815832376d29fda13fdaf4f93ed02c92d6e5664a258391c35ff39094bc81974c

Sharing

Copy URL Twitter E-mail

General

Target
enet.zip
Size 4.1MB
Sample260730-w79masen8s
SHA256 815832376d29fda13fdaf4f93ed02c92d6e5664a258391c35ff39094bc81974c
MD5 7048b7fce8b5c0a70a2abadcd0cf8c87
SHA1 4efbbaa7953b58c1a7d7811d126cebb4b0bc9325
SHA512 4d291d33e80acb01e08ed3c61db8daf07771a1509a3857d9f41ba75ec6b709275c71539a227505e6fc0e867d38a729cf4077d931f6625e2b76401996e27b69c7
SSDEEP 49152:f43AKgOk0qFjpr6Mun5WNFGFEp95khnGGHr/GgDjQhWD89Wn0gau2uZSCLNqnBaE:g3ATFVpuYlp92hZ/GqjQMDMWn0m2SLQX
TLSH
T14C1633CCCCEA2BC1461E52B9E94B73BBFACA5504827F1B5A22612CE9C5C79D43744933
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  11.exe
- Size 2.6MB
- SHA256 4e917de8037479d0a66258d7fc0cdb75a33299483e71f68ff15f3e11190eec73
- MD5 df9fad6c5e6c2a0e15809421a6616662
- SHA1 243fb34e38b3a5c07ee51a1a38ec0408d19e609d
- SHA512 26c7eec8e08c673e8bc915d9d8c60a5ba3dfc90c19cfc4db165f1498daf2cd2b549e31a85b0d5e11cf867e510d8fbbe891ab628a83c64c96b6576aa0bb8c3bcd
- SSDEEP 49152:qVoWRfcnmrgcR3m+sjCi6JJW3ptVLeCBIt3WaMedtKVY:UGmrgim+OwzUbLeJtnM
- TLSH
  T152D5F1452B85C0B5CB8DE771DA2B9E8F33F6A5908BA8C5C7F9C5B9CE19732D0143A142
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2
- Target
  EVO.exe
- Size 51KB
- SHA256 26d92c18130e8b928bd40aeddd517c97c160ae68fd41663ed252fba2c5089657
- MD5 8d5068c3e2665f165f4cddb900151818
- SHA1 2bb87243a55d6bf80330f4b83e6824dacd04e02a
- SHA512 64759e4f1951382288a68a17162e296607fee712b28d76c8f61763d4519afecafdcedaccce10fb01d79d5deeef12a4942eb910b556156e187ae93866f37373d2
- SSDEEP 1536:dojlMeeWTGD3KxMNR/uGF+8xAk6q0qtbT0rhQCP:4GD3KmNR/hF+8i/cTR
- TLSH
  T11433BF0866E14221D46EE67BA2B452210FFCAE878937C71F1FCD5A881E36A305955F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

command_and_control discovery persistence privilege_escalation
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral3 behavioral4
- Target
  NBTboost Image Loader by Atlant_v1.2a.exe
- Size 51KB
- SHA256 26d92c18130e8b928bd40aeddd517c97c160ae68fd41663ed252fba2c5089657
- MD5 8d5068c3e2665f165f4cddb900151818
- SHA1 2bb87243a55d6bf80330f4b83e6824dacd04e02a
- SHA512 64759e4f1951382288a68a17162e296607fee712b28d76c8f61763d4519afecafdcedaccce10fb01d79d5deeef12a4942eb910b556156e187ae93866f37373d2
- SSDEEP 1536:dojlMeeWTGD3KxMNR/uGF+8xAk6q0qtbT0rhQCP:4GD3KmNR/hF+8i/cTR
- TLSH
  T11433BF0866E14221D46EE67BA2B452210FFCAE878937C71F1FCD5A881E36A305955F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

command_and_control discovery persistence privilege_escalation
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral5 behavioral6
- Target
  Remote Enet_ssh.exe
- Size 460KB
- SHA256 abcdd30547a5917873bb33624c611ffe0d2a2ae437fa14ef412788b9aaa06d2a
- MD5 f74fbb8a7bd4e430fa820c401204405a
- SHA1 9f0f431934af7aa01c02944cc325dfa190f866bf
- SHA512 47ac00d2a0a527b4aa6a54d4f4d35e5330a7da75b118413dd6b2fedd8236508b0e522b267cf7369ee9a0c65addee1a38e3c53d90c36692fc83fec6bcba978ed3
- SSDEEP 12288:sHbw2SZJF6LtfIH8uALEV63Evylzz51tw:sH6AwVCEv6z9
- TLSH
  T19BA46C30BA46C137D5A215328E7DDB7B646DAA210B2A51C3B3D81E7E2DF06D35A3131B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ZGW_SEARCH_3.0.exe
- Size 112KB
- SHA256 028377bdf1cee7b471f9e81e435a78eb9c231aae686672764bbcfcc1de5f6854
- MD5 9e96e40cf936bab451655a5280af648a
- SHA1 20ac0c7112948db27deca08dea6000a1f6d9ad3a
- SHA512 a853a6a99291238f930a91f5c66f2337063104ac601ac66248bd37fce41af5c628d97348aebf26378365c6723a4eba0c036fb6f19cea15606fb4ab7ead7dc5c2
- SSDEEP 3072:rMEOC88o4W26Y2DdqxU1XjJFqxfK6wmC:r9OFiW26XJQU1Xj3qxfK6wm
- TLSH
  T1E5B3C713ABDC2142F12706B01E3669A969763C390560AD4F2749FE8D29719C3F9B273F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  libcrypto.dll
- Size 1.8MB
- SHA256 065d3a16b418dfe5647c56c8a1787ac540b13299bdf35f69e9980525804cb9ab
- MD5 bfb07109da9eef8ecb8e4360a56b1641
- SHA1 d71484f8f0b8fe26222677597d04ad61dd68291f
- SHA512 7b8a392e6e9f82c81d5b76e7a171ca4de133b417914dd8c5e21102764f61fc6da2901bdcc601cabf0ee2ddc242c9e0e40df90a94c5b403d0785d20efff6c9654
- SSDEEP 49152:RiYeMEx5Hn+aNK0bWPFTpU+ivStjRfTNOS/UzuDAPxzIbdbZnR1CPwDv3uFvXDRB:RJKx5KzU+JPR/UqkzIbdbVR1CPwDv3uF
- TLSH
  T1B0958D25A6A904E9DDBBD23CC567951BD7B2B4100370EFDF06A14BA91F13BDA673A300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ssh.exe
- Size 1.2MB
- SHA256 e41e50a22dffeae8bb13bce4cb47b6c4aa0de4cdecbd62ef79d5046adc05a8b1
- MD5 21b3b0408efbbb931bad188a98d731de
- SHA1 45dd06206759855bbafa59d3869fdded3da059f9
- SHA512 25b12b462d278f59da27052184a0e1a4956ea14f5801c4c9935bb6d607b261246b1655bf544ec05fbe3af6fddc671a2ba83486757847616bbccac1e2cee43388
- SSDEEP 24576:WKoammb8gV8kwkti4xvMHZSmB8YLppxGlQ21aKUUjXnnhkFqOJz9ai5OJ:/tmmogajX4e5SYppxGl31kCXnOJDk
- TLSH
  T181459E51A6A100F9D8BB9074CA9653A7FBB1B02417347EDF0E989B212F33AD1173E719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14