87a8574288014c615648b2ad238d9d75a632bd90adbe94edb45b8c28e21b7f5d

General

Target
Essential_0.0.4_x64-setup.exe
Size 11.8MB
Sample260806-pd4evshf23
SHA256 87a8574288014c615648b2ad238d9d75a632bd90adbe94edb45b8c28e21b7f5d
MD5 031790b667865c3627227b4900ff5081
SHA1 e258f57f3caf9c028159bda2cfc67ac69424e126
SHA512 ba954e6999e7ad685f1bc8dd2b98bf2c9ff34025f9197b54cef8af88e7369ad9effae9d69dea19a03bf56a4324686c3c99e355054acb30b1d8a8bbf47cb28ace
SSDEEP 196608:95oZBQABLohOBQsQZ2MdxHRwZCbep0rPPV/uQiL+Ve2cEmH6kvolfdbYs30xxWds:95oXQuKe1yJ3rPd/uQiL+VpvoKVE00TH
TLSH
T1D8C633FA214D6D7EDB419E70C23605E6EA0D8D92B8F10A894EB57D628304A83D5C7DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Essential_0.0.4_x64-setup.exe
- Size 11.8MB
- SHA256 87a8574288014c615648b2ad238d9d75a632bd90adbe94edb45b8c28e21b7f5d
- MD5 031790b667865c3627227b4900ff5081
- SHA1 e258f57f3caf9c028159bda2cfc67ac69424e126
- SHA512 ba954e6999e7ad685f1bc8dd2b98bf2c9ff34025f9197b54cef8af88e7369ad9effae9d69dea19a03bf56a4324686c3c99e355054acb30b1d8a8bbf47cb28ace
- SSDEEP 196608:95oZBQABLohOBQsQZ2MdxHRwZCbep0rPPV/uQiL+Ve2cEmH6kvolfdbYs30xxWds:95oXQuKe1yJ3rPd/uQiL+VpvoKVE00TH
- TLSH
  T1D8C633FA214D6D7EDB419E70C23605E6EA0D8D92B8F10A894EB57D628304A83D5C7DF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  Essential.exe
- Size 23.8MB
- SHA256 37032a994b082431bf8fe0c165a2ecfb9c0e194242b8a3618c358cda0cf5d729
- MD5 196609e9c5739fe63be4471f8a4f3ffd
- SHA1 dc5fb521f830b9eda30c20bf3509388773fdc8bd
- SHA512 c45499b292c52de74156a31816293b9ef6dc183be138bc72db7116bf44943cc2afa4fb0f11ed0ce3f875fdae1a6190dd4a0ede2b263599aefc2f3fc5325b73a1
- SSDEEP 393216:XjcNN8OTdOSUbu3ZFzeO9BUNfnAvqUnfjbGJs9uKLH:XjcNN8OTdOSUbu3ZFzeO9lvbnbR
- TLSH
  T141476B207A5A996CD09BC47483478A721A7130EB1B35BAFF44D496382F7DBF46F38219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2