9d5abb1af19bbb2121bfff4ffd3617cf14e4bc48520223bb8bb98374a90d17fa

Sharing

Copy URL Twitter E-mail

General

Target
9d5abb1af19bbb2121bfff4ffd3617cf14e4bc48520223bb8bb98374a90d17fa
Size 1.3MB
Sample260807-rydfaaxelb
SHA256 9d5abb1af19bbb2121bfff4ffd3617cf14e4bc48520223bb8bb98374a90d17fa
MD5 162732c00485fbff7039a200eccb9e57
SHA1 e8ba164ff83de96f7fce1a4da13689243b8e9e06
SHA512 ee3e045fa3d3e4479ef350414f27466459a3a46a227ee3955da0857843ef628a3e8279cc04bf6568556aae24aadef283152993a24e85ded2c9420e40fbcca33e
SSDEEP 24576:rcjh9+TiOV9A7D0AtWL+kcatqOCRcKNEiN5GrZPILq1guo:rcL+uUAtWfxtqOQ154PcT
TLSH
T10355334856AFCA6EC34AB4B342F8A02F0507375AAC779634771123CDF8AB5A5B374760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Новая папка (8) — копия/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Новая папка (8) — копия/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Новая папка (8) — копия/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  Новая папка (8) — копия/bin/winws.exe
- Size 199KB
- SHA256 31d68a175abebab19f7f39bf6d0845ec5c18ab653eeeea6ee830b22d799b7e55
- MD5 f94c4b0110feccd6aeca48c93b278d8b
- SHA1 0148ac55f074a602d37db9031a8f33912ad427d6
- SHA512 cc45b7029bbff2cad44faec5f3f4a96a23365007101be9795b2dc7ad1c0184402160ac13deb97ddb01547be7803d35cdd79d5ec59a750ac33ec2234e076d280a
- SSDEEP 3072:u6iE1/fe+JgV/uCUsnD23WDTCT4+4Q1aRw0SKcVsa4jNKcdJbIk6D79th2y/lJ:r7JgrUsdDTQFDVsf5KQxIk6ltz/lJ
- TLSH
  T184146C17F3D688F9C462C17897AB6333E931FC452124EA4F6F94DB252F61E10A12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Новая папка (8) — копия/general (ALT).bat
- Size 2KB
- SHA256 bdfa28f0f299672eb074026780fdb19a52ed1732810e674e80f4c1890f8aedc1
- MD5 a5de0fb5bef76003c74034271b70bcc6
- SHA1 11ca7eb035a50552191980bd3477e640b15a0d04
- SHA512 937442e3c04f4eaf04bdd6a0ad627b222b9ae005db567ee821ba02d28b72cbbf728f02778ccf8e7ad819156776742f5ed3b6347726f9a07eca4495af0b4db59f
- TLSH
  T1C9516AA7E00CCA47F2CEA53EF46FB1607127DC8329D6C842834A59F8DC4EDA9684E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral8 behavioral9
- Target
  Новая папка (8) — копия/general (ALT10).bat
- Size 2KB
- SHA256 652207a70a993ebcf02fd2463f5e9593ac593ffb75d84ec4b8871cf8d84033c1
- MD5 666394850863bc1dce5fa24a49a9d3ea
- SHA1 a645725bcda0bfa72a8868490b9a0e059b0a17cb
- SHA512 0f39cd5402ceb1546bcf18744e731ceea9bb6a7f08f390477c479d17ad27ebf4e7edc5b7936adcb3ae28a69364f88f6f42409a536c5b966a496c8a80c34fbc82
- TLSH
  T1984149A3E00CDA47F5CDA93DF46F7670712BDC8768D6D402528A44F8DC4EDB9684E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral11
- Target
  Новая папка (8) — копия/general (ALT2).bat
- Size 2KB
- SHA256 483c0ee9bb6a8419927f320845dd8e504c4aea84ea7bd71665ffc795cc868a8d
- MD5 399a10089f3c74a55d9d75dfa34d58aa
- SHA1 8344d3f8bf4f56a0f070f97569523c6378f40048
- SHA512 831cbf187c39759659b37e53221ff81c1651b7f8db9d5c28727bf6cbac8119c1746261464de2e29745a0b9c70253e76f83597e9009dc8690eff97d95b768a668
- TLSH
  T1D14127A3E00DDD4AB6CFB83FF45EB1A17017D8C36DD2C402564A49E8C98EDA9498E499
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral12 behavioral13
- Target
  Новая папка (8) — копия/general (ALT3).bat
- Size 2KB
- SHA256 0dec95aeb21ee9803089667c1167b3f6e535dd58ca7a3629bd348f97663b210c
- MD5 406f92c91857c9201c2a7e2b5e5580d9
- SHA1 05500e828371d0ef81de2d676e4d7366d39a3cba
- SHA512 d4ac9eee0b57c76f1e3e44d38032b12d90d6956949abc9b43b299ff583ae0e72e139a5433037a03419c742aa0b780709a3b4ae84ec87d0161afbf363fcefd12e
- TLSH
  T198414893E00DCE96B68E643EF86F72717117D8C329D2C841924A44F8E84FAAD5D4F588
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral14 behavioral15
- Target
  Новая папка (8) — копия/general (ALT4).bat
- Size 2KB
- SHA256 46409e3c9239057702e03eb6896277b8904ca529d842d72a938a34b0c2b18cbc
- MD5 aeee5054db95ef77e520b3455fe47fa9
- SHA1 7d910290d71ffc2378de8e4ab21077fa681e1a52
- SHA512 a8c83b9651505ada80210b0b9832e9ec92087cad9400f9fc9d7101c575808f7cac6bf7ce21e30c9db0808342c75acde173380d8734732342a4bf1a00325da320
- TLSH
  T1B4514B93E00CC946F28DA53EF47F7260312BECC769D6D442838A45F8D84EDA9588E598
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral16 behavioral17
- Target
  Новая папка (8) — копия/general (ALT5).bat
- Size 1KB
- SHA256 99eea6f7de9ea0de0924823c1db1fb99a25b78fdaccd862e751706c4d01fbf44
- MD5 77d16dbc97714c2287ba1bdac96b2a9a
- SHA1 59891924e30237c0a4ffdd205f6fc8b256f87a25
- SHA512 4043e430453e74ed0f3bcbd21bb00bbbb96a0957e4d0b50b4a6ed2e9219223e2349b6d749c3a124e462245f0aaab2a81586f5ab10a8db9e886bfc82758c99666
- TLSH
  T1D5317A93E00DCE47F08EA83EF86F75B1711BD8C769D1D402578A84F8D84FDAA884E458
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral18 behavioral19
- Target
  Новая папка (8) — копия/general (ALT6).bat
- Size 2KB
- SHA256 1d61e089d24979779ebb14756ff1ffd1936782e6a45edff9b6e4fa6051c34c7f
- MD5 40a8a46561c45b0d0d7465d69d0712ad
- SHA1 ded6e328a528b4a58b4f881bc7b0b3defde59edf
- SHA512 f9647aecfb1ac960680cc8a8b31c010fb478f087d5379b6be431cd32b11e067820a8a8c84c593369b2c715a00653aa5b74810e846b7f0a1c24c9670b8116db69
- TLSH
  T1594158A3E00DDD4AB7CFB43FF45EB2A13017D8C36DC2D442524A49E8C94FDA9498E599
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral20 behavioral21
- Target
  Новая папка (8) — копия/general (ALT7).bat
- Size 2KB
- SHA256 8114b447ddee36c4d93d16c7f3f0735485cb92095e596c29eb7c86ccdc26c4b9
- MD5 d105f6efe8b5161b7128fa666c3925ed
- SHA1 428c1982b216a624507e455c81320fd1257f1ab6
- SHA512 2f836c11253598f01829e917ea4576c4220b651286eb8af4ba3130dae4896ebca977b989158a984d9db4da0fd96b24d257f5cd1119fe666f7a2ec371140e4d6c
- TLSH
  T1DF4148A3E00DDD4AB2CFB83EF85EA5B17017D8C318D2C452534B59F8C88EDAA494E499
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral22 behavioral23
- Target
  Новая папка (8) — копия/general (ALT8).bat
- Size 2KB
- SHA256 83321ef1b714267ae8aee99f4e4b0ec3a0fa3aa53e1c94a7a169918b99767566
- MD5 9df643a46b4cb69cc926035b7c012f4c
- SHA1 2990122be9d6b9452a95c905250b453f252e01f2
- SHA512 6602620a0ba5ce089774dca1ec587a1924a62cb9287ede948cc2e4f76d9931fef16b225ba4ab3f2d68909f2b70b5c8e9ba936effcf6109bdaaceffa9fe9b015d
- TLSH
  T1CA415993E00DCA86F58DA43DF86F7271312BEC8769D1C441538B44FCE84EDA9984F998
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24 behavioral25
- Target
  Новая папка (8) — копия/general (ALT9).bat
- Size 2KB
- SHA256 050f000ac9f1f2b730569bf6818b3cb3340a8afa6b8ef517184aec7d050571c8
- MD5 b75a8d973a5e5d38b4eccdeac0c32cee
- SHA1 c6e2e9accce4d84fd0265b9937a20d4d930e4ce2
- SHA512 a1bf6d26a12348bedcbbec32240bf50b29cc71a4ed48efe2eec2bb16eb0da39fe715e3f44c8ae697a403709185538439ccf188d255cee650670d1dc4e7364091
- TLSH
  T103417D93E00DDE5AB5CDB83EF85F71717027D88728D6C841638A49F8D44EDAA6C4F18A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral26 behavioral27
- Target
  Новая папка (8) — копия/general (FAKE TLS AUTO ALT).bat
- Size 2KB
- SHA256 b8fe3b554155b4cff1d625ffcd2c79add3ea73e11741d92e289ae7ba5f494984
- MD5 2cc05a727f31afdf6127547ea606bf0e
- SHA1 f75b22a01e845fae96e081294c0941aa93e55743
- SHA512 5164bd17800ae7be8ad2682867e68ad6ed117df922e0698836da99679b65b1de694430d97c32fefa22f7dba0dd1f41e0c310a0b2e8f781446089db21153fe45d
- TLSH
  T103517FD3D00DC947F7CDA53EF86F7260312BE88769D1C841924E54F8E84EEA95C4A194
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral28 behavioral29
- Target
  Новая папка (8) — копия/general (FAKE TLS AUTO ALT2).bat
- Size 2KB
- SHA256 3d03890feddb2e0e854fb0656404519590cecf9b037aa50ed2bf9634e236658c
- MD5 bd80cff8b83f850512cd7b53b9a78ee6
- SHA1 df2acd0f729385f709a0f202d852365b4ec1c4f7
- SHA512 809b0438f5ceefe3d1dbf64a38e46d0dca43b65dd83080f1aed02943b2d9f2fb716090cbae09d4695d2fd9ed105638db6a7e244fe97333402d072d7738e708d7
- TLSH
  T173514893E00DD94BF7CFB43EF46FB2A53117ECC368C1D842828A45F8D84EDA9594A194
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral30 behavioral31
- Target
  Новая папка (8) — копия/general (FAKE TLS AUTO ALT3).bat
- Size 2KB
- SHA256 a2077b859d7d5955c6f22918ead0ceac18d6b986ade84ca047795ac855b78969
- MD5 6edd4f2f5439991900a96b658823653f
- SHA1 496eb6a92cedcbe9af69fb871a848a35c05918e6
- SHA512 50a7fb2dbab96e569bc082035c494386ede84b98c1f668d4139d7931f865a2e5ca8d9cb47dce5549df03d8d16faad0f4ee115696b37089f3c3c2264aa9e05d3d
- TLSH
  T1125157A3E00DDD4BB7CFB43EF45FB2A57017DCC368C2C842928A54E8D84EDA9585A195
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32