01aa2d75297dd4b966ebb672508abafddd3747baf2b3852f99ae1890d4be21e0

Sharing

Copy URL Twitter E-mail

General

Target
Installer.zip
Size 8.4MB
Sample260811-p6leraee46
SHA256 01aa2d75297dd4b966ebb672508abafddd3747baf2b3852f99ae1890d4be21e0
MD5 23968cd581ada1966ba87bbde16e7a44
SHA1 3143486ce06d957c87a722fbb9cfc622ceb823a2
SHA512 f38704bb322e35ea6de18e3a969bbb8cf10e3179d38cc94d36d0be97bd6496908e768ebe41d7bc19fdfa17d03bac8e027545e7ad7481a5effc5890229158e7fd
SSDEEP 196608:7mE7MI4tf8IKTUP6clrGgDOhbP7h+cS+vMbNmKpEs3f:7VQf82dlygE7Iv+vMhmBs3f
TLSH
T11196337E3D555143CEAE5635E9810B743F4E14BB6768ABBA51AFD000B8BC89C3C90B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Installer.zip
- Size 8.4MB
- SHA256 01aa2d75297dd4b966ebb672508abafddd3747baf2b3852f99ae1890d4be21e0
- MD5 23968cd581ada1966ba87bbde16e7a44
- SHA1 3143486ce06d957c87a722fbb9cfc622ceb823a2
- SHA512 f38704bb322e35ea6de18e3a969bbb8cf10e3179d38cc94d36d0be97bd6496908e768ebe41d7bc19fdfa17d03bac8e027545e7ad7481a5effc5890229158e7fd
- SSDEEP 196608:7mE7MI4tf8IKTUP6clrGgDOhbP7h+cS+vMbNmKpEs3f:7VQf82dlygE7Iv+vMhmBs3f
- TLSH
  T11196337E3D555143CEAE5635E9810B743F4E14BB6768ABBA51AFD000B8BC89C3C90B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Installer/!!!README!!!.txt
- Size 2KB
- SHA256 4183e28e3a081910a7e002c2ae044143e0fff18cefae5334ea7227f4a6014596
- MD5 f48ea165dff168150cac7db08cedfbcf
- SHA1 7d9cc93e2fe5c0721bdd05a260f2ce522f137cd6
- SHA512 87cccfb5afc02b48f1bd93c4cd93281144d9fead3706bcc0559aec75f98559566bc1badda383b89f07874a94ab4cd3bdf785e7c931a62bb7ad31ee1e4e71cd0d
- TLSH
  T131511A5EFFDBAAB39041DA112B1ED6A2C20D516CAA470B101A5450BC36A06B379FA4E6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Installer/ALI213.ini
- Size 2KB
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH
  T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  Installer/DW/README.txt
- Size 544B
- SHA256 7f022910960d0b0b59a8c34cc6aa8ef2ab6b3812556edbff37c705ae84f9e7b3
- MD5 cfaa8fa0af14238d62ad14cb3d6f9a98
- SHA1 4ef6bf9018c513f6a1f1c950e77b75aceb1709d4
- SHA512 e087d62af3569ac6cd6b02b843e4d3281a04fd9dc2e2f540c67a436ef99c8c14071945eca3b0fa87fa4dc38125d8f966d649a39c339f7d96efef1c45826686c4
- TLSH
  T173F08B0EEFCFA6B21501E7926B4DD953D208A43C93618DF45835217C61703B46AED6F9
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  Installer/DW/dw.exe
- Size 5.4MB
- SHA256 fbff7e301407d40c0785294170bc4fc3b99a4a898bf60d1d3999682a995100d6
- MD5 5d99480d717e1bd6b623af66d7677eac
- SHA1 54089c977b62cb1a2e79aef022ec570226d254b8
- SHA512 bd0f6fa59d6b63a9ce1d527724c511371015c0e7db2b79df5711e30f29387c59c44d5d35bca1657db3794b333f95157c2d21de6a779f18376bf18d94cd20d875
- SSDEEP 49152:JdX01aKnCjXDQ5/hhv5qAWAZXkRKLfVoxgMpg4:JqLbWElLfVo3j
- TLSH
  T186462917AA9548F6C0AAE735C8B74655BA70B80D4B3133D31E91BEB82F713D16E71B80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral10 behavioral9
- Target
  Installer/Installer.exe
- Size 3.6MB
- SHA256 9b9ae7956e2fa795239fc24d38393712c17939b8b6f71e146d414472f033ca26
- MD5 3b0c875992d50d9fffeb13336db38129
- SHA1 956f5c78884d08c98d7e2e5434793cbb91993163
- SHA512 9268b5277a7eb25472b3b0c6da7b4e750126dcc288eaf70b437b4ee99692b408f02a60e35c77aa881b1f5dbd3bb85a7e5bea85e4835679e02d09feee4e9ea4ae
- SSDEEP 24576:vkZYO+dE60XiDDcvyggIEt9AweuYIWfdQT5p9+Bv/oBele5I9D2i5LTKJ+egEHIO:vkZBcEXSD4vygirreukfS+/AeenJ
- TLSH
  T19E064B03AE9108FAD196A73588B75151B774BC0C4B3533E72E60BAB82F727D16E39B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral11 behavioral12
- Target
  Installer/Serilg.dll
- Size 125KB
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH
  T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Installer/SystemEx.dll
- Size 23KB
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH
  T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Installer/config.jet
- Size 697B
- SHA256 7ab308abac85601d348005bbb7032c92261fa25c782a712f1b0482bd85845ede
- MD5 53a9cdbb5470cba6ec4fbafdf7ac618c
- SHA1 dd8600c6f92b975ce54f300ac854abbdddb96559
- SHA512 c501cf9bbce1186e42352612d60c1f41699c0e297bfa93a6a91ad586b8f09fcd81b00b67ca1cc52a80a227d29750739ec56a8b494fe3f679ffca0c797ccec02f
- TLSH
  T1CD0176308A7D243C430CCEAC3D62EB5AAA7C020F5784C41FD56D8EED1BC00A159D7352
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Installer/data/ALI213.ini
- Size 2KB
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH
  T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral19 behavioral20
- Target
  Installer/data/Localization.json
- Size 8KB
- SHA256 0ed2630f4d0450117719a6200426a1e1b78eeb9b100a0fb8e4cc10b7995e3aa2
- MD5 53efcb8e8d93ca156a3962254cde417e
- SHA1 dca16a76e1345958a33cc09d9dbbf080adc0aead
- SHA512 63fd95544513f9f6716d39c5e9d732fb2b30927e0e43717846dcc1d59f80e5dd31e8f302d169f7d5f3a7d897adf264cab22b6e610f35409968b3a5b04d5f4fd6
- SSDEEP 192:Q7WjQPr8cHgeaxcE57vTQNZfl0RB7vTQNZflBa7vTQNZflhWhN7vTQNZfl1B:iXrUcIspERspBAsphWhdsp1B
- TLSH
  T1D9020114FB401CAB822261A16405FC1774A901FFAB29B7FF764C811E6BAD02ED477AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Installer/data/eula.1042.txt
- Size 17KB
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH
  T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral23 behavioral24
- Target
  Installer/data/eula.2052.txt
- Size 17KB
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH
  T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral25 behavioral26
- Target
  Installer/data/globdata.ini
- Size 1KB
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH
  T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral27 behavioral28
- Target
  Installer/data/kernel.bin
- Size 518KB
- SHA256 952ca2531233f5993cadc72e6396983d96957a435c9b78a568dd8ff4fa9ca4d4
- MD5 d9b31471fa5f562bf746a1fd1f07094a
- SHA1 95a381ad0e3aa296aa0545ca5b86cb5ca96924b5
- SHA512 af2c1f585001ae50bdb1dd0d407eff25fb0b4bd3c98c8c07da873afedf7aef3b75c4757d583616a666154b2911be3744a4c358a4c20afed24241ca82be48952c
- SSDEEP 12288:GEakMQ33cCxTWI8W8o9hMCiWIUdJWz3L1bfQmudC4WPgHGwgQ3piVnMlPs2n6aJk:3aDw3h9/xZjM/dkWzBbn0rGwgQ3piVnx
- TLSH
  T1EDB40E68273B0BA5E106ECC554921C03DF54A39633BEDEF19F579EB60350CAAA4B4CD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Installer/data/overrideAutodetect.lua
- Size 162B
- SHA256 817dc1b1f94ab2bae24edb81907f0ef36a00631563de9e47b2263d2c23958db9
- MD5 a51d997e849f796e0df777cb67f2f3e7
- SHA1 7f59e9422d976cef13ebb588c62e28f5e4b22dec
- SHA512 581d26ad578ef711a03dc9f58e90a946e3000021907f3d1a118c4f6caf89038cd3ac7303448768a735a0a7e3d53c1edf4945e992e141c90cdc4b04509103de1b
- TLSH
  T15FC08CB09736B9280B1BF7B7EC022A0604F0E81A01A7242F1350008C5A00F69A42AC1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses Microsoft Outlook profiles

Checks installed software on the system

Looks up external IP address via web service

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses Microsoft Outlook profiles

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32