acfe1d2529bce1efa8197be60e6a9f707e33492f94cc057d9084c5444a79b7e2

Sharing

Copy URL Twitter E-mail

General

Target
Promolink_BALCAO.zip
Size 11.2MB
Sample260805-ftvyzsdh55
SHA256 acfe1d2529bce1efa8197be60e6a9f707e33492f94cc057d9084c5444a79b7e2
MD5 ce584fdda93306bafdd8dc4d46db25c5
SHA1 cde63faf276743f4ab6063e7b9eeaed1ab68f075
SHA512 9e3c8df8fe27bc937088bcf7bf0f75166c13f07d5911f8ed967c84c596c13992f460531b24ac5ef177ca2931a6345c1a04819e69bf04c28bf10a93d05d662e71
SSDEEP 196608:dyUxdvEGXe01ByJxE9e9CjrLn2gJOVLyNmXvXWb7veoazPfjQKAnYMZc9apj1v:dyOvnOfjb6rLn2XVuNm/s7La7jQKAbki
TLSH
T1B6C633E3DC5669AED095A28B1A38A307F2E70F021F92D4EE1C450F1E36E77754D6E224
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DESINSTALAR.bat
- Size 1009B
- SHA256 6424990e93d25ce329ee49129c75f28be9519b4b2c162277064f11f3630fc1f7
- MD5 5a435942a24393576222f1ad1ae5578e
- SHA1 e42afb23c436835ce7458f39989cd6c9050a4336
- SHA512 07922a58464931f1d552d23a67bc5cd2635de589df2bbf940d28b68d46fed052e158a7e122b706b44fd7fbe5d627b7843174b6664d9eb13206a8f3e74a469032
- TLSH
  T11B1100037E7D9C359698AAC199EF0242F79DA18BC0122DC0C0D384B55495BC6FB1FD99
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution persistence
behavioral1 behavioral2
- Target
  INSTALAR.bat
- Size 2KB
- SHA256 2baa954a85e554b73429e7ce55e3d1610dbfa03c425f137abaafd733b70be7ae
- MD5 c2bd1d3c2c7efcbc5c7bfa6578420f2e
- SHA1 da498a75b3253e2f5f220b589e4d588cf07e55bd
- SHA512 cbd914aa859353c4bd9d76b59aa62c5c263a943da17ebf297ebf35c76c4dda52d8c9efebe2d8d01016a3e72d11c0ed98b265677354e7a4d74de38e94c6d35427
- TLSH
  T178412F037AA4883191A896C0AD5B8702F75D939BD0129CC0D18BCA3915CE7DAFA7F465
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution persistence
- Loads dropped DLL
behavioral3 behavioral4
- Target
  Promolink.exe
- Size 11.4MB
- SHA256 b6fa0a791f06f7e7e2d9c46b24d70d07ecc8fa44b140c3227784b6325b3af3d2
- MD5 cacc37bb78b4f5fa98ab2a9b56d1f0c6
- SHA1 9e4c612c80914a51bc489e39cafafaab68798dd7
- SHA512 5d0c56bad269625afce483daf0d509f2edebec2164e031f8d6b06900ae0ebf17a394573b282e9d49661d8d35d33d199b52ea5b100f531341d2f7fd492da87e1f
- SSDEEP 196608:YtzVAECIFxuBwB9drbdXQaN+MofR4Rmhdo57sM/frHswqwpC60sFkE7zd:mVFbFx/hrbdXQfM6R4RmhG7f7Hswqwjb
- TLSH
  T1B3C633C5BB9509ADE466223D59D48B1BD2E27C220BA5C9CF17F40E192E332E5ED3C721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5 behavioral6
- Target
  Ver exemplo PromoLink.bat
- Size 54B
- SHA256 c06d4dcfd4e9ca6ad6ab4545f375f48e311ede069a5251f53e3585434c6a8d7f
- MD5 2a2edf34f7712ba95935a3095cbf32e6
- SHA1 649ffb13f41ec815fc4706e1c3fe970ae41b0c9c
- SHA512 b580c4a961dac8f9cbded403f0565e9fc1d1a5731f746866e18e314de9c0ca2af8010a889fa9fa30e84fcd5dcd52c3fb6bedebb42e60938c813bc02fa8253ee3
- TLSH
  T1519002414C1900E495194C10505B3984FD1D7147D5005D045083542E588F4497994091
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Loads dropped DLL
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8