7e95827e0d28850936c5d2df49090c4bc8e4a78db09ff6c3cc1a17070ac94984

Sharing

Copy URL Twitter E-mail

General

Target
SWIFT_MT103_PAYMENT(64136).zip
Size 37.3MB
Sample260730-rp23aaag72
SHA256 7e95827e0d28850936c5d2df49090c4bc8e4a78db09ff6c3cc1a17070ac94984
MD5 18f31fb788d14c5da687a794f4793cec
SHA1 515e4eafcc5adf25cd80202d6d14e3e6e69b9271
SHA512 c5e66c65711640ea234f7f15ffbdbd7a7cc03170b8125c49e142548fdfd8b79013133ee100660e4d4bf6ad4924af32d57b5a570b784960df66abce5b3c08b968
SSDEEP 786432:3dwm/GCb6M1VN4OkZVIpkOs0om4B+vf74BALjAZA:32meCbpKVokOsVRBO02jx
TLSH
T195872217A6E60164D5BAC138CB6BA546FB723C0613306ADF12A8B2556F73BF01A7F314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_29766118.vbs
- Size 7KB
- SHA256 98bf2190ec4274d16c47decaa0f7319d819d4410e37bcb18ef4bd9c70be15a7e
- MD5 bcdea4da5b1a93f4a7739bf8a1ed185e
- SHA1 cb6dc039b9c71001fff974a7fee4cd85cbd4cfd6
- SHA512 e24f1510369572d5a8e4217d0e3b0130d150e1d84e4cda99be0e2e6f94e018dca9ccfcd0621f1aac28fe80fe0495bc47106f1093e9942ab3d137b89994528957
- SSDEEP 192:vzRjTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:ljTdDzeeARF02LDzwfjFxJ
- TLSH
  T1C2F1D10BFD112638C356D3F849B82C9DEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_46912147.vbs
- Size 7KB
- SHA256 98bf2190ec4274d16c47decaa0f7319d819d4410e37bcb18ef4bd9c70be15a7e
- MD5 bcdea4da5b1a93f4a7739bf8a1ed185e
- SHA1 cb6dc039b9c71001fff974a7fee4cd85cbd4cfd6
- SHA512 e24f1510369572d5a8e4217d0e3b0130d150e1d84e4cda99be0e2e6f94e018dca9ccfcd0621f1aac28fe80fe0495bc47106f1093e9942ab3d137b89994528957
- SSDEEP 192:vzRjTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:ljTdDzeeARF02LDzwfjFxJ
- TLSH
  T1C2F1D10BFD112638C356D3F849B82C9DEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_07624508.vbs
- Size 7KB
- SHA256 98bf2190ec4274d16c47decaa0f7319d819d4410e37bcb18ef4bd9c70be15a7e
- MD5 bcdea4da5b1a93f4a7739bf8a1ed185e
- SHA1 cb6dc039b9c71001fff974a7fee4cd85cbd4cfd6
- SHA512 e24f1510369572d5a8e4217d0e3b0130d150e1d84e4cda99be0e2e6f94e018dca9ccfcd0621f1aac28fe80fe0495bc47106f1093e9942ab3d137b89994528957
- SSDEEP 192:vzRjTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:ljTdDzeeARF02LDzwfjFxJ
- TLSH
  T1C2F1D10BFD112638C356D3F849B82C9DEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  SWIFT_MT103_PAYMENT_04.pdf _92445991.vbs
- Size 7KB
- SHA256 98bf2190ec4274d16c47decaa0f7319d819d4410e37bcb18ef4bd9c70be15a7e
- MD5 bcdea4da5b1a93f4a7739bf8a1ed185e
- SHA1 cb6dc039b9c71001fff974a7fee4cd85cbd4cfd6
- SHA512 e24f1510369572d5a8e4217d0e3b0130d150e1d84e4cda99be0e2e6f94e018dca9ccfcd0621f1aac28fe80fe0495bc47106f1093e9942ab3d137b89994528957
- SSDEEP 192:vzRjTvlDzeeRZNmRhqo0DuusLDzwfjLZxJ:ljTdDzeeARF02LDzwfjFxJ
- TLSH
  T1C2F1D10BFD112638C356D3F849B82C9DEC95C1334C6A4858FA9C16282F26EE7B6D45F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  ZvEUKF/07624508.pdf
- Size 94KB
- SHA256 1cc7143891d7164c71d7f180db7be94ffe1fd530aad78b648ec4d2ad3607bc1b
- MD5 afa4a24080a202b5abd8ec1a731f59c8
- SHA1 f71b8032abea1aa71c7d9dcb3e1c8b6c7c9cbe58
- SHA512 7bd2bb2fe4865c527410350b2d759dd6aabc2197180b2e51a07e3b589871a756e7803e0c0b5677ec50bd2687f443a8e92dd121013a375f7b276359c57eb4ebd9
- SSDEEP 768:uD/sm/9JJRHR2t4v4FQl2AXf9hNsixRHJc7TMsY9d+xQaspeEmVXla1RD:s/cKPxY7TVY9d/jx0Xe
- TLSH
  T18993B4144DB49DCAE05FD9F167BD3424DAE730B3F6C61A26322C4261CF02DA6D98E68D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ZvEUKF/LogMeInResolve_Unattended.msi
- Size 37.2MB
- SHA256 16f92782bd3b522b24ea25c3c0707f75d538d49a99b490ed3c24124a6d586535
- MD5 61a515dee5380a93bd5afe980d7dd1e7
- SHA1 0ba0a003eaebd19967bd9c031c8271d709743a82
- SHA512 78b0e3b5d77409b363da181db5e1012e7fff15fdca0cc775b601edfe732c6e221cdc0082ca2725a3644f2518505bce3f1f64bc3d8a1d3ccb998d7e00a62765e9
- SSDEEP 786432:6dwm/GCb6M1VN4OkZVIpkOs0om4B+vf74BALjAZ:62meCbpKVokOsVRBO02j
- TLSH
  T1EC872217A2EA0164D9BAC138CB6BA546FB723C0513306ADF02A4B6556F73BF05A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  ZvEUKF/install.vbs
- Size 7KB
- SHA256 66cd2d2a533b9ac820fd8c760e8390274e02ca0c96c3646786383102f2b76545
- MD5 d2567038bfcd724a1992159cba3f6f55
- SHA1 79a2f57da31229293cbdbccd1eae0a67751e472e
- SHA512 d6d14d98d34f97c839a4c4400092a1ed29fd626a49df52565007bbb2cbe9d31176302f7c091cfaa8efae23f7501e65374019806650e21f86f876287c5de6ae6d
- SSDEEP 192:c1O5A2wy8J5HNBo2V+KvE+lKyFVrNPT+82OuTa4SfqPwY:cuA1bBa2MKvEYKyFVrNPT+1OmIY
- TLSH
  T1EDF19257BEA3433096D384A891AA0C2D96E6D727506B4492FFDC48941F18BFD93F08D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware backdoor defense_evasion discovery execution persistence rat spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- GoToResolve remote administration tool
  GoToResolve is a remote administration tool that can be used as a backdoor
  backdoor rat
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14