b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4

General

Target
b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe
Size 719KB
Sample260810-wfjxkazset
SHA256 b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4
MD5 f11a33a1a5b0fc1e6214a0986d601e49
SHA1 3cd631dc156788e37abb91143ce1344281bb8aa6
SHA512 e16e059a082b5cef5eef9d8e723ac983d2a7d463ffd034436d0b5ec02662ab91d08e1a258118915671e9b90fb4df53be3d242e76c573d081d63874d58dd3f4a6
SSDEEP 12288:oBjHXCrwblvxTS0huCSr3N1pFdUICiJQ05M+xZOcCubqtndGAMz1BU9zKaovP0wy:E3KMvxTSquCSr3N1T43+M+xb0ndjqDEZ
TLSH
T189F412C03B8B9C39EA91B835DC974951C7A93A71E27301F73E34F52CA462A728B1F915
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe
- Size 719KB
- SHA256 b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4
- MD5 f11a33a1a5b0fc1e6214a0986d601e49
- SHA1 3cd631dc156788e37abb91143ce1344281bb8aa6
- SHA512 e16e059a082b5cef5eef9d8e723ac983d2a7d463ffd034436d0b5ec02662ab91d08e1a258118915671e9b90fb4df53be3d242e76c573d081d63874d58dd3f4a6
- SSDEEP 12288:oBjHXCrwblvxTS0huCSr3N1pFdUICiJQ05M+xZOcCubqtndGAMz1BU9zKaovP0wy:E3KMvxTSquCSr3N1T43+M+xb0ndjqDEZ
- TLSH
  T189F412C03B8B9C39EA91B835DC974951C7A93A71E27301F73E34F52CA462A728B1F915
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  camoufleur.Can
- Size 52KB
- SHA256 e62f19191cb29b46c368b153ae8d7f413cf88eea1f538260939db7f11833d74b
- MD5 1b62d55fbfc1481850db5156f354f284
- SHA1 1969109f1b296054a89c53e0cc8172018671b2cb
- SHA512 d6fe2092a0c6c7eb95b9d9ff54681cbaf5726401654a5dce6d8dca491e2755861a49c2a3bd9e5b2485bbf1b91e65d944ad36a32dd3c10aefe15468d78dd56e00
- SSDEEP 768:PVNyHxhQ9nxpL9x5MH82RTZIHbrloF4l+qtugolmSiX4xeFwzAbmgN+asKbfIvIB:PVNyHW9xGH82g2qfoloX4oeALRbf/
- TLSH
  T18C33D080BF6B556D884122B86B994D312FB94D79C6E6C471CA3B32EF30C1056167DACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence ransomware adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4