211be3346a4d85988bac11ae231ff51d8c7fa408770e0261953c3946ae735e12

Sharing

Copy URL Twitter E-mail

General

Target
SKYPILOT_Setup_v1.0.2.exe
Size 325.6MB
Sample260802-d176sasvgt
SHA256 211be3346a4d85988bac11ae231ff51d8c7fa408770e0261953c3946ae735e12
MD5 7a0e9aceac5c6f9aeebd2f16604bc19e
SHA1 73acd8a1f276b5abdf5af2a43e94d1620b04bc7e
SHA512 bccdee1c398854534afd10bc724b1f3cc39dc2539835a8405793c1a65a0bb9313d4f868529f8295a28bb81cd1f13005af7f5c4345fa12e1c76e4d5a37f142222
SSDEEP 6291456:Cd4M8H0+vq6AJDYD3pscZYVcJjBy5iDafW1PTp+Yk65ly5/4E2gI/JHICkz:Q4MhwvAJDYDrV8B8Tp+bIly5d2zICkz
TLSH
T14FF8338E08B8B76193F6E17350757BA24DA8658AE26F326F723004C29F1E935D16CF53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SKYPILOT_Setup_v1.0.2.exe
- Size 325.6MB
- SHA256 211be3346a4d85988bac11ae231ff51d8c7fa408770e0261953c3946ae735e12
- MD5 7a0e9aceac5c6f9aeebd2f16604bc19e
- SHA1 73acd8a1f276b5abdf5af2a43e94d1620b04bc7e
- SHA512 bccdee1c398854534afd10bc724b1f3cc39dc2539835a8405793c1a65a0bb9313d4f868529f8295a28bb81cd1f13005af7f5c4345fa12e1c76e4d5a37f142222
- SSDEEP 6291456:Cd4M8H0+vq6AJDYD3pscZYVcJjBy5iDafW1PTp+Yk65ly5/4E2gI/JHICkz:Q4MhwvAJDYDrV8B8Tp+bIly5d2zICkz
- TLSH
  T14FF8338E08B8B76193F6E17350757BA24DA8658AE26F326F723004C29F1E935D16CF53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  SKYPILOT_Launch.vbs
- Size 318B
- SHA256 49f911623f47a770f0ebe30de396696788f924e355e5ee04deb294c47e56bd77
- MD5 f8075ba224ed4b72902ec8ea6ca14970
- SHA1 3a30ea3878639b6a2b383898ba6f8ccdff84b1a4
- SHA512 980fbfab9ac194b1d34c830ba0ac003bf83ed718c95f239d88fef1fbab33a2a39cb42e007b77953ae8a7b0465b8ec65d727afd98df3599ebf32192874a529c83
- TLSH
  T12EE07209E40BC02C8E8B8B4411EA8C3E9B63B2A30004E13C8A20CAC8102C9F82E08643
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  SKYPILOT_Stop_Running.ps1
- Size 922B
- SHA256 83826a5fae40f7a688ed294906fc45dd019a5cbd8066b5ec252854c9a3671381
- MD5 36c68fe704eab49ee5e56a0463690ec8
- SHA1 0f835d2783b6d2bd6c78f1ad82a2116b4458bedb
- SHA512 0bbb33a021a9d6d5e61fb0adadaa6a1ce1f488f3bcc2413191c8e2a62e3f2c3ebfd2a2a6f0bba3ff55a53927d88bf4f529b30a3ab4de047cc151a7169633f443
- TLSH
  T12711CC023B85B1D040B66B3686CA5387EECB06B72206A951BCFCD2457F709744749E69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  Uninstall SkyPilot.bat
- Size 104B
- SHA256 aa2c6fbb247425a254ee23783c17767d14346004eee28c18f13f275815b42da2
- MD5 67395e5859b60226d089beb267719001
- SHA1 c07e26e814d8cf9b852d2697978d3a61d4990003
- SHA512 20f7a4103edba170289dd4fb1efeb394370db8a71e80876a405879336c54f1b31383146d0e57c243a38a113c94495f844850285fccc0dd54650ac479caa9896d
- TLSH
  T197B012165156EB5D39A7DD2510D340BC592E514613158B4170F1463A750D21DC1EA1CA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution
behavioral4
- Target
  Uninstall-SkyPilot.ps1
- Size 2KB
- SHA256 461319461c03eeb2e0677172dc74cfbc97a40fa62be4cfacdc71f0f728822fac
- MD5 6aaea84a737b034ac7ac1998a8c6eddf
- SHA1 d43ca3f0851aca655cdd9c2c7c112922b0fdab3f
- SHA512 ebb9525adcd7f8dd3038f1370d876e948c2ed40ca2d57dab7abbd9bff18f7f213527733310f2523d3675319e5b2ae2698d8985c8f09105de0f20f85c1f01678c
- TLSH
  T11451414235E261A1B8D5372AD5CB534E179B097F018983003CEDD153BF9396E8BE51E6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution
behavioral5
- Target
  Uninstall.exe
- Size 489KB
- SHA256 755a92c0d9611fbc5907a7aac730fc7254646db8c71377d39cc1bade0ae5a444
- MD5 f679c05b7115c083f56dbcb0256a99b0
- SHA1 753ceea4763e523b4183468b8cd28eee359cc51f
- SHA512 1d6a41eafb689e0defef073c59ee4d5aca8ff6b1e17314fcf24e4da57caf906e8adabf9cd9bda2c99840dc6de427dd3d6f8c05ddaa53a927b199fd04d4232478
- SSDEEP 12288:aln823SOB39HHGZNftY+I4glZJxl3NTe5SGOaafJEaID:Cnj3dGZw+rgfJRTYOthEaID
- TLSH
  T146B42348E2D4F7F7C5A27975039AD9935D7AA827237643C64330E6883C67E13EA0DAC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral6
- Target
  _TEST_SERVER.cjs
- Size 4KB
- SHA256 a8d4d389a598d646b4c2169fd22ffc7e7ecb6577e8605d85f43c711f926082fb
- MD5 b169841aca0b3aaeeeb6db69912e6354
- SHA1 a16ffe2ee9b79f55a83a0ac97b768afece5f59bd
- SHA512 dda2e3290c8f54b95f6109ddd0d87faa728fba8f55d39ac56890a220580ee265878f4a07e486b49d1acc5a64da7ef8e204d255464811015a1ee11ac7f16c838c
- SSDEEP 96:JUiV655eFwTQSTbgO8JGHSMpG9wC+sQrjBAhwvSvn:JUiV65stSTEOrHSfqvSvn
- TLSH
  T1189114CA25571153C6F2E7E8DA42491AF74F677B3610C90179EE66A83FF202801A5FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  dist/assets/index-CNS4UrHu.js
- Size 1.2MB
- SHA256 8b63bedcb915c73f08910083d87944ae06e50cc1ccb37d88218a71d3091c0c25
- MD5 7a576e225f7404dab5ef2e3d990a4e4b
- SHA1 52723ac72f83135143ee8924ff044b46152670e2
- SHA512 c5f21cb7c8282e2e96c90ae252b356b1f0ede1eba8a77d3c47d1c1e615b5bef7e94cd8866a0223879145f47528fca243e97424193a55f3005b0b23a881ebeb0c
- SSDEEP 24576:7LGumSCAmhOZEMwbMaClWYkmkBLLdsnpNKMb7VINwv43XIukOEBdgCIhSjn:7kSCAmhOZEMwbMaClWJm+LWjKMb7VINm
- TLSH
  T198558CE5736574234B5791AB503A0102B3397497680D486CB92CE8EB39E1885B2FFFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  dist/docs/boss.pdf
- Size 62KB
- SHA256 6f6d041fe096258bd916d806bdb34016c769ed1f5d5b93be9df2a341a08d1091
- MD5 3df4f1c4da691adb494df0d7483d187d
- SHA1 0d0c0e3ef8c9b752f9f3c408931cca3431b8ce91
- SHA512 11cc52c485d8c7f24f1eac89cae9808a87cb20d6d2d86971ff7c6b4a59d81dcb43d354c774a6c19f8652a1942ac578c65e5af4d7f800b1d853d4bb9e7d6c78a0
- SSDEEP 1536:29nR8R3mJZASMzKWbhTurAbCLfrvU5vfUC5VEGxGciEd/R8o7nx:2nRs3MkzRlurA+LrU+a+ciiJx
- TLSH
  T13853E054DD0229DEC42EC2654B6F385EA66EBB12A1C890E37CBCAB137351F58C41B717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral9
- Target
  dist/docs/bulk_roster_import_template.xlsx
- Size 5KB
- SHA256 a044c8c8ec4073e4424a58138714062dbeed47313997206acce7431852e7a1c5
- MD5 25c14471545b60aa0da4f90d51f444ad
- SHA1 93f969e4fc5e65dff1177527e2c1f8eb0cfd1f6c
- SHA512 2f49158da9606284b356f1de72d235287ed59c32be5668b0a9b581ebbac5b71e4309d353d91937075119579616eea43e40588813a00aefef9a3bb0f6a10bd88c
- SSDEEP 96:C5qwgGtEUj3iA08i6c0lKRjhm9kZyNGqrTiaSercoBepaW73j1SeG1naj6mEatrM:nwREUTiA08i6cUKJhnUz/JBcpa4xO1nv
- TLSH
  T121C12B32A2D5A931CD861237A05F1F15195CBCC253AFFA5AF050746A20B6CC45F5F397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dist/docs/cpr_explain.pdf
- Size 105KB
- SHA256 3217f5aba23fbef771cac9a3006cb65543055237c80454163f9034cbb57df784
- MD5 6af5c2c824d1a05acd735f35b78753b3
- SHA1 22c62eb10b17209057c1c9eb53eca4ac6d7ebb16
- SHA512 767aa70e5addd5057718f88efc84989281ec394affe8be1d7745d4b38c812a13f5f79f83a44b589fa527da18ec21f77e2df2bb73df20366d41497cf25276512e
- SSDEEP 1536:ZtEUuR9m+vsx9UH5NpySzJHt8ZGYYH1fA1pDkjJpUBe8OC2NRTvR5jqqkrR6gDy4:ITkb/XoA1pD+pUBHmhPjdk7xH
- TLSH
  T1E1B39C20989E6CEEC31697D16B1F7C5EB62CB262F1C912513A2DC3460760A7FE91721B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11
- Target
  dist/glb-availability-banner.js
- Size 3KB
- SHA256 d779675222e23e1ffb41e6984ae688f0accaf1b5de2a3b09707757c79a115d00
- MD5 c561d0cec54ffc058d073aeda9fa9728
- SHA1 4ebfc3c5161398486e95a5cb0bf2120f16e38c58
- SHA512 082fd51ba31b1fc0a24714cf2debf735d66cebc91a769bd2f2ca26b26de3dc86efbcd6b229e8f9edac99d7a6dae4fef802cde643a0c909bdb53ffeb275b4bae6
- TLSH
  T1EB71770E75B315374A63536F653B5A1072369207BA0DD61436DDC6092FDE939E2F3318
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  dist/index.html
- Size 641B
- SHA256 7a0b8f256b5b19c20b439dca80ff7a33d356df601d565a515eb50b73e402f7b7
- MD5 8b9e8538ec2fcfe29db866dd513745da
- SHA1 297b773eec85b45e3eecd861df7454d579fd5750
- SHA512 4af83501d86165078c458ce90bc1185be41acd4561952ef2bfc1f17ae4712c5493c0ecb687bab9c8b6646ec10fa3ef313037c7973c4369317ead337adccb559e
- TLSH
  T12AF0D8C68CF0CA57620006594DD1F01C6A87D24B120ADC0438EFA4BA1F84B928AAF878
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13
- Target
  dist/model-viewer.min.js
- Size 1.0MB
- SHA256 283b0672384614b4847636c306fc93fe4b1fcadc76d668b4e47f0ca76bcf033b
- MD5 5ddfff660827a15c61c93b98601b9539
- SHA1 1daf0ee7c71bd2d78673bd0a149abb0ab2eaf4d4
- SHA512 5ad7a603358b8f103b8e34c4c891b7c9ad0d0a245bbbccfdf9f000781bca137b9b50286a6139f2ecb70ff8e15d8c0f8a8bd8aa46e13402280604ae669550cfba
- SSDEEP 24576:2msjnNaRGuLxgetFxzWC5csIuOQhLUJdVsO2udsnpNNnWRxbDKJoIkKtzV+nYHwD:2msjnNzuLCetFxzWC5csIuOQhLUJdVsK
- TLSH
  T18C356DB5327120370B9295D754790142923A789B740BC1ECBA2CECDB28AA495F1FFFB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  docs/boss.pdf
- Size 62KB
- SHA256 6f6d041fe096258bd916d806bdb34016c769ed1f5d5b93be9df2a341a08d1091
- MD5 3df4f1c4da691adb494df0d7483d187d
- SHA1 0d0c0e3ef8c9b752f9f3c408931cca3431b8ce91
- SHA512 11cc52c485d8c7f24f1eac89cae9808a87cb20d6d2d86971ff7c6b4a59d81dcb43d354c774a6c19f8652a1942ac578c65e5af4d7f800b1d853d4bb9e7d6c78a0
- SSDEEP 1536:29nR8R3mJZASMzKWbhTurAbCLfrvU5vfUC5VEGxGciEd/R8o7nx:2nRs3MkzRlurA+LrU+a+ciiJx
- TLSH
  T13853E054DD0229DEC42EC2654B6F385EA66EBB12A1C890E37CBCAB137351F58C41B717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15
- Target
  docs/bulk_roster_import_template.xlsx
- Size 5KB
- SHA256 a044c8c8ec4073e4424a58138714062dbeed47313997206acce7431852e7a1c5
- MD5 25c14471545b60aa0da4f90d51f444ad
- SHA1 93f969e4fc5e65dff1177527e2c1f8eb0cfd1f6c
- SHA512 2f49158da9606284b356f1de72d235287ed59c32be5668b0a9b581ebbac5b71e4309d353d91937075119579616eea43e40588813a00aefef9a3bb0f6a10bd88c
- SSDEEP 96:C5qwgGtEUj3iA08i6c0lKRjhm9kZyNGqrTiaSercoBepaW73j1SeG1naj6mEatrM:nwREUTiA08i6cUKJhnUz/JBcpa4xO1nv
- TLSH
  T121C12B32A2D5A931CD861237A05F1F15195CBCC253AFFA5AF050746A20B6CC45F5F397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  docs/cpr_explain.pdf
- Size 105KB
- SHA256 3217f5aba23fbef771cac9a3006cb65543055237c80454163f9034cbb57df784
- MD5 6af5c2c824d1a05acd735f35b78753b3
- SHA1 22c62eb10b17209057c1c9eb53eca4ac6d7ebb16
- SHA512 767aa70e5addd5057718f88efc84989281ec394affe8be1d7745d4b38c812a13f5f79f83a44b589fa527da18ec21f77e2df2bb73df20366d41497cf25276512e
- SSDEEP 1536:ZtEUuR9m+vsx9UH5NpySzJHt8ZGYYH1fA1pDkjJpUBe8OC2NRTvR5jqqkrR6gDy4:ITkb/XoA1pD+pUBHmhPjdk7xH
- TLSH
  T1E1B39C20989E6CEEC31697D16B1F7C5EB62CB262F1C912513A2DC3460760A7FE91721B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17
- Target
  launcher.exe
- Size 35.9MB
- SHA256 aba3a5ca50005291595f22da51fbfc4e31fe01808b4238d603de03aa9a541fdb
- MD5 b01d719d03e51dadedf696112d497b30
- SHA1 9a9ab33a569a919e7675ba3cba88cd60196dfd81
- SHA512 219478a191643148ba899ddba89830343363a1490a6a96ab4e2ceaf15958c343f12703e18d18a54d23a3b0ed0b29072f5c97bae8619d4251b42a2314541fac1d
- SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfs:fMguj8Q4VfvBqFTrYj
- TLSH
  T181878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery execution
behavioral18
- Target
  src/WorldMap.jsx
- Size 121KB
- SHA256 eb8e70d5089ca963f13cb922a8bc6c14eeaed893ef5f62d5617129f363f6684f
- MD5 caf183ffa832fb14d7d6914756077c98
- SHA1 330cf0bec7e176d0ab3126e5d3421144f71dd2d8
- SHA512 dd437fa541afd587dc36b252759b7c091cfb90c334b66a7605d57a4dfe71f8a170edff63ecbaa500f5275797946916cb51dd751f2d959b279beb6adae9e6ad78
- SSDEEP 3072:S2wFcnRMjhijftVz+Yij9MY7hArYfbaD2n8AdEmu:S2waRMjhijftVz+YoMY7hArrD2n8AdEF
- TLSH
  T11FC3C651BCF238360553E0A6293B4602FE748157BA4DD894B7AC47882FCF05AD2BF59E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19