beed204b93de512985fd808a25fba1d44577487e361f851a96a3df915b10e5c4

Sharing

Copy URL Twitter E-mail

General

Target
beed204b93de512985fd808a25fba1d44577487e361f851a96a3df915b10e5c4
Size 294KB
Sample260730-ll3azsveqf
SHA256 beed204b93de512985fd808a25fba1d44577487e361f851a96a3df915b10e5c4
MD5 f00fc4196e6049443bd66371333458e9
SHA1 7bdae59266ad97022469c7d3511d7348c76c7e73
SHA512 c05e524d4131e2d329d05bb0c3da2ebb7ec6f5516ee5c0b67ec91d6be349848f3f76e104bc556b47c36c1d62b4a5187f99221be633c317b53e3b96437b5c8ee9
SSDEEP 6144:Agk8oySYrG4cehsB1EHBG1NvEShgngFD5yuodMFwpgEUIL8oO:o4/rG40BIK8jgFdodMFneU
TLSH
T165542381F2D8BC119A71492CF87399B4AD09C8C053B66672C6E58BD3345F2BF377854A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  exe.exe
- Size 193KB
- SHA256 076385df30ac3b73743881c39a26936a4cc03a4384a02bf850e3c2f4b23f1565
- MD5 f0c30bc1fe9fe22bb47b7f133f876530
- SHA1 e18469e2648436f83bd7080cd9ea7453db4f6c7e
- SHA512 0ef0dfec7d7f8803d4292b1f0f14fb96b6d37be3373b64b87535e9e99f6957fc5f9ceacc96d64ad310d39e509039f20521d869cd27fb76cb26470f253c4af0aa
- SSDEEP 6144:5V28okSYPG4aehsP1EFBw1NvOShgNzjdVoS:5om/PG4+Pcw2jBjXoS
- TLSH
  T18E1412C7E2E8BA20D670757CBCB62878AD1CD58893E89237C1F613B67C55487372C80A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  源代码/NSudoLC.exe
- Size 127KB
- SHA256 b75d7eecd4eb970f800113d99b9a05ecbceaae65a1d8c281aaa67a3f0867619e
- MD5 3360efb5c779c805b7d76fd1e1ee558a
- SHA1 97b140d8b86f9570cb34fa962f0ead4ca261112e
- SHA512 5a30c0d8ff7f40594249908928b3dab95c766bb42ec98be0186f998507480adbb6716d28d3b6b90023121ca756e4eaa227c0aedf1b725bcd3d835dbd252a9dfb
- SSDEEP 3072:rZ4E/UueyCtgFLMgjxFxNUY8BuA6N3U8:rYeZTjDUPBuA6q
- TLSH
  T11AD37E25BAD8C872E1B002703A79AB62D03C76695F2402CB77954B6CFF14BD26932F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  源代码/bat.bat
- Size 1KB
- SHA256 74ca5b3e4ad8a810d9802282acf59450c4937deaf6b5c032ddce9e897ddb0ea4
- MD5 53faf14c78d7e0d35ec0c0c3e66a2812
- SHA1 e6c89f64e245d60aca8959e96b629bc91ca211ba
- SHA512 d61f6a73d1379976636befbaa1fec7f11da88f9e5ae16d16a90f9523d1a4425277c7ccc8b49cbf9f91e415a9bda0ce680d0d229ea66171cd9517006779a318ed
- TLSH
  T14E21935C07EA006A10A6D838CE08289A97C97F70A3FFB451C80629E2FB6117D4A7BD90
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral5 behavioral6
- Target
  源代码/tempbat1.bat
- Size 3KB
- SHA256 f15ea476f8fc1b20a007792efd7d4d1e16ad15257203639248e44ac46f50260f
- MD5 994d5e2ad561ff756526b1de3ca9850c
- SHA1 7a93de2c05b3f580f3e34c546bf5aedf908e0bb0
- SHA512 4f24d3d1de78a0bd3f0cc85304a8e5d8cecc06d9e2620f5e4702e5b9277ebae11d423a65d6587c80e3ded4a3d67952e65f0cc9b4e24c87304297f1ea8f96ac19
- TLSH
  T1D0714930AD24C11BD655B020D9157B40E7F9B3A774C2ABC168CD21939127CEBA17D7DA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution persistence
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
behavioral7 behavioral8
- Target
  源代码/tempbat2.bat
- Size 982B
- SHA256 83fe350df88dde8d1107879cb5c4b8afb70c7e803ab095b8904da1281ba0945f
- MD5 c0697fdede7a924f8f5cf60e070d6ddd
- SHA1 571c018f695d83a977cb58ea6a6a62b39586a245
- SHA512 18ec7034cef58a5e66772db39cef37333045a9e7bc41f9cba10ff31e73af3bc3ca327c59ce859a970948dd8d313e38eb010ba1ed076bb65b87e8097489803c29
- TLSH
  T1FA112D8C1BDB640798D254908A18058BE7D4BF71A3BA6464820338F1FB215B98677ED4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution spyware stealer persistence
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral10 behavioral9
- Target
  源代码/tempexe2.exe
- Size 45KB
- SHA256 f52a6f783c445e9d11aca1e8961d4efa344d0638379b9b8fe5b3235d5a37cb5b
- MD5 ff1385312d267df2e897a593414fdd72
- SHA1 5d4b8af3e81d42c3d0649fe975f5251cb5625ee6
- SHA512 725c259cdda923f8b8dc3efc19a8c65eb6ba9f2d1faf6810b3d73c8c5e99bc96802422033c71bc6f92d8858d518ac1b0bdbcf27d7999a189e7e8cb610f540984
- SSDEEP 768:/pm7BcEKNvBcvL6VeRNL1a6ZO4PTPz+o+CKr3zQ4NuVVWgP4+zVX1TnbcuyD7Uii:/pfEKNCj6VoJl9Go5K7s4Nu3XlTnouyI
- TLSH
  T1FD23F147A2CD69ABF2644075AC6F1C295F58E72875C08373EDE033795CA0E069F2D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer upx
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12