13c25d4d908a504cd6ded62bd4666c2ceff34a50b4b9f5353b0835643d034c7c

Sharing

Copy URL Twitter E-mail

General

Target
pptcopy3.zip
Size 1.6MB
Sample260816-af2aysak31
SHA256 13c25d4d908a504cd6ded62bd4666c2ceff34a50b4b9f5353b0835643d034c7c
MD5 24b037a1741e7e4a5b6d2919919d9c01
SHA1 0a975f5aa7731d59c81caa717fdf74a7715da26b
SHA512 f2166db74cffdfa2f7f83da2878d67677fa833ba6a7522f66e40e215304aa44d38e669e2a5f6d48843a64123f7e339fa6cc5b61809547acec4373324c74959ea
SSDEEP 6144:7Vs9RCyK6n2U/Xz97ZIAjMJzM5K27DZHryCd8x9iTKeGfoPr2xTFAYC8lN6HTJ7w:WnVXz9tKMdLytWI6zzTX910F8fh8+HS
TLSH
T188856302B4E0ED25CC97083DD5A1270D3B64C1E74368AC64F9ECABA66F15A8125773FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ppt copy 3/env_setup/env_check.sh
- Size 700B
- SHA256 2e9f483156b630214b2fdd83a65b71d78071b2920121465ce42da7b94a560a74
- MD5 6a51dc35e5bf75905ec6c14ae482eefa
- SHA1 d5c383e550a50966ca6990ac96c4d88a92322d28
- SHA512 7b35f31d49838cc291d06d47ae54fbe0536348e80474af1d9c35d7f075b8e9f8c234d7ec1dd6f4f26814a3abc1083b8657b4aedf8e63c9a89bf25498713bb6dd
- TLSH
  T1B301C0666129E33414C011E4928E86627A30A3754AD59C5DF7EAB4931B2054CE077B12
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  ppt copy 3/env_setup/setup_mac_linux.sh
- Size 8KB
- SHA256 ff129f1f25c5f35b8306feadcab43dca4a12fc14554a37fb64e15f0b9946efd3
- MD5 82981186a626cf200a83b3ce50f531bf
- SHA1 75444416dcaaad2b4c9fb08f263445c0dc65f24f
- SHA512 7e0ecd95cc84a1cc0d866d623ad6311c896ee304ca23bf96055f4d373d0366c49a7e363f64a69ab603391e0cae6c5eff3b04d82e27503799ffc46f9d546d5960
- SSDEEP 192:YEMADZW92hypab2fgYUuHNiquvRYv3Dayz73:YGZM6vRlyzj
- TLSH
  T1180292677500B1B1351982B86E5350197B16226B2828385CB0AFBE582FA0BD8753FF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

antivm discovery
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  ppt copy 3/env_setup/setup_windows.ps1
- Size 9KB
- SHA256 2e69b468b49fb4ce8f40917d3e655859c01bd0a72ed33046e854b9115661393f
- MD5 aae99d7117966e13416177bd381c7a2e
- SHA1 7fe071bd2badb8fbc9a17f74323b7e53c56b57f5
- SHA512 4872a335048da0b1fbd158548a8719385a1a861f773c3efe7aa786a16ad2f4a972201322798df447eb68901275064e3978321c915336fc1fc9663121e81197aa
- SSDEEP 192:NBjP/o8PF4GZkrpiVMxig4BkOW/1E9VoHPy+kow8BOi:NbWGvzBVmCkaA
- TLSH
  T10722C62AED84597639C253AF8E9B9100B695522B800C3E50759D5D84FFE633CCB32BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral10 behavioral9
- Target
  ppt copy 3/ooxml/scripts/pack.py
- Size 5KB
- SHA256 6fe762f45aff8c63fd95b9fcb1337b28921d6fa454e18a0e8158d4c8708d6d00
- MD5 99d7c94338ecaac4ea0d423c130e332b
- SHA1 48327c411090982220f9546f8b699d9b93745744
- SHA512 f40c8883f7e61131b9afc0db17f162bd5d104b31366db9addfc4b693067e4b827ef73d22e7dea0656ed7c1ee3d4d60ccfe20001605e2eaf7fc6199b6d3b1fda7
- SSDEEP 96:Dlk89H7StjF9B2XrjkChPHiRt1MH2BuIkZT0s3ShWwQwcDU1pFvVi:xj9mFrCVCz1ZIh0s3SYXwkUzNVi
- TLSH
  T1ACB18402A8C518929B93C57CACE2D41066A5B85B6649287C799DC2903F64F70C2FB6FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  ppt copy 3/ooxml/scripts/unpack.py
- Size 1KB
- SHA256 438bc763c1f31373381fad7ded0e87ba4a4863004cddbd95c1f6d59ca1dabd51
- MD5 fcbf81d1df2bac57c1b3444c9907b809
- SHA1 7239d7c14a1cdc409f982a7379a0b7a9adceeeaa
- SHA512 e28b887f8fcdb46717cd8709ff4db92dee2844dbee52323a479a18beaf32d08a35b1e6899340ffaa20c9ab2f8891d09103d58d02bf8132813c7f601979817c0c
- TLSH
  T19D311112DCD264830783D79868EAA958E3357C4723813EF871BD9F682F25D6184EF45D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  ppt copy 3/ooxml/scripts/validate.py
- Size 1KB
- SHA256 08b1c15e8faf0f6a822622aabd85476d913a2fbe30c82204f80fd5f08bcb4014
- MD5 fef3c5b71681070dadb5d06aaee4cb79
- SHA1 885f612e0ffd27e423616c29ea6c30c951d474df
- SHA512 68f0fd96980513e1cb8adeaefa37e056366c21ffb7194cfead005989f8ba75fef328e053ae4dbae10e2551256599afed4c1882b8ac2e2cf56aa1e647a21f8767
- TLSH
  T10D41E24D89C910400F6302FE9BE5C84156A61A4B258178ADB7ED42906F84BA2C7F727C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  ppt copy 3/ooxml/scripts/validation/__init__.py
- Size 336B
- SHA256 83e0f035c5abea238d3f2c3968afbd511ed022b527b7c9cb60a9434cc34ff987
- MD5 9577920dc811fff9762a96d4095d95e5
- SHA1 f3b82b83cd17a455c92544d6391dbbd9e1666395
- SHA512 3a8a9f08be8ad12af6238ff179fbe3b23813f08e3a513d33a09a54dc64a52ab2f7261560daa7bfd057e05c2e5831c1dba54043fa73654a765170e4b875176ce0
- TLSH
  T138E0BF5988366B610DB561FCB122D2961EFF24231E102227F2F543640B847D78B2600C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  ppt copy 3/ooxml/scripts/validation/__pycache__/__init__.cpython-313.pyc
- Size 487B
- SHA256 11146dc92652fd8a7cadf66eaf1c34335b1b56f2ac228360f02a1dd70503faa2
- MD5 256f1ab7a4ce661b6bdfc697989a3214
- SHA1 9573beda5590450c9a710138262b420c83adf748
- SHA512 10e50f7fd980828fa45839ad364aaecf93d8d85cf5d12834dd93bac31ded1595766b715779a24c24d14f5b3490174c3157018b644daef3556a4fe06b24363bcc
- TLSH
  T1FBF05C84B811D662DD6930FDA075EBFA1EEBE443B63E5007A3ED60A41C4C3C2D79685B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  ppt copy 3/ooxml/scripts/validation/__pycache__/base.cpython-313.pyc
- Size 37KB
- SHA256 cb1a2eb24a8971f8b12a6da07480089084d6363948dd730fce4bceaf24fa11c1
- MD5 fe1f4e731ec16611eff8785e99b97fd8
- SHA1 ec592982fffeece0a5e14c67da5b6a11b1195179
- SHA512 4a475d617e38b3ada10881caac1b7350e1064414a06469f71191c0a7f58a0e91a67a2b41ec6218c58a3ae6024b63f300a6a4d08f3bd0829d2df611740ec8e532
- SSDEEP 768:XV87le5Q5VV1g9dHp0BN9/t3/7qdaRX6BquiiLrvc6+RSkqq9bYpvr:XV87le5Q5VV1g9dHp0Jtkiirvc6+Rcqm
- TLSH
  T16C03075FE5619612EF20F2B450DA240523AD5AD6B6A5C333741D03352ED7BBACEB232C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  ppt copy 3/ooxml/scripts/validation/__pycache__/docx.cpython-313.pyc
- Size 11KB
- SHA256 abc48c865668fd15a50d4158b5aafdce7879bcfadf12d910194882b3e3c0e50b
- MD5 1c763eb6c23337e29f33ad5f5572f904
- SHA1 8bce21999e1e2974987138fdcce60636aabb2f76
- SHA512 75784d6cd31e9fbde692223cdcc0e5569233e3b8f60863521d46c3c97e3394681a92481bad795baeb03c793431fa67fead29efa3bddc86d483aa0b7738b8d19b
- SSDEEP 192:bfUEpX4XIIo8t40qXOeFe1ap7QxltcxBBRcbrd1EHrftHJXvxjlIwMzQftkf/f6W:QEpX4XL7xH1o8rcxud1EHTtHJXvxFf1g
- TLSH
  T1E732D71EA591D015FF31F2BA50DA8A15B3BDCB96FA12D32B745D43301EC7B6289A230D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  ppt copy 3/ooxml/scripts/validation/__pycache__/pptx.cpython-313.pyc
- Size 13KB
- SHA256 78a8128108d0cf4ed2fe5897c19829417778cec1391c0b7e13bd4d4e34611642
- MD5 c6c252ea385a9e2b554b66c2b278675b
- SHA1 cd107164089781b3bdc3a38b78efc5eb769137c2
- SHA512 90dd281001410060cb98971c6d42c6aaa6e851a3ff6781b3ef335b6461ec5ecd2586c4b85a1084777558ec074dd8856353120388d05745e1579938381c32f2eb
- SSDEEP 384:6GvtIkDV1BnI5yUx2CHmoxlP4hs9lmcoX0FVyYx4Cqd5JNj/x:6e46nz84Cq5Tp
- TLSH
  T19252F98B96118A01EF34F1B940E5860D63EECBE1B156833630CE42351DC6F79C976368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32