b58d4218935b9d9b0becbc47281993cf801694e812bd09fe4e22cce2593dbec8

Sharing

Copy URL Twitter E-mail

General

Target
b58d4218935b9d9b0becbc47281993cf801694e812bd09fe4e22cce2593dbec8
Size 14.3MB
Sample260809-n1p1baxcjd
SHA256 b58d4218935b9d9b0becbc47281993cf801694e812bd09fe4e22cce2593dbec8
MD5 df55a8384a001386ad154ec05df51fb8
SHA1 56b59735bf96dcb24a715f28388b21c1e0181e7c
SHA512 c28885de997486e5fd3daefad4ed981efd88185cc973d4821d04fd1768a966b28c2ed1ccdfce12079d2f980e902bfa4de26b667949defe5fd80ee6235516abdc
SSDEEP 393216:K0/EdkXDWXvL85wgax5oLtILa84agC+nAnpJlNl6SDUwjl0Fgujk:x/EoWXj85wLUe+AnpDP6SRB0Fgv
TLSH
T1C1E633ECA3000C9DEF8B492A7B5F97E3D8E2909D55C2442FD5945BDA60C99E83D2F08D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  pcstory-V6.4.2.0/autoupdate.exe
- Size 7.5MB
- SHA256 88d1c6290c2c4628d9745176d0d76ce5cd7cd52b82db99d14cb93676a24d042a
- MD5 315b8d9f394152254e548a694a656665
- SHA1 0e81333ec56109a8b81a8335e1fb4b30890360e1
- SHA512 87bd6824a95eb06a6f57353cb77918bbfc95f17fea0b6fa3508766677f57f92d65af8f0ac72bad2ccdd123359fd30309a4b706eecb2b24fd45c4a798d877397a
- SSDEEP 196608:rRztAfbd6Ov5QNTSwGt5EFLOyomFHKnP:rRz6Dfv56TljF
- TLSH
  T19D768C556BED00E8D4A7D038CA578527E7B3BC1427319BEB0161A66F1F336E05E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  pcstory-V6.4.2.0/pcstory.exe
- Size 8.4MB
- SHA256 12746cd27500b796ba3aa21a292cbbf4fa4f12f81d6b415bd73930fd5d299ede
- MD5 9dd63a1edcd5dd6d6a85dcd8344ec1e2
- SHA1 abc59b23690da2c8f3438b285b8a23c4748e5c56
- SHA512 74237e6a2155f6e144283e1e12b05177f158951cb9b94da24af535850c65b8b2ec4110588c74594b1bebf795947a13e8e701790ae7295f0dfe968078dc7a1438
- SSDEEP 98304:Sx1g8YFnJU4MmgtL04K1BwCxedYciCBAUZLOHm62mFLOAkGkzdnEVomFHKnP:0W8mPu6BwEe6ciCV+mqFLOyomFHKnP
- TLSH
  T1EB969E466BBD40E9D067C038CA978647EBB2BC612B3147DB1161776E2F376E01E7E221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  pcstory-V6.4.2.0/storyservice/fp2papi.dll
- Size 218KB
- SHA256 1351e53fb7c9ecad3fd9a2b608fa0f2c28c43f9896110d9e9410c407c8acf1c2
- MD5 115fc09ba5ce7955cd184ddb7ec95a57
- SHA1 b2eda37beedb9bf29dae98e66f7b20798f05ed42
- SHA512 1d39f5dca031cece19d4f93e490bcc69dfa2eab69c80b075daf45f07ebe423a724160604a8c883a27a4bee6f92262c1757c8838594a052792b8878d8b8fe6d96
- SSDEEP 3072:hwt26+3yELegk91x/ZUJDWmui55GgDiO4yCXX4XQFpq57hoTZ:hb6ghFO1x/ZyqjY3SN4toT
- TLSH
  T19F249D5573E40CBAED77823A89974606EB727C020770DBEF03A04669AF2B7E1553E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  pcstory-V6.4.2.0/storyservice/fp2pconn.dll
- Size 316KB
- SHA256 050a553248e776952b362973254d2cd1b73a65e37529934da09b47f72959d6fa
- MD5 981e0cfc8abf8a24384947dd3ffaff0c
- SHA1 1bdc8f641cafe6dde25ab314b8e3f63cf6c7c7f0
- SHA512 0b7caf9c972fbf3ae2c381da0982c02072d741617b957c2c8b8f09803ffa24da08c948cbc822ad0661c9fe8b4ccf4c5f85f36d66f267a2bde5751b465d86ac81
- SSDEEP 6144:lgNOWI9TPYa9HdUQmQpA1jOvc0JDrcYrFbf22A:ew1TkApAdOUgDrcYrNS
- TLSH
  T1A3647C59B3E504F8E567827CC957860AF7F278660770DAEB03A0862A3F23BD1553E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  pcstory-V6.4.2.0/storyservice/fp2pcore.dll
- Size 306KB
- SHA256 753806b088f21d13f976d5956e6f88a7d062e14268d02252ade7159d20e94c0b
- MD5 0507186c43ade7bdc7af37af3ea68f03
- SHA1 d55f904f27af00652fe33e83fee8ba0549486239
- SHA512 a0f8b3572517dc621846fc91095dacd6a0104d4dbbdee677aef22809d91f94a3e5f12907768904ea7c60fc3919d6faabfcc7022f64198924ea86aec2d2a822e3
- SSDEEP 6144:kHBe8Cfte6U9Xa4n3xNHrAKbGAZ4vwCOTBS1uXVw:kScpa43zLXbGAQwCOTU1uS
- TLSH
  T113647C06E7E510BAE27B823CC993454AEBB278450760EADF53904AA93F13FE0973D751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  pcstory-V6.4.2.0/storyservice/fp2psrv.exe
- Size 356KB
- SHA256 6aa6d33533e62fea4cb78521e83767bb82f642581c9701f0637ce1fbe0ec44b4
- MD5 73ae449d4bc4d2a0562da03462a17ca0
- SHA1 c8f65f27c574a1c060d20209d709c27c9735e002
- SHA512 8d8e63b60a77a02c9ee5091581c6fcefa1c652bf0931f50b1b683f4587b8fc805532f2588d18efd91cc86f76e66df93e668c81248ff789f972b1f11df69643e6
- SSDEEP 6144:HNMF8BGmknNyCuFQxuoBmErm6S4bONeBK:6F8BGmknW8uuXD/1BK
- TLSH
  T12E748D56F3E404F9E167C138C9678656EB727C1907609FEB23A4966A3F33AE1593E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12