87752c1dba834e1563a4a84b6a39a8399894874a64e63ed987e838e224831571

Sharing

Copy URL Twitter E-mail

General

Target
Indian Horn by Sachin Hegde 4.scs
Size 368KB
Sample260804-mpq8kaxhph
SHA256 87752c1dba834e1563a4a84b6a39a8399894874a64e63ed987e838e224831571
MD5 48feb0bab5fac3ff2ca293cbda64a780
SHA1 aa2b770987b378f726c365972cdf379b5b1bc582
SHA512 74fcab31fb533d042c530ebe759f91aba4b451c6319a1fcdf0202688371f25f9c717f73fed5f12efffb4c8ab618cef67ae6346ca394f3f4e0dd3e7e5781eb104
SSDEEP 6144:IffCYOs549Dr9Gy2w3MxRNZbJXy65R8rDr9Gy2w3MxRNZbJXy65R8ZfCYOs54kF:QCYpQN8RRNZNHyN8RRNZNH0CYpR
TLSH
T19B84029EC34D555ED34ADEF9C04A2FE1ADE4C804971C11828429D015898EFBF8F7A77A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  def/vehicle/truck/dbmx.volvo.grand4x2/engine/d13c.sii
- Size 2B
- SHA256 dc2d87f2fa2dbd94ce6d35e39be1bc47a85567634b0b27e6133940caf74b035c
- MD5 3d5f42d53f9016d1b1b3120f6fe72602
- SHA1 c2b272f1bac4414dab87fe33f97585ce098177a2
- SHA512 7a416a24fe0fd0dafd238575a4572985b4df210b5573ef58d4c62dd7f89f1dfa9f125d639d15c97ca92d8af581fe1d6bc793f950d691f07d8d87707684d4e700
- MD5 SHA1 SHA512
Score

8^/10

execution defense_evasion discovery spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2 behavioral3
- Target
  def/vehicle/truck/dbmx.volvo.grand4x2/sound/exterior.sii
- Size 1B
- SHA256 22adaf058a2cb668b15cb4c1f30e7cc720bbe38c146544169db35fbf630389c4
- MD5 3beb9cf0eab8cbf2215990b4a6bdc271
- SHA1 241cbd6dfb6e53c43c73b62f9384359091dcbf56
- SHA512 e5f7f597c756ff6f6efc09eb14ed7bea3b63be7efa5798c45f4978f0471ee8899a3025adbf91fe71608e7cc3e80e5e3a45793eba1dd1cc90e74b20f2ac3c187c
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4 behavioral5 behavioral6
- Target
  def/vehicle/truck/dbmx.volvo.grand4x2/transmission/H-Shifter(6).sii
- Size 4B
- SHA256 0747a966e01f6498b4692e2a055a79e8f2599f7e72f59a208f209bd51f3435ff
- MD5 a13b05c634a80acb555cb8c447364ece
- SHA1 17adae9d24b5dcfcb81273776f85c817e1fd4da2
- SHA512 e251038b7bd5dd3a76dfdab40d4f43ad4a0af670302468af190ce0b98f0ac90cc7d0b7f5bbdf8d4886b61aad3b498b06bf68ce0fb105e2c4b0249b3210b80949
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral7 behavioral8 behavioral9