472ee5813c5fbbe7e1c3fa9cc14b47bd2c2c3b800d31de24537ff68a61335873

Sharing

Copy URL Twitter E-mail

General

Target
dogshit.zip
Size 13.7MB
Sample260801-babnsathmd
SHA256 472ee5813c5fbbe7e1c3fa9cc14b47bd2c2c3b800d31de24537ff68a61335873
MD5 60590ec8bc5f99f5c6cc3cf2800bdb59
SHA1 7291cc4e9237074b39a9fef54e0963866c67c326
SHA512 1d7d2193d56d984f7a62e09041427f7d25cc5234fd7395f4b8d9eb8664600631c346e7699be3a451cfbad0a42e8a86e211a2f60199267dc80c1f651e4262b3bc
SSDEEP 196608:t2A+wW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7Y4mIEvnk0H:tjgCDQaC28nl78Kg6zCWCdFCIEvnk0H
TLSH
T116E633811935C0CAE5750733D998CB9CEEE19D318785CE8DCE4C6C993EAAA2B274F744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  dogshit.zip
- Size 13.7MB
- SHA256 472ee5813c5fbbe7e1c3fa9cc14b47bd2c2c3b800d31de24537ff68a61335873
- MD5 60590ec8bc5f99f5c6cc3cf2800bdb59
- SHA1 7291cc4e9237074b39a9fef54e0963866c67c326
- SHA512 1d7d2193d56d984f7a62e09041427f7d25cc5234fd7395f4b8d9eb8664600631c346e7699be3a451cfbad0a42e8a86e211a2f60199267dc80c1f651e4262b3bc
- SSDEEP 196608:t2A+wW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7Y4mIEvnk0H:tjgCDQaC28nl78Kg6zCWCdFCIEvnk0H
- TLSH
  T116E633811935C0CAE5750733D998CB9CEEE19D318785CE8DCE4C6C993EAAA2B274F744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution persistence pyinstaller ransomware spyware trojan
- Renames multiple (6135) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1
- Target
  dogshit/2394070.lua
- Size 236B
- SHA256 658694bb22590ffb2cdbe9de44d97aa5980d8a83d5ab41333b37f077c7a690c0
- MD5 c0524f58d4a59e1ffca5671d560f7915
- SHA1 6bc6c46acda1de9b9f06929cf152f5b534b1ae02
- SHA512 5025140bdbefca153a25b9155d9099e9b44e17257d4fbda61f89a20e37a3f0eb6d76bd851cfc86a13ead90489220a3f68db8baff9a5d5a046e1c3c2bc1dad19e
- TLSH
  T1B9D0A7B203B410575968FF4D9D2B159CED5F82EA75C431F5883270DB66420267B56C1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  dogshit/2394071_7352388594244382936.manifest
- Size 325KB
- SHA256 c83f7192aefa756f189a04051a842c43e86c5e6e6b4f442917abd5f138d5413b
- MD5 4e5f8b2ed5abc4a3414dad67f5c3bfb4
- SHA1 4276e274db16f3d45607810b660945f54cf7804b
- SHA512 75fb1ccec9d52f2ff30619b50c5f7114aeb1b5d975a6fe87951871d18be969898d8d350c4a06a2a63669393bc38721c70c1d09ccdd305a1587bcc0ca2ab114c8
- SSDEEP 6144:spEHRnmeQ6s+asA37rBNptAC42dYGLfMtUWWB89ytGhh:TYFL+asALNtAC427L8UDec0
- TLSH
  T10364F8D25916C5CAE5252B33EB9CC6CCAAD78A3587C4EDC8CF2D0CD92D9682B3356740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  dogshit/ManifestHub2-2394070/2394070.json
- Size 2KB
- SHA256 5271f0e3ea775830523134fb7c7750bb298bcc84d5c5ac2d3769a098c7631423
- MD5 553a3e88a126f067a8fba99cbc032d36
- SHA1 ecb22a2b51862601f090f4b046b053883c267435
- SHA512 76337f03f939242bd2a9ec8bc53310f6a286189e0a0ec4f02fe8352803c5268462558c138bf8ef86ece08ebb80d5d8eedfaa19b02c36a45afde28f6df4438eb5
- TLSH
  T19B41793DC9B08CD71589E1681C3E4206AA34426F0D483E283B2D518D8F6DA5F96BA77F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  dogshit/ManifestHub2-2394070/2394070.lua
- Size 193B
- SHA256 3dd512e4554d8755617263b615f934c10a5c5b96b305c3e1dc9a117eeba0dd14
- MD5 6fe434c8286ce6079a0b818656af5429
- SHA1 ac6e8c711b4f11e90454d2e64c77ace185e5bdde
- SHA512 315764ceac691bf3b4a72c1157ba53611ddbd390f5b93b4aef18f22290a74b9491239d61d94aa148308fb82e09edd3516f1d2cf854925de94681fd02570057b0
- TLSH
  T15BC012F205E5255B9B109A5CAE3F04A9ED5EC2F666CA70F68C2570E763420396C26D0E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  dogshit/ManifestHub2-2394070/2394071_7968616020155547253.manifest
- Size 538KB
- SHA256 fd4b67fc5df16a9f49126a4d09b02f89e4415b49fa7005e4632a0a4e67851413
- MD5 cd24be6b9b90fbe2a13d95251800ac9f
- SHA1 5c67b896ca3bf235666247f2251b13d5f1586520
- SHA512 8647e858d6a82dc90bb8ebc743a0f18db2729aaaf526aab9896d4b2be5ff614a6658d30c02306dc29dbf0abfb56fd795ae8cf6e2733d86fb91f37ad92ce2e208
- SSDEEP 12288:fkbKwLgrrZjOM2WIrDtvzwgT0Nfk8cGzQGLInjvGr7kbe:fKKckrX2H9TSfkR8QGrEe
- TLSH
  T12FC4E0441A3294E3F61807734DD5EB2C9F641A71A78760CACD5E68A69ECF96F23CF024
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  dogshit/ManifestHub2-2394070/key.vdf
- Size 129B
- SHA256 93711aa20e213f20e5f000dfe599b1348dc4f15db82ff4f4fde6d9d6f7352f37
- MD5 5fb12d270805df7d8442c65c5d6e9929
- SHA1 0ce89afbcb0f427a195a7389f7fac97d8ada68b5
- SHA512 588a960639d37172ccbb5c4bbc75f9e2340e6a80a8f38b779e09ccbf21ef6bc1278b00b215b26d6a01d5287b646ebb5754adce04e5078521dabdcc18e2a7926d
- TLSH
  T1E4B09BF184D018F71156FD5C5E3F44CCE65683F320D401C9365E619D9F410459447615
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  dogshit/New Text Document.txt
- Size 21B
- SHA256 601b2bd3c3b0801b3307f65f5fc691d87aa2347687b10908f4141df78cbdf40b
- MD5 de8d076e63245ea30050039b72b74d5a
- SHA1 d8dbd60e12704a21161476b4eb4b7e0bcea3ea30
- SHA512 157e7011066a1d659385d00b651e51dbae18a592522f9453e4bd8b2c7e97074c24e7a6543ec1aec7122852a2572a066a079d84ba8992eaaa8908cf223d53d5ce
- MD5 SHA1 SHA512
Score

1^/10
behavioral8
- Target
  dogshit/SteamSetup.exe
- Size 2.3MB
- SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
- MD5 1b54b70beef8eb240db31718e8f7eb5d
- SHA1 da5995070737ec655824c92622333c489eb6bce4
- SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
- SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
- TLSH
  T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence spyware trojan
- Adds Run key to start application
  persistence
behavioral9
- Target
  dogshit/st-setup-1.8.30.exe
- Size 10.6MB
- SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
- MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
- SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
- SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
- SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
- TLSH
  T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral10