4ddd3b9b123a630d7519c647ad9b2a6b0c3b69eb33b0e01296f099de803c9325

General

Target
github_io_xfoxusx_v1.7.zip
Size 533KB
Sample260804-g2kzeshk2t
SHA256 4ddd3b9b123a630d7519c647ad9b2a6b0c3b69eb33b0e01296f099de803c9325
MD5 4922a629c25e89e28d9b274a84fbc63a
SHA1 183fc1ebde97057a329f5d704f9945e721cf5591
SHA512 29c74f5db07d185c6f1411c02dea09c61313158a696d5b434c82c4f6c9ab943df3e1c3580c5450169851355909a81a411ce112092cfe6c919f8f5420c6988f3c
SSDEEP 12288:geCEht+9qO3g/ALyYG0ZaDajTCXMO8xzDOeQake:ntgA/f0Za6TCXKBxlZ
TLSH
T111C42367226F72500DFE92ED4E4156186D3D8E322A00A6FE55D8C9CE8719F0ECE35E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Launch.bat
- Size 25B
- SHA256 b54ea465f77f1eb726d3244aa52d13c103ad9c4fc5a15061b7067347896b433c
- MD5 7f8763a16a923fc1a188fd04dacbfaaf
- SHA1 0aec3fdd44982b06ac84c51a74ad353156909e33
- SHA512 e84da911832044ab8a46d4fc3e72d7c3ed91ff3d904aba64abbf63b51c1f2e4d3e4c7bb73d93218d1a24b1a600119a6600136eab5ed4f2b230773236abf5563e
- MD5 SHA1 SHA512
Score

7^/10

discovery execution persistence
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  license.txt
- Size 301KB
- SHA256 357cd0a1601d24bbb7949637b352b0ace1f30f51f788a03cafa98316068938e0
- MD5 1770fcdf879803a04811686ef260c7cc
- SHA1 47cf529da3eabf5298ce8a22647470391ab0870a
- SHA512 e13a19c73784083d59ef2a0a68d8b11551761000f5cd5633379c00fa37efda12a9b756d122e5a81d5e739e1faf59f52f6fcf54529542281d7b2be571ad1e1d23
- SSDEEP 3072:BVk0ZXKS3rMorXHuyWXsOO2nYwcF1jUXvtGnuJHmKM6VTK9XxYXLG3KOMh3ClfwZ:BV7z3pjOVX3OZTEQBQTK9x/3iSptzwVn
- TLSH
  T1196406D0618404DADAABC680EC325A9A33B72DF1470F1A8B1F5CF5E4B78119DD7ED826
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  unc.exe
- Size 753KB
- SHA256 30694a0101abfeea642cb9de7fb7eb66789eea74d8d7257b39822d7dab59445d
- MD5 c1317f7281ff9d56daeb7fae01acbdbf
- SHA1 3ede36c1d7afdbdba58f2e7a69e679ea85d1bec2
- SHA512 8e80b5a77112e85fc778f4ccdc7a2097a0b4905c0ba149b0475d9049a8cb150603f50acbf8150c3579c301c7a3c5470cb5dd9ae8c4eb9a3453ce2abccd8b700f
- SSDEEP 12288:0Ixb6mgscIPv+xPBPx3ph7WfsnE6VTdUZ9nUt2ZvIX/19X7BroLkLwqG:llRcIOXrh7dEiTWZC8gXTFD
- TLSH
  T141F49F19FBB101FAD5B78135CD16A90BEBB2BC050624566F43E06AAB6F377210E1F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6