822801128ff8df85852dc6e13663c9598ee6ac462133e895adbdb509633bef6c

Sharing

Copy URL Twitter E-mail

General

Target
pistonware.rar
Size 1.1MB
Sample260817-16dkpaam5t
SHA256 822801128ff8df85852dc6e13663c9598ee6ac462133e895adbdb509633bef6c
MD5 58d209c05802efe381948e1ad525e511
SHA1 14d870c76c56e173af77e910731b4a064798790e
SHA512 2920ac26e14be6f2a403a4007212e05f376cf67ba7f3b333350561914a1aa9940e1f60df4ff8444e440cc647bcb6132afdd16623c67ac183686c82e88ebd7495
SSDEEP 24576:nyVt/pcQO5ap7FRIAUp5jBk2gwe1zyeYkYem+7W4Ev3:uQQZbIAU7efTeeYA6/
TLSH
T1663523EBB78C7532C9BE01710A14576CC9620684B5E8B5CF025261F6F436CB066E3FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Targets

- Target
  pistonware.rar
- Size 1.1MB
- SHA256 822801128ff8df85852dc6e13663c9598ee6ac462133e895adbdb509633bef6c
- MD5 58d209c05802efe381948e1ad525e511
- SHA1 14d870c76c56e173af77e910731b4a064798790e
- SHA512 2920ac26e14be6f2a403a4007212e05f376cf67ba7f3b333350561914a1aa9940e1f60df4ff8444e440cc647bcb6132afdd16623c67ac183686c82e88ebd7495
- SSDEEP 24576:nyVt/pcQO5ap7FRIAUp5jBk2gwe1zyeYkYem+7W4Ev3:uQQZbIAU7efTeeYA6/
- TLSH
  T1663523EBB78C7532C9BE01710A14576CC9620684B5E8B5CF025261F6F436CB066E3FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  pistonware/assets/hud/font1.json
- Size 141B
- SHA256 1f9864c182d7b44dbd2f110fca6068b0a0d343f6c3603a6a33332e0457e2e56a
- MD5 c56e386808fa7406f2d64dc3f63df861
- SHA1 af851c000ccb3e3aab86a66b3f79e43c3b33bba6
- SHA512 42775892470d8029313d812caad071982c1813237b5d36dff7e3995e782ff3795c098c98f2c28ccaa754687d49fd907dbed538773361a24cc2a1cdcc308e702f
- TLSH
  T161C02B4D32409D6C47CD02DDE0082289000B0297F6CEC801A8344F3025651207022BF8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  pistonware/assets/hud/font1.ttf
- Size 108KB
- SHA256 3e24b56fd39db40cf2acec608f0d7d42851273b61144082f7784a41c50026277
- MD5 049bd15488cfff46b250247d3a9ff0fa
- SHA1 11194d2f51c9ff7596a121b0d00e283b5950ae53
- SHA512 610a284cb9114de489672325fe2616fef2e39f7b5b0144dc2f739362ef94506cc9225b2f8313fea248a3241af435cc73466a6c0e93084edbd716e678b4c22196
- SSDEEP 1536:6X8mydXDNYah0lLhLvzrfuQnP7GXGlRHxCiQ7U:6X8oaelVbzrfRP3lRHqg
- TLSH
  T1D2B33856E382C7D9DE4A9DFC7231E7501FB97E38583CD24AA8B2B97BE65F5410C20205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  pistonware/assets/hud/targethud.lua
- Size 8KB
- SHA256 49118a92051dd377bc22c14a282ec84e86b172ab842a792f90856bab938d6357
- MD5 0ad1a5cc3560c10c92e3a880535c6fe7
- SHA1 2292787b3c3a1010321cb091c4e1498e96dfffd0
- SHA512 6785aa454c3400122ad5275cb48a9dfdd5d4d020ea845399053d2774e66587e99f4e866135dbe75a66ae6d41388342e80c526d8558a41e2af4fab98c619178c2
- SSDEEP 192:InYImniTp4Su5xiyDtDIeGMWHA+DoKaCS+TTk/HDwowoHqKzTUNjHmZhHowcD7ap:6YImniTvixiyDOeGMWTDoKZS+TTk/jwu
- TLSH
  T1EF12634F623E015D89161ADDE9370A417EFF6025A20BB64E78BA5035E4C0A4FC6F5AFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  pistonware/assets/new/Visual1.png
- Size 430KB
- SHA256 0b76676a036a2394c019ce7e25accc7546726be0c6a137bdb1b1732250d79174
- MD5 216291c126ff08250973be06a984e08a
- SHA1 01305fe064f402f477eef3598c432bd0a0833d5f
- SHA512 b4a74dea045f8690051517980c8d761db488f00b8a866c6e943dd9d302cc260e116632a78c7b59c7f6bd00dac087c1cfae2b50b428a9bb76a80a301ac07dfa27
- SSDEEP 6144:une1/859hLzHBHSN5Hi+oMB9chuIza2/OB9JPwqslBYk7s6ItnyQHMTi4tFYVAd:une1/859hLTJWMOB9l8+PGFYOd
- TLSH
  T12794D0089A5861B2EAFE701074D31D46587738A6E205FE0913A21AFD6F837B50D72BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  pistonware/assets/new/add.png
- Size 373B
- SHA256 c27c704d230d506fb880fac4d42945bdd761ff5faf63b7b10031c2df23b27200
- MD5 72cf14a5da117fe57965fc3922ff7553
- SHA1 81fdd7c122e8707e4d2756c300ebac63ecc232fc
- SHA512 c10d34e4676e11f89bb36f441a22e58b57b9a6d37d2a941ed6f6630b602d950c3e02db419dd54be113e61d2c685faae11e278cd862682257a7067ba244262bfd
- TLSH
  T1DEE068ED520A3622C99A8439906F1819DB3AF21D82E4507C40CA45B0609A8B848A0AAF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  pistonware/assets/new/alert.png
- Size 3KB
- SHA256 6e2771b285140189af96bb763bfa8c69ce6354fb0c5b0f0aa375da8ed825d598
- MD5 46e5266dce5cbd09699719ed960b9dab
- SHA1 4c3e7bb7fe43c2d3fdc8352dbc7151efae369221
- SHA512 d8d8aaadf5823f8f3bf32857d587c8e95e3bb04cdbac7c4c198b84fbe8e8942de0fd1aac36f5800591345ae4cb2566f40c081b482f916dd4dbc1e07b8fb42207
- TLSH
  T1A0816D43FFA0F1B7CB21606106292CB03F55376CAD4CA1D925526BBC36DBE0891E4023
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  pistonware/assets/new/allowedicon.png
- Size 353B
- SHA256 090bebafebb2b4576e6993296ddf8e2440e9ec6c676714412921cfa0cdb6c8c8
- MD5 f3ca2e379d7028e712385cca507db076
- SHA1 eddb652a6f37aaf37625b82d69d9069a85091e6a
- SHA512 22614ed870137ff73146998f883f82934737be5448550acdcc2e59de24e31fc2c7caede860a508d51c6975334629de73dcaa29b30a371fc672e86cd38aa77938
- TLSH
  T179E0C0F3DEA2994EC4514E20019F4108DF3C1865CAF1150CF9807337D2217490AA4E05
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  pistonware/assets/new/allowedtab.png
- Size 446B
- SHA256 a195c4e864068fe951aa8dfc5b5ac33dbcee9e283e1dfca9b2af518e22cb91f3
- MD5 21b3b4d1c314275479b06a1fb10970a3
- SHA1 a046ed865bfaeb8b995f25018e4e28f4b7dcc740
- SHA512 5794c15816447a8e8bd9a1f9aaaa530a8d1ac5e3624b35bcb8cbda919fe9f86445ffb7beb58172d8eab8c2345ff5a4d65a645cfff0d15c45413d3594d8be293d
- TLSH
  T1CFF02378FEC83E38858F1973C63480C8FC8624963024059125F4B5660AC200AB0BCFB6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  pistonware/assets/new/back.png
- Size 263B
- SHA256 7fab66001b76c953f87899eaf72830b35a35c9be928dbc7ed34b4b1139b8d8a0
- MD5 5b44b3d8c44f15111b05712729c601a5
- SHA1 ea83f371584f62e5f38334fd770f6ee521eb6f4e
- SHA512 03d5419d42c5c880f0464804bcc5dde5b17e3ac2ab273b862659de32d88a4bd2cda19b5045e995a7977cc007a4a4e34f5c2bfc105490e948d569e73bbe5bcc46
- TLSH
  T19ED0EB8B13F0A033871A912606840181EF1A0EA8C006C0822D1298B01D4238A8CF2E63
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  pistonware/assets/new/bind.png
- Size 237B
- SHA256 64287da0568924aadaa7abc88fa52e4344ff30045d18788cfaed5aacd8558a5f
- MD5 c5da468d328bdeea8ba0bd530087d395
- SHA1 b5f31cd532665c6027583305e99b38f330042a26
- SHA512 e5639d31d77488b2c09ae5a0870c0fd4049a888ad7c7a6602ca2b443905bef5000dd79222157db189313178254e90f2f0e6efa60c652cdb7a378587cf96ee8d1
- TLSH
  T1D6D097A32A004D9AC0AE15A78A11DAA8E9624252CB0784A04780C9E9F45C28C122E320
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  pistonware/assets/new/bindbkg.png
- Size 295B
- SHA256 92e0188077167fb9874bd463f1e17a95b83ce2a40847efd997e22f3cb88b53e0
- MD5 7c2bbea6a079b64787e90d7ff6e94107
- SHA1 bad83efcdf9ada9c9e996ee383e2837430648342
- SHA512 e6b8e7ed885c4e72c0e0cd3f29fdb73d2b49bd2890429ec3856ccb1184c7b38aeb40335a9894d2c78d2f761d4a3bfa78cb5a53f0a2d30c16d38088fd2d9d7f49
- TLSH
  T171E0E7F2DB9B74B8D9D4349E1D119C53D07111414E8600551F55CC5F553CD0C990D5C1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  pistonware/assets/new/blatanticon.png
- Size 330B
- SHA256 c85459ff3c3f5496a3fb49cd97eae926d832f773b116af571090446313221e56
- MD5 26aca335b9c999ed336ced38f1838c33
- SHA1 97f80ecab62c2f716e5df9db8db4e729e2209842
- SHA512 3fe4500ec39f5aa597b875440b67aab0d71553c618a63ab6f69d4356d5b0f48017fb1f66f2fee8515b3a6dc30e4f7df85ccbcd6e0aabbdd22a47fe9add08e36d
- TLSH
  T135E07D4B93DDDA784E0501716D1A076EA650B6E3E546C20B18A5D12D2AE30DBF0D52AE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  pistonware/assets/new/blockedicon.png
- Size 341B
- SHA256 7f539a26af4d1a7a0abfe41971a0509283936508ab22ac64a30a94decbe41821
- MD5 98751602aae1de2e2a9513555ee1868c
- SHA1 d2dbfd8f6fc216b9598b11a5692f10bcfc608e2f
- SHA512 95c0843fc631b0d754cd62df0e66c41033d6310880efc5bd62a7223201d9c65b8371b43558436433b6c49e08dcb7c73525ee43c1a6f0618f44de4d74d613b90f
- TLSH
  T145E028519B717C30C0634E7011D85FBDF73C546786DD1C3E8113E51C1125144CEE1540
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  pistonware/assets/new/blockedtab.png
- Size 466B
- SHA256 9a5455cefa5e37775b6b51ae9fc6f8bfa18b0b7aa455ba9533e6ae751d2cf9b8
- MD5 cd94102ce330d1a6e7c8fec40bb00f3d
- SHA1 f75a2e9fe0ea276ba817b52e5a9199e5f7d59c89
- SHA512 e0b349cad69f8d5d8cd45cba97a436fee0f66ec114bed871b8dbf70310a840f78d5dba7ae96d5457bc07d9d73e101847f03517f20bc3aac1ad1bfb19dfbb98ba
- TLSH
  T1B7F0D4A3224F7FDAEDC6C15744F108547923818E014997C706161AA0E96561597DC30B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  pistonware/assets/new/blur.png
- Size 1KB
- SHA256 35f34c08ea82b8428eda0f6d9b3258764dd19359f1878cc767c2242e0703b6cb
- MD5 c85c36bd6079524b19db3834bf1c679f
- SHA1 47e144e6c836f78789f537b967d3c52eaa0d3ffb
- SHA512 1482176df9711cb0f784bc30c404ca75a750056fac9305dbb6117c083b82d86333c6b0dea0e30023a718073bff440fa61875fcf3550628ed71a2b868e4411fc3
- TLSH
  T1D441758F78E049DEA1051272567304D07B3DAE482C1B8A0DDF2CF6F4DAC8B204C42BEA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32