3e2d5d6b5ad2f9fac3d2893663468654ac1a902ac534683f8be33c5781aa664f

General

Target
NullHubPhotonTool.zip
Size 356KB
Sample260814-2g543scd54
SHA256 3e2d5d6b5ad2f9fac3d2893663468654ac1a902ac534683f8be33c5781aa664f
MD5 e0caad9e2cd7e65b08c7682b6946e15a
SHA1 97db55acf89700b63609644bf7b5b5e0277dc52c
SHA512 a7bc8113156c335b36f297052daa242570ca8f180ee6fb21ef13790fb2b1c1916ad26491abf7e511c462774b10cf9b526657420dec7f84464757bd79a1d7fb81
SSDEEP 6144:OLom9QdSXgSKxJt/U1pXc6qleJm2NsXo8qPb55CKTNV6C6ZdlDr6qa:zdSuxJWA2NgHqz55LJJ6ZdlrTa
TLSH
T18F7423946D34F090D8A6473F17379AA94B1767ADC792237FE303B08FAD96485627288C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  net8.0-windows/PhotonClient.dll
- Size 187KB
- SHA256 76ace5df8dd979e269ae561b63dfc8cb1ead4acffe5fdc8407e91bedbb631222
- MD5 9dac3a2deb6822ddef6c6e6e2970dca7
- SHA1 2709e1e1d87e226b6c6d51e61e0458960c538456
- SHA512 717e8c1744c1c9d42cd6dc102d354393f56d73d38037d2770332ebf35b8985ec69aeff133b0df1eb7ad16b84407d8aeb85d1b4305b49f018cee0455b6ef9cbf4
- SSDEEP 3072:VJGx2bsuIQAa9XZjpoPAO4PMQddFB0Z8b1Pyi9xXyTIGZvGNDh0:VXsuIQAa9gPOc6ByvtGV
- TLSH
  T17E144A5C13FC4A1AE2FF2B78E475011A4BF2F926BA7BD75D1440A4FE6C56B828841363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  net8.0-windows/PhotonTool ~ NullHub.dll
- Size 242KB
- SHA256 b076afc17c5771f07cdb1409601968b00a21c3e8512cb0f9919b423137e74f5b
- MD5 d69f3edf40e68d5360102f6cae55f942
- SHA1 0565024f4b8fc9d92f3f67724eb90ece4768f856
- SHA512 74abeac9e7b8f0d8c0b86d65a7c56ffcfed73848926ed93716d2018d405090b152093330613bc1fe364aca32cefb83a236626eb508af41cb0452d80951995167
- SSDEEP 6144:MmZVzgLzgcgqqjprorwm1+ujIZF1ZY64PqtIo0t4DhfP:Mbz9S0rwmgEIpVIt4DhfP
- TLSH
  T1D234396463F84A35F6BF5B79D4B34100C779790AB43BE71D5A98A4EE2CA2780C814B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  net8.0-windows/PhotonTool ~ NullHub.exe
- Size 148KB
- SHA256 9c5ae83862736be7b5352a7eb70c9b20549a1e06b36d4358dbbc7708e1fe056b
- MD5 6664fe0ef69320873e09fbf46a2fbb5c
- SHA1 c6e9ba9b3756b3c4c2d5957769506bce9017c3e7
- SHA512 29fcde205d30b41da283d98dfbcba6e81148dff5fab4cd97938bbcf69571f7af58172fef1f674eabb17f81cd5ac0633815cb1b78944debf62d67df23a0c1158c
- SSDEEP 1536:V9YXnq9YamgiYSoGR6+k84vKqIzjiCBs86Q6LRwqzm4X8fY01NT/Z2bo+W26mLIO:kqvmgiYSo4k8uIPzlSRwa/WB26mLIgN
- TLSH
  T1FEE33B07E6A851BEE1B7C679CD924C41FB7378594B71A7CF07504AB60E63AD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6