b9dd74f8f1992ba6f62062a7d4922c02a00826048d6dbe1d30b946de37c52c6e

Sharing

Copy URL Twitter E-mail

General

Target
release.rar
Size 45.2MB
Sample260730-van4nawsgy
SHA256 b9dd74f8f1992ba6f62062a7d4922c02a00826048d6dbe1d30b946de37c52c6e
MD5 6c60373ec6c4de75481d03a38471ee4e
SHA1 f88a1587dc95f5f19cb1fc588a8ee261e665ea1c
SHA512 dafe0daf15306aa1eba132858895e9ebdf2ed380f3723320c21b6a6c2b9e8bbb489b70fb484b603d351fac86e1a157a1ee3932c8fbea39432243153443c9e569
SSDEEP 786432:4/OhctXlVltaj/IDNsDSa6hMPPw8yJXnct6e6UuIHPO8xeqGtgSMDx4mjeh:zhctF+ApLjqWnnU9P/ItgvUh
TLSH
T190A73383FFEE762BC95BCD19A3429E22A76D768458224B0FA7727214F5B55023C1C273
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  release.rar
- Size 45.2MB
- SHA256 b9dd74f8f1992ba6f62062a7d4922c02a00826048d6dbe1d30b946de37c52c6e
- MD5 6c60373ec6c4de75481d03a38471ee4e
- SHA1 f88a1587dc95f5f19cb1fc588a8ee261e665ea1c
- SHA512 dafe0daf15306aa1eba132858895e9ebdf2ed380f3723320c21b6a6c2b9e8bbb489b70fb484b603d351fac86e1a157a1ee3932c8fbea39432243153443c9e569
- SSDEEP 786432:4/OhctXlVltaj/IDNsDSa6hMPPw8yJXnct6e6UuIHPO8xeqGtgSMDx4mjeh:zhctF+ApLjqWnnU9P/ItgvUh
- TLSH
  T190A73383FFEE762BC95BCD19A3429E22A76D768458224B0FA7727214F5B55023C1C273
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  protected/Slinky.exe
- Size 6.0MB
- SHA256 3d68c709fb63cc90a01d3aaf2db427edf5c39cbfe42a0499090ce7c3ca67827d
- MD5 029a0878d7b088c182fcd87adc7cf9f4
- SHA1 7f9312aa81b3fb6d5c416907ffecb0b92a11831a
- SHA512 f3e5c35c7934c71417614397975cfe31b90950e873e762056c8a8beff44a9c4de3586b8feba7313aecab370aa7052fc0408bdb035643a85bfe123d3fbd637d5d
- SSDEEP 49152:PsAOFu7Rot3mMIKom+C8eq8+Ns7LlnU09HS4qjtkZOUMjO10o/aufKiK9KvRp5Ep:PpEg/NClnl9yNSLthbJEp
- TLSH
  T18D564A03ECA545E5C0AAE23589679212BB717C885B3627D32B90F7783F72BD06E79350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  protected/archive/lib_win
- Size 21.6MB
- SHA256 be03bbecbf14b03458de36c8b3848c1b7325ad0aeb6a61b6e0f9206fc40b4af7
- MD5 cca3b536cbdf30a01b6f56faaaba4867
- SHA1 8942402a925183da44efce556f844374677a7fa5
- SHA512 862dabf12ceda043b66450bbfa2ec778c9281e303132c57c53b68dd56e24f6f4c9a9ebf6bce973db0410b2e42593eaeecac86aebd66db51a351c477ff3c9f632
- SSDEEP 393216:t1hMVBgt9zH4/o4PXARSt6DXUIbj22gUIEO2r31Zkhbq8PH42ZhZ02/qgmi:t1hMVBgzH4/9QRSIDtbq2JISZWuMPTZ1
- TLSH
  T1E13722D538D042ACC88BC531E68E2BEEF0D678495DB9681BBFC709012A31D56DCE6937
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  protected/archive/lib_win.sha256
- Size 65B
- SHA256 5a6aceb05ecf870a71ce005df609517ccbf80d239b8d814b2baff393c39b4808
- MD5 d8a55ddda3045a6ea6ee616e19165d7e
- SHA1 89e0522a65b5170191307877283d26dd81a7267f
- SHA512 affa29cfc42a5d6a602db97c2f41c30488490bd978b956d6fe15243f7357125880b3d13bc8f44e0117d6e61d260fc14f8623bfbfac23efb81edc57d56fdc8267
- TLSH
  T1D0A00252D9056641AA193764360D033A2A858A515C137EA693A169FE369B231E0E4750
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  protected/archive/lib_win.sig
- Size 71B
- SHA256 4929f0a9fe6d2b9c462d12a03442b4b257b0b1851bd1d7421ff3e4317bad17f1
- MD5 78a9831d8463d054e04bab1c821b7a92
- SHA1 ede53e39267e40fd73cd2d394fa9f8da873213c1
- SHA512 4724dfcaba64be2aa5c54dc41f8ac08819a694e2eb4dcf889a875ae84e8412902de991759cfa12f2108dabefaa8f4ecfa1662406a60eea5d34879bad82f366c7
- TLSH
  T12CA0223C2A2C20222280C03A338808AEC822C0A38000F0CE203022F0CCCC30308B30A0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  protected/archive/loader3_win
- Size 6.0MB
- SHA256 f93345c0cfe60e5fce7d8d84ad23043cfcdd2c9516791309215bc9a005ee4e95
- MD5 0a3f1c2d04bc0d6183b4919628e08a86
- SHA1 af161fd596ebbab8dd723d6d70b81f1cd8b59ae6
- SHA512 493f4d5ece050109ce9acd77c09e75177dabf917187b08a12676278ccd687867ad6078b489fc154e9bcbe7a7aa8871097bf53d79ab63035348eb738bde96f278
- SSDEEP 49152:PsAOFu7Rot3mMIKom+C8eq8+Ns7LlnU09HS4qj+kZOUMjO10o/aufKiK9KvRp5EZ:PpEg/NClnl9yeSLthbJEZ
- TLSH
  T167564A03ECA545E5C0AAE23589679212BB717C885B3627D32B90F7783F72BD06E79350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  protected/archive/loader3_win.sha256
- Size 82B
- SHA256 b4442b4f64f6ab7ad6b694c932dee25a5d7426b0018d1842ac6578b1f009fb2a
- MD5 aa1d294237c55d0e1bf07db6c0b5ee7f
- SHA1 035cad502c0fe26415295816761cc5832c7d58f4
- SHA512 46c01ff4c9bc06dc706db75fbe25204c41c293501a4d7e9e80a0ac0d834229df0c5cf469c1309106cc2d2bc63ffdda2212675bef172e198b9cfb9f74b558214c
- TLSH
  T196A012068124D8060509262512190D4177802D17A100680745104099A202E0C97C6136
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  protected/archive/loader3_win.sig
- Size 72B
- SHA256 86d9d92de79a00fab75dcf7799184af028c5268f9041a8cda5c86b8421427650
- MD5 ef7fe63d71674138bf0b2ecd8b7955aa
- SHA1 1f6a5c5d970aa0aab7fe2d326f158b77f267480f
- SHA512 cd474c880ddcc58b682cef70717053625515d9feb78c38df297d79c5e4c0278a8b55248c2b9b3dc4f6a3d08091e6928bb54f16ae6e801f1276d57763c79ae309
- TLSH
  T1B5A022082008BCC303B280A203A0CC0020B820A8E0C80000BC0C0320300CE82E0C2C03
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  protected/nacre_7f2c.dll
- Size 8.8MB
- SHA256 044f64c5a19e365b9994e862d710ec37aca8475ddb64270238b16e988257f8e1
- MD5 29f5b2dd6612c316ee355fbc4bc8eab9
- SHA1 20b9f68f1cc082d0a4013038ec399bea43f316ea
- SHA512 5601d6bfb4f997764abc5b0e0d95f4a9f0878e59601b996411f9a7d19a22ef46ed97f91e9e0639f77e5ac3b69aafb429f21aa4b4932ea5ab8f1b066bbce3713b
- SSDEEP 98304:YzEAfZSUwLn4Wf+O+PMYuWbj2naqxZiDF8xHgrHPoyPZm9KQpE6j:YzzfZSUwLn/xYuWzqxZiDF8x/H9EG
- TLSH
  T12896E0A9A5BC0079E467857CC28B2266EBB1B4290BF017DF2F9445E51F33FD096BA710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  protected/stinky.exe
- Size 23.0MB
- SHA256 4fb030b137047c127b134051efb187c44b4fc13308cbb8c0dfb94de2627094ae
- MD5 9f2c5ed3edd22492748e946533df0edc
- SHA1 3b3f4cc501ceb0027ef80a646d43db2c31639d9d
- SHA512 e30e463f14e0f85175e620c56c567c382a9d5c8329448ef8d3133be99772ff4ec14d7c66421b4f08d4ea982ce8718cf083e2442ab752a80c148919e33e8d755f
- SSDEEP 393216:O2uL8awiLSKtiAT51av8CIeSmS80v7qnQxkoJp9sObdBzWt5KYv/U:O2ugaw5KtiVv8CyvenQyoJfbP
- TLSH
  T19E3712C678E191ECD397CA30D7CA6AF8D2DA768A0CB9542F6FCA04022631D51CDE5D36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10