cbfd18131d8ba670192cadbea650e42eee9b35cbbc355a83606c0fb
- TLSH
  T1C7118EC3DEC94537EE92F376906392834737456B3BEA8A26201538095E5054A1A7359B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  backup/pysteamauth/pb2/__pycache__/enums_pb2.cpython-311.pyc
- Size 28KB
- SHA256 a48304be432b688e1aa888e7e25a989b956f12b458a282b2dbfb825c98f52fa1
- MD5 613159de30a84c91cb15746f3ff67ada
- SHA1 dea56922707b34b60147cfd35bd4c23404010305
- SHA512 f493e199095bf20a2e37d68eaa0b3603967572900df07c688edc9605502b30c89f8055142df0c3ea54c7cdec18ef1c74ee623ab0126fc4ab756b243a1350e3bc
- SSDEEP 768:4TJM0fxpiXwKg8QLbXtTSInQw4JBBZLlbP:sR+vwUYcBBZLlbP
- TLSH
  T1E7D29463B218C133CE5AABFDF9B911790BF0E6B5B12C812BC4A6160E69C3950573E3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  backup/pysteamauth/pb2/__pycache__/enums_pb2.cpython-312.pyc
- Size 29KB
- SHA256 07229a5960383b10970f944ff87ee9185188e1c923092978d5277906d7c286ed
- MD5 e47c778d14e8b7f6db5ea716782038ae
- SHA1 c39c460e9244b5c10862e39f8882a8c9500cc340
- SHA512 4c6b506b9f34e7d70e81e292f1873f3e9b7534eb76f1eba8a25c76a3c5f2371f0e6fa49b2b1c9e289e08eac014d96de120e2f59815e8900e1c5c23bbb192e2cc
- SSDEEP 384:u02NosRPE0fxpiXE0+XKgrunQLbXtLrEQLHXgvZKKcBBfynKUKOKUKNW:uzRM0fxpiXwKg8QLbXtdLHXnJBBCLlbN
- TLSH
  T1C0D2B663B21CC123CE5ADAFDB9B912790BF0F6B5A11CD12BC4E6520E29D3940973D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  backup/pysteamauth/pb2/__pycache__/steammessages_base_pb2.cpython-311.pyc
- Size 16KB
- SHA256 851b2079b30ec4e5bb0cef31b078d8a165103db8000ccb2cb7fe991ca709a2e2
- MD5 b208b0560536da9a0a8b75f6d441c1b6
- SHA1 68908fe9521a50110ed0f03a27d26168d9855958
- SHA512 11c8a161f2f3d96fab25bd4da0e444bfb7d0c35247de3da8cf3e67f490c1c7445d5eec09beaf2fce527e696d80b45462b66052e4a509b88cc859d696b610e526
- SSDEEP 192:cLo326KU3dkNKvKmUgJHzrWEEXVg/4iHm+wevUJfnsVns/e+CMYVJqYdT/846Gw+:cWq8GKv+OvbEX6pVNs2+Nk6GwmT
- TLSH
  T15A72EA02ABD8D239F5978634A4C93EBF75509FF6BE28C213899A8D1D5CD1104B92E1BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  backup/pysteamauth/pb2/__pycache__/steammessages_base_pb2.cpython-312.pyc
- Size 16KB
- SHA256 6e51595027b4d949a24b9a6604ceab1d912034d42b8d1c86b5a297401242b3a5
- MD5 139fdc9821a5805604ffb5628e862312
- SHA1 7f624fc136fbd730ecfcec5dd923b0ae42ba7f24
- SHA512 5e9c8a8d81b4eae7a1d25fe8dcc96cc79574c8ac3b0ce6e1a4671283b9ad278a8702a7df2f3dcd4fbff60514537090f6e5b1a0efaac9b0da2e416fef9213aa77
- SSDEEP 192:d0U2/OieKTKmUgJHzrWEEXVg/4iHm+wevUJfnsVns/e+CMYVJqYeIdhpXpkvt:d6jeKT+OvbEX6pVNs2+NgZkvt
- TLSH
  T14F72E801ABD4D235E4D59538A8D43E7F76A05EF6AD2CC307899A8D0D2CD1909FE6E07C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  backup/pysteamauth/pb2/enums_pb2.py
- Size 32KB
- SHA256 a6ecf5d57d9391eea33994a84788ab00cdd11d5913c3eb8f702275341aca097e
- MD5 efeec344ff689fb48a056927ee06a9f4
- SHA1 c83f1ef9b455c0f05b23ef32b10d62ecf0dc6c2a
- SHA512 00242efd848fc63c1852b0d46d1447843e65f0687ad6c36e8dc3dfb44e9d764847cec4b76bab7d035038a2f4395fef0d94867c4c62a811f0aaba6372973e9ea1
- SSDEEP 384:wQk4/hD4DJDkDsDkDYDNouD9bnrAJZdydcS/b:wz4/FktowoENF9b+Ecc
- TLSH
  T139E2749B6564E013CE5AEEAEADBD41D20BB0E132CB44131DD6E51A1EA7C3C610BD8FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  backup/pysteamauth/pb2/enums_pb2.pyi
- Size 198B
- SHA256 fd7c0258fb219ab664a09260c3bbb3e38d3aa5685eb2f8089305da0056980830
- MD5 1dfbf61d4f5c201e32a2fb4a6d6f34a1
- SHA1 2b53ab3ad6deddc07a025c4c0e2701128248e342
- SHA512 1f36bdae76a4fd0c161d6108d3f0422ce0fad6d0a64f3edeb923b8d290ce62ffa830377d2b0dbe67bcb284868d8a31cd406f04de5a71dc58eaeca59b9c9f9d2d
- TLSH
  T125D01292C6DB4334C1F4C74720D42A3773F86941A6AD283524B319F49FC154B08A03BC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  backup/pysteamauth/pb2/steammessages_auth/__pycache__/__init__.cpython-311.pyc
- Size 190B
- SHA256 f8bebd50780504356c0d78b3a5f97aba768d1a14057a03b3b2e6562b10b30822
- MD5 efd26603fd7875ce29c223586b33554f
- SHA1 99152e02c02551f0beac1a52daae2dee456e8d3b
- SHA512 51d5ec1e5656a31f8625e52473ae4d12f6e6dc5505f4bd838815a84ec5fdb611fb81aab02704b9665b3904e8387b3a263f3a77bcd9ab6b0a231c74cae9901ee7
- TLSH
  T133C0C0470921CC0AC124843E40F3214FB0F1CD0172D0004F834AD249F09F4488C91C0C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  backup/pysteamauth/pb2/steammessages_auth/__pycache__/__init__.cpython-312.pyc
- Size 149B
- SHA256 a2d598a587d3955d04438350f2e82616d06d073ca6af8bb0e290ab9eaa2453bf
- MD5 56a52861ee845eeea852ce2f494ab8ce
- SHA1 da2e35f96c62ed4884a9f4b2cb054ae5e8bc159f
- SHA512 a5984edba36fcbe65556a869742c1bd57a2fa06dfcb23bd753ca247ea5ef2e3562cba32bd16537b4890a51e858eac041ab4df8c4525feb6c32fc60ab1cb3ecb9
- TLSH
  T1A2C02B462511C14AC01860791430020F2CE547D3E153484370048148440D0080CD000C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32