81e45c1e6d6a718624159e116e6daa8c1547f39bef7f56163303e7eca8abfae1

Sharing

Copy URL Twitter E-mail

General

Target
sausage fattener windows.exe
Size 3.9MB
Sample260805-qfd4essxcx
SHA256 81e45c1e6d6a718624159e116e6daa8c1547f39bef7f56163303e7eca8abfae1
MD5 81e69b29c4c09391a12b665e7661f48e
SHA1 b103b694d12544c9db444badd9e2263d219698b1
SHA512 5476b9fa6967aefcb73793c965224c93d2ab46268830fcb71c69bc864e22e0cb92512959fe7a728ee77c2bde00e3ce9eda64d015ff1ef34273292707680c0042
SSDEEP 98304:QhVVJqioKMFh1qKsbZcMgsGwNmlCNE4CJgcMyfQP/4:QhV1pMzHQCMFGImHgcM54
TLSH
T17F16331B17C16C87F9675136933EEA7EF3B4F842AE86674B27728DE826DF90101401DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Targets

- Target
  sausage fattener windows.exe
- Size 3.9MB
- SHA256 81e45c1e6d6a718624159e116e6daa8c1547f39bef7f56163303e7eca8abfae1
- MD5 81e69b29c4c09391a12b665e7661f48e
- SHA1 b103b694d12544c9db444badd9e2263d219698b1
- SHA512 5476b9fa6967aefcb73793c965224c93d2ab46268830fcb71c69bc864e22e0cb92512959fe7a728ee77c2bde00e3ce9eda64d015ff1ef34273292707680c0042
- SSDEEP 98304:QhVVJqioKMFh1qKsbZcMgsGwNmlCNE4CJgcMyfQP/4:QhV1pMzHQCMFGImHgcM54
- TLSH
  T17F16331B17C16C87F9675136933EEA7EF3B4F842AE86674B27728DE826DF90101401DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/AdvSplash.dll
- Size 6KB
- SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
- MD5 13cc92f90a299f5b2b2f795d0d2e47dc
- SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
- SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
- SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
- TLSH
  T137C1B837B7C216F7C35600F12916375387E9943263A1946909B3EBCAA6A185BDD34703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/Bass.dll
- Size 101KB
- SHA256 14a38f56be50a3829eb1eda2a908da2de5913f81d5cb01d8b668593d0fc36594
- MD5 a8af308ff01b4477657955fbf0cc8408
- SHA1 0794c059f0326e4a71be8a3ee4ac17a657d90d88
- SHA512 9e221967db95d4b86bf311891193dfd1515806aa0d43198d3bc26a17d77f06f212ab9dba1ca8575f50d224380e8b109529faccf2f56daac834da83a83677a0fd
- SSDEEP 3072:kR+vccy3LIweO1vFCLPkG9dfSD0BXZXmpw69Qe:S+vccy3hF1vFCT99dTBX5mupe
- TLSH
  T16DA30299DA7441C3E4EBF839646E036042CA6B0F421DEFF85ED8D2E022D45D522A5FCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/GetVersion.dll
- Size 8KB
- SHA256 16dd6da98b7e53d374830cd4c644c01b112955f8487a285f34dc0353e9cfac15
- MD5 e013b625f5ae1e2f0b442cf39c0069df
- SHA1 9ec785b63279144c091366badda65278c4cdee20
- SHA512 306f7e674d119d129db48012c43f825bffabd078fac8518aea9d514b0787752a2e876bda2ad15df7332bfc8cfba38a0d1be17ee7c58a27e09678fce9aec58418
- SSDEEP 192:9r/9XGqK7s/AlHdJZBi46AQ5VuNxHA8/1:HXGqM93Bi46AQ5Vujg8/1
- TLSH
  T14A02B6F207E403D4F22B4B7C906A43037B6CA92499F196290F61A5D73CFA545DB3B762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll
- Size 5.8MB
- SHA256 8b25cf3f7aa82fadccb2ce615ce0e40c5a8a3ea7bc51180a92173ee113a0ccfe
- MD5 028251654a4d65509aa8ccb5f2ee284a
- SHA1 4a4ad468a86df6b903002be4f8919017fea0c152
- SHA512 f252670bca0da9e8e2c519a6ef4ad6dd0c4e548aeb7566693a7d203e73e63345fc58683072020ef771d836429bed1d7b4fdf105aa3e62a969e9c8d39556e1d2d
- SSDEEP 98304:kj0Kg9frmFcqlMZ4vpHfOVlQnzW4Aogn/oXFdAaTZ8GcB7d0s:kjFA7t2RHfYlQZJgTamGcBis
- TLSH
  T1E7569E01B2D5D8F6C26322706E2DB726A3FDAE3447345A837BC47E1D5A31982563B31B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/bass.dll
- Size 101KB
- SHA256 14a38f56be50a3829eb1eda2a908da2de5913f81d5cb01d8b668593d0fc36594
- MD5 a8af308ff01b4477657955fbf0cc8408
- SHA1 0794c059f0326e4a71be8a3ee4ac17a657d90d88
- SHA512 9e221967db95d4b86bf311891193dfd1515806aa0d43198d3bc26a17d77f06f212ab9dba1ca8575f50d224380e8b109529faccf2f56daac834da83a83677a0fd
- SSDEEP 3072:kR+vccy3LIweO1vFCLPkG9dfSD0BXZXmpw69Qe:S+vccy3hF1vFCT99dTBX5mupe
- TLSH
  T16DA30299DA7441C3E4EBF839646E036042CA6B0F421DEFF85ED8D2E022D45D522A5FCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Resource/Sausage Fattener 32.dat
- Size 845KB
- SHA256 662c308546fc42506073e1f12d38252f7cdaad888e13ee4cf109d062ac609955
- MD5 69d6f94235a27ef0e06544e9ce0d632e
- SHA1 ea92ea58a7db386092a868eea87949fc5d8fa626
- SHA512 39432cea09d8a9921176f14aaae140ce6638c8321f5fe3808616152dc84473bcbfd0215150632d6cfc32f78c7419576a20d5e00f19507018f7de88761e577ea3
- SSDEEP 12288:8E980FzsrMFYul42/YkXE7bZ0TaOI7Yme6lvWHSRukPOGx4FCN225w/l4n:54MJ9TYYmZoSwGYCxC/l
- TLSH
  T1F3056BB239588D31CD98117B44FAAB6960BE5D158B65E4D3AFE4BA3F0C741F0BE31902
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Resource/Sausage Fattener 64.dat
- Size 745KB
- SHA256 59b707eefe8286a9468d8ddb4cab4fc5ad4090ef21d68f4c57a3da2c9a5df58d
- MD5 54796ccdb2d6031b2e0d1259e534caac
- SHA1 5c46b4ee988900a2da2a0a60314ac45ac265c9ef
- SHA512 d3fc2c18f431bb7a7aa08ebc70026409363700bc509c22e53d12e14e480fb9096cb0e583cead0e882ebeb21c1b29e7655d86bad65a041b27c377404fe41c186a
- SSDEEP 6144:B12aJOgYCwbtc6bZ7e7c30XnmT/0Vn3wTpyw4156CM5uG7t6q5bAy2WGvy+Vv1nC:5kgob6QZJ0Xnq/3N5uG7eyDcFbA8oKo
- TLSH
  T147F44B75945949D6C83380B6C8A3C641EBF6BC644B346BD702E4063E6E7FBF88676720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Sausage Fattener x64.dll
- Size 92KB
- SHA256 7ef161e760e967040516a79d961bd137fb12a54753dad80d16caf26fc2421994
- MD5 8d7608fa89581b1fb6f35c48a6f110ec
- SHA1 9741b557de8207c934b81e00983eeba1f71e1f7b
- SHA512 e962f63c38bb37b65d0adbfd5020243f2bed6cffebb40c61c8ebaa43d8ae1e58e7f8d51a77c28c56046a4c7f03c65440e30f59ac6f8ae05141254228b2fc33e4
- SSDEEP 1536:a7wHSj5Heqr6T2b2XrVx4GHNsCqhmMQfVuzoC2BXTt3xHH5ZuMBuNpHoUqNJ4X:aO4kq2T2q7H4uNXqhmMQfLjxn5FAoxLm
- TLSH
  T17F936C46329004F6E4734234C8E36E55E773F856427983BF07A486AE9F673909E2B732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Sausage Fattener.dll
- Size 95KB
- SHA256 42349ce1da21c41e2f72641a76d64fca1a7c7f6c405a50d331c581d2fbf10f76
- MD5 52e95d9e2e0cfc550ce4e40f1d686480
- SHA1 59984bb6becc0f6084851b623f0f2c4bbc901fe1
- SHA512 95b59db3be017ba7486dc774d80af1bc55e50dfcb86b918f266d4db77fc88061b84ba77fd1682a2af81e49608b23ffa4153763a264c85078b32d399b6ebffd03
- SSDEEP 1536:YVoTTf6N2C80UWDOS1Vjw2+OSqbUSovFFvJnystkH+vtmgMbFu6kN:NTxtlB0GNBo4Ag0Fu6kN
- TLSH
  T130A38E1172F3C9B3C0BA153448689BA25A79382256F444BB7FF91B7E5FE03D04A76362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  uninstall.exe
- Size 38KB
- SHA256 09511049b3b5d519bd9ad7fffe29fbae5bde288364e69cff6490a64d6e4f601e
- MD5 4d80cf1dcb4050035ababe91073376ed
- SHA1 66479ddbc4426fb45a526d7a6fb1df1ad09eedde
- SHA512 972bddb89968cb422c6e35aad471b3ca262a40169ff624a207d5a4053efd211251fa04f6381a34230163d0a22239897e751b24dbfa8390444ffe77b7d3c261cb
- SSDEEP 768:c4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJ3Tc8F1:PLXB65939tY6HBg4sXJ3TJ
- TLSH
  T152039E6A72C1D4BBDA52053005F7F73AD3BBF3E91352156B67242F7D29611C38A2A2C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Drops file in System32 directory

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13