bb175cc9c3b0035479d74b0bad115c93bc08f9a5ef8726adb21bd7566d3fa294

Sharing

Copy URL Twitter E-mail

General

Target
SWIFT_MT103_PAYMENT%2877085%29.zip
Size 35.7MB
Sample260730-g3f2vsvwd1
SHA256 bb175cc9c3b0035479d74b0bad115c93bc08f9a5ef8726adb21bd7566d3fa294
MD5 7fb2df8cdcc9135cf3be28d15385729c
SHA1 bbcd8b48485bbf46b3e13f92b975edb2da71bb8a
SHA512 f91065763fd287dc43743598246bc1a9f275e1bc7b80ba02f4dff48390ddbf9a07be13b5d277a7d9f005749646d173b7965fb04e3e430f7b2469c670fa816036
SSDEEP 786432:hPY1Az3ATtecG06QsFodGzrzzsEwN+4PphXiIgvWoEj:hPfUTEcG0vKzzsEgjhXi3vzO
TLSH
T152871217A6E60164D5BAC078CA6BA557EB723C06133067DF22A8B2156F73BF05A3F314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_86080682.vbs
- Size 7KB
- SHA256 b7029eb3cb86fd16a790e301aa551e27210e073dcb9740781f0fe20182d60de6
- MD5 ba1e8d5129ad02dd9710f26257daa881
- SHA1 42f03479bb636fa6f8b4b02f5dc041fbe987fb21
- SHA512 f9c0102c13ef8de0a7876b80b3bc06413d1004582e029790db33d72aa1b821eaa11ab819846c362f13da2ccc373cd8fc11d4bd93646c41c94b8a1ca547819a42
- SSDEEP 192:vzndijTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:UjTdDzeeARF02LDzwfjFxJ
- TLSH
  T119F1D00BFD112638C356D3F849B82C9CEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_55569010.vbs
- Size 7KB
- SHA256 b7029eb3cb86fd16a790e301aa551e27210e073dcb9740781f0fe20182d60de6
- MD5 ba1e8d5129ad02dd9710f26257daa881
- SHA1 42f03479bb636fa6f8b4b02f5dc041fbe987fb21
- SHA512 f9c0102c13ef8de0a7876b80b3bc06413d1004582e029790db33d72aa1b821eaa11ab819846c362f13da2ccc373cd8fc11d4bd93646c41c94b8a1ca547819a42
- SSDEEP 192:vzndijTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:UjTdDzeeARF02LDzwfjFxJ
- TLSH
  T119F1D00BFD112638C356D3F849B82C9CEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_66503175.vbs
- Size 7KB
- SHA256 b7029eb3cb86fd16a790e301aa551e27210e073dcb9740781f0fe20182d60de6
- MD5 ba1e8d5129ad02dd9710f26257daa881
- SHA1 42f03479bb636fa6f8b4b02f5dc041fbe987fb21
- SHA512 f9c0102c13ef8de0a7876b80b3bc06413d1004582e029790db33d72aa1b821eaa11ab819846c362f13da2ccc373cd8fc11d4bd93646c41c94b8a1ca547819a42
- SSDEEP 192:vzndijTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:UjTdDzeeARF02LDzwfjFxJ
- TLSH
  T119F1D00BFD112638C356D3F849B82C9CEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  SWIFT_MT103_PAYMENT_04.pdf _42184178.vbs
- Size 7KB
- SHA256 b7029eb3cb86fd16a790e301aa551e27210e073dcb9740781f0fe20182d60de6
- MD5 ba1e8d5129ad02dd9710f26257daa881
- SHA1 42f03479bb636fa6f8b4b02f5dc041fbe987fb21
- SHA512 f9c0102c13ef8de0a7876b80b3bc06413d1004582e029790db33d72aa1b821eaa11ab819846c362f13da2ccc373cd8fc11d4bd93646c41c94b8a1ca547819a42
- SSDEEP 192:vzndijTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:UjTdDzeeARF02LDzwfjFxJ
- TLSH
  T119F1D00BFD112638C356D3F849B82C9CEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  thW7f8/LogMeInResolve_Unattended.msi
- Size 35.6MB
- SHA256 29906168eba271442305389aebe91a5091ae933d551101ad60087f699ca2630f
- MD5 ab7e7ff9fc24a0b1f8ad7863c4a0a2ec
- SHA1 96f043a70e69af7759e92b60dadf507e906bc2c0
- SHA512 10ba657c9baf30cc7e5a2f2339c5398687b1de74e98a823ea5fe3f2eb857683a15b9f9b61f727aa9e2760bccb16f826183e4a26820b4e96e7f2d5f3033ddf99e
- SSDEEP 786432:yPY1Az3ATtecG06QsFodGzrzzsEwN+4PphXiIgvWoE:yPfUTEcG0vKzzsEgjhXi3vz
- TLSH
  T133872217A2E601A4D9BAC078CA6B9657EB723C06133067DF12A4B2556F73BF05A3F314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  thW7f8/install.vbs
- Size 7KB
- SHA256 66cd2d2a533b9ac820fd8c760e8390274e02ca0c96c3646786383102f2b76545
- MD5 d2567038bfcd724a1992159cba3f6f55
- SHA1 79a2f57da31229293cbdbccd1eae0a67751e472e
- SHA512 d6d14d98d34f97c839a4c4400092a1ed29fd626a49df52565007bbb2cbe9d31176302f7c091cfaa8efae23f7501e65374019806650e21f86f876287c5de6ae6d
- SSDEEP 192:c1O5A2wy8J5HNBo2V+KvE+lKyFVrNPT+82OuTa4SfqPwY:cuA1bBa2MKvEYKyFVrNPT+1OmIY
- TLSH
  T1EDF19257BEA3433096D384A891AA0C2D96E6D727506B4492FFDC48941F18BFD93F08D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware backdoor defense_evasion discovery execution persistence rat spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- GoToResolve remote administration tool
  GoToResolve is a remote administration tool that can be used as a backdoor
  backdoor rat
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  thW7f8/z.pdf
- Size 94KB
- SHA256 1cc7143891d7164c71d7f180db7be94ffe1fd530aad78b648ec4d2ad3607bc1b
- MD5 afa4a24080a202b5abd8ec1a731f59c8
- SHA1 f71b8032abea1aa71c7d9dcb3e1c8b6c7c9cbe58
- SHA512 7bd2bb2fe4865c527410350b2d759dd6aabc2197180b2e51a07e3b589871a756e7803e0c0b5677ec50bd2687f443a8e92dd121013a375f7b276359c57eb4ebd9
- SSDEEP 768:uD/sm/9JJRHR2t4v4FQl2AXf9hNsixRHJc7TMsY9d+xQaspeEmVXla1RD:s/cKPxY7TVY9d/jx0Xe
- TLSH
  T18993B4144DB49DCAE05FD9F167BD3424DAE730B3F6C61A26322C4261CF02DA6D98E68D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14