mirai | 5826c717dbc010c383b3c1e37c07f9c8f093f1278bfd1ce182a86e398162024f

General

Target
GameSetup.7z
Size 92.3MB
Sample260803-pr6gdahe39
SHA256 5826c717dbc010c383b3c1e37c07f9c8f093f1278bfd1ce182a86e398162024f
MD5 39ac1ede6c01437639b31afd007b9a33
SHA1 a91d6be0d67e562fb4949bcb60a577b1dd34fa17
SHA512 6c5e6088a6107d7c8ee863106d314369656edeafb25edb08e224754929dcf9b55ab49024ca8c09c877bc266c952f83c188aceec01c5bd11fdfe7ec2d1e74888f
SSDEEP 1572864:d4ee5EknSKZ/uZuBVjYmDJlJ6tK6wayxrByhJ92FJkr826ebC6BMBS2qJ7xG:belnSKKGXJ6gP5A8FAX6ebCds21
TLSH
T18F2833121EDFD293CE350DFD43FBCD9F042629A296D4A44BB408B6AA19C4D8D5C47BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  GameSetup.exe
- Size 92.5MB
- SHA256 ee002a9fb98bf83e72045ced743aa63c31f1ae7c578fd9355e7b155496e2ede4
- MD5 3ef7f88cba16df65b600c990c90caafa
- SHA1 1820baad97557ac90c64722a2b9997087b0387aa
- SHA512 e3fe6fa4cce2a846d17f3b734dfacefa37f9c856a7aedefbe14620bb216575546053f039decb1f88f5dfcb230eb3b7f16461f5ae46f490d7184520d7cb1cc8f4
- SSDEEP 1572864:mh/5wbM7r/Rcs4H0pnr0AUobTxKl+I0N1czPgMIOFLifSa1/T1mZqvpIFbazI:mvw4r/2LC/TxiZ9jdFsl1/T1dBIN
- TLSH
  T1472833512FDA8D72FC7D88F893A6D9AE043BFDB181C4A44AA80C756A14749C90CF677C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  GameSetup.exe
- Size 178.0MB
- SHA256 a5a624fffdd4f22d62fa00da3e3033220998bc4b4880708d274b90a95bd86ca2
- MD5 e10855f604fa34ba40805c411a4cc30d
- SHA1 a669b078606d09f9aa897cf691cc82977e9e46fb
- SHA512 bb9c493b1f1af8386efb5b6b1ed04384518c44bbc313cd259c4be5e3c308f5b20cb606c56bfd3086539edfb08862200c86444038f3c4627f1fe17c5f292e0a28
- SSDEEP 1572864:w7N/dTr80yRuIK4Sqfg6ll8HiptFi98D1fX0rxuK/xjMFbZPGoB30iSs0hfEv4S4:ESm7UkF9um
- TLSH
  T14B988C03F39610E9E05DD1B18B9B9633EA72B8454724B2DF2A6407562F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2