Extracted

• • Target
    install.bat
  • Size 994B
  • SHA256 498626d4650fd115b6924d33c639b7dd997a571d5b4ec69e0d58722986c50cf6
  • MD5 57b823758012ea60514e3242561c821d
  • SHA1 105593bb19f30196946ba5ebedd887d452a424e7
  • SHA512 3c301a59e9a8d7ff2a25e9fcb285ce2d91824989d97a7cbb42f7a773640901e23ca069d12b4fe0e2405227f326f211b4fd16cb559d7cdf0c739643ee339df639
  • TLSH
    T1F811ABA7B32AC35C2E99B5064DA16334F498225F23A00DC4F7EB8164DA04B50A7BE085
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2
• • Target
    install.ps1
  • Size 3KB
  • SHA256 a3d1afd6fefec582ac177af4602672f1e30e6c2a94ed567a5332d7bc52c3eaf5
  • MD5 e540e3281a162e94e263dca921e4696f
  • SHA1 7b86680931540306d8f37db95f5a1f0950daf729
  • SHA512 81eef335815c8fefddc15fd6fec66b425f6e507b47fd910445c688a453a61899f7fa323541c4d5a0eb7c6970057886fa06d60f1d6e85fb12f427e5132dc046d6
  • TLSH
    T11861776F80275238661A320C512877E8E857D43B85D54ED8F39DC814B7E273E07ABAE7
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral3behavioral4
• • Target
    nantara-vm.exe
  • Size 348KB
  • SHA256 e325de21c79da274756699d6ccb088536b0e43d7f5514bde907ceb3d536c238f
  • MD5 eb9ce48e143c8f04b42e362c45eb8eb3
  • SHA1 6bf8ef72316efadf4ea0efcb68e9f27b08c5631b
  • SHA512 2a7b245646103525c8db2cb3bf40ac3f3375cfe9e327c769d84dbe7103e1f2b8cc4d713e6431c31c97abf22548e4cdfc173451a50ec9910082e2515ef64d84ba
  • SSDEEP 6144:loIUWwDh+yqhNkKBVyGXcvY3F0rAS66cmBEDEaYxdG:xUD+yqhN3RvvAaU
  • TLSH
    T171745B22FB1564EDC06BC03883569A72B93234DE0B356AFB159482393F65EF5AE3C714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discoveryexecution
  behavioral5behavioral6
• • Target
    run-nantara-vm.bat
  • Size 616B
  • SHA256 aaa320947abcd750ec32f6015a1f856606a6df4a64054f82c8fb4357eda20abc
  • MD5 7a971e85a6361b80752322e19fa9b69a
  • SHA1 70db486c481b9f6570a85aa343ea89fe7b93f685
  • SHA512 d1de1dafd60fd31e79d64c6d38f8c1dfe3ebed12a04377a3ed1697970b843e5bcf330f0b0bfbb4ea3064ac4137b82f242e97025cf35cb5cf1b0819ab59845b9d
  • TLSH
    T1D9F0ABA2F01EC521A5E977814E184A61F008800F02906ECAB1379070A15DBC56FECAE0
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  discoveryexecution
  behavioral7behavioral8