dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b

Sharing

Copy URL Twitter E-mail

General

Target
Application.zip
Size 904KB
Sample260805-pffftafl9x
SHA256 dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b
MD5 630f428bf3c25dfca46e91edde334342
SHA1 f6a648b2c8b097248f7d25af322b91607fc8fae2
SHA512 03a4e9748f66d10de4aaf698c62d313f0d498bfce2ddb4701487631b4c15a24b4a00d02508246d0f97a9acd8fd7afd804d074cbfae085e4e68d7333e8f035938
SSDEEP 12288:XBE/nJIRs2wv8s7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S4:XGRADwkc/u/7IoRnUKfq1Dl4DYt
TLSH
T1E215AFC0F5C241F2E6E611718476DE36463E3D2187028CEB7798BAF55E305D0A637AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  Launcher.bat
- Size 2KB
- SHA256 89a1cffdb1f1facdc871ee710cbb92a063d30afcafb36334214ab08f5c38f80a
- MD5 92180d52ef35edd36a28f52052f90c5c
- SHA1 6551936cdac2e0488408813bb7bb526e9ffb26e2
- SHA512 a9a8b825881609661620a33513e358bb55186cdb49a2c6b1aa3cb82992c285e4eacea38ba1b362f37afc0df2a4353aa3f7f8bef588b879446329f36c14b299ee
- MD5 SHA1 SHA512
Score

6^/10

discovery execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  config.txt
- Size 220KB
- SHA256 d92b9e01e24935e1cc6144734c0b39379edef1e3c06aedbd547dc304e7334d77
- MD5 96c673c9e9dedefec5fd5e27284e4f29
- SHA1 1b5865f8998749a1fd61f62e6357d19dedcc9a2c
- SHA512 4ac805e8528f1003911960ce317150d186022a30dc31c479a54e1f6adbbf9cbce882da4b46f8cf0991c9e07fb4239f970d07c1538e4d16c79b560b5b272e5b83
- SSDEEP 3072:ubmjIIxdmqlnRf1/QyZs2WWwjojiS06SK9J8Iq8jltsBo0FXnihq/+43j:uBCdFllFLsSok9Jg4lutNb+4T
- TLSH
  T104245CE0F9D407C266FE9A42C5B2CD1AC31A366292435CEE242CF9F17A419C59729F73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lua.exe
- Size 89KB
- SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
- MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
- SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
- SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
- SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
- TLSH
  T1FC935C00F5D2D071D5B3593558B5DAB04A2EF9311F259FAB339813AA4F301C19E3AEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  lua51.dll
- Size 592KB
- SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
- MD5 3dff7448b43fcfb4dc65e0040b0ffb88
- SHA1 583cdab08519d99f49234965ffd07688ccf52c56
- SHA512 cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
- SSDEEP 12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
- TLSH
  T162D4BF41B6C3C0F2E5E21171047AAB760E3E2D114716CCEB97E439AD8D346E0B6776EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8