ac11b79a440549f4a4c4db847fd05780215a389310deaa22c2c145f487ab07f2

General

Target
TrackOrd_TokenGrabber-Reborn_1.zip
Size 40.8MB
Sample260805-t57nta1eka
SHA256 ac11b79a440549f4a4c4db847fd05780215a389310deaa22c2c145f487ab07f2
MD5 7867271b83fde4eb8c8d7b00db0d5965
SHA1 8b4c05170d94e91d3c63de3efd06b97247eb59f4
SHA512 e251a341bfb6ea140077ec2082d0fa4092e4d0997d206e241a45fe76c5df745b0a52a749132756994b98c8066fe56f17f748bce6d446d03420fcd401b1d2668f
SSDEEP 786432:krCMPt1+YU8JcEjKy5zsxML9yUoE9C2D6FhfwzvCyohcIzZ2VCar9xx2bxRe:eCYQ8ieK+sKNQhfwzvCyohLMjfkNRe
TLSH
T1A197333704DDDA6A889EFC34B1B19591FD6AD2E02E67C8A7F09E53B13C031D989F0212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TrackOrd_TokenGrabber-Reborn/INSTALLER.bat
- Size 327B
- SHA256 8d7ac081b1e1fac0714e6c9236ae90d9cd118664f66f501e4922b14548a1e15a
- MD5 02f4545ffb34c56ec516c25863f61190
- SHA1 200cac5759cfcd7c05dc364caa53152b67b4c76a
- SHA512 5f1d31638cb75cf5acae86719bc33033c8a452d7fc7cd41d17203c9dc7eeade4549f7e90128a8ac90032f603f618e22a7557708bca4daa172ce92021c12ac123
- TLSH
  T1FFE0263A3922A42C99E0CFE24AB713A23E90A04353214D92218B90B8854B5A3339B96D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1
- Target
  TrackOrd_TokenGrabber-Reborn/PYTHONSETUP.exe
- Size 24.0MB
- SHA256 b5884fa3f05f88bbb617d08584930770c00bbcf675f2865a9161c2358829b605
- MD5 4fe11b2b0bb0c744cf74aff537f7cd7f
- SHA1 b4f5627009f897d3ce9664242e7f7968b55759f1
- SHA512 80f535f7bc5a3d0a7d645c432ec8fdc86474e129d318c474bec043b568d969e989f2d1d3cde955d4316405e2dcce74aa07adc4734756cb833495910f443c3a13
- SSDEEP 393216:eDU6aubdmT1K7iJC6b+dm9kgTWrB3ldBVO9dJiNQbaWd6LwnCtYr6ICEy6uafw:eDUCY1I6KI9kgTiPdjWaypdwxc9Nyyfw
- TLSH
  T19B47333350989036E6E52972B564D170BE2CEA142B2589EAF2C8FF363D714D56BF3312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral2
- Target
  TrackOrd_TokenGrabber-Reborn/TrackOrd_TokenGrabber-Reborn.exe
- Size 17.3MB
- SHA256 7e25c20c311ca1c0d30ca334e971d0e31563593f7b4db5128a837ea72d0e6e7d
- MD5 6f285a7f9301f8a3e1b649bdb64e34bd
- SHA1 e0fb5a5148ef07b10777b51b6d923d519aea0b47
- SHA512 6717a95996c34bc5d6a4c6ef744da47952453506268f73e1d402d6a20a7e2b8961197dc21271502b73feecf5eda88f46f92f3ac00971e71c5749d310ea518915
- SSDEEP 393216:QOKPvzSvoWpYFxVHFFjXMCHWUjscuIM/PA2w4x/3XvspGEYdEDV83:ZKPvzvGYFrHFFjXMb858/xxX0tDK3
- TLSH
  T1DD07331DA3E041DBE9F25838B6F7C692DA7AF8B20772C6CFCB6462512E130D0493D956
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3