6620e9ad75919ff168183d2c6bb4fc13870cbf4573da45b859bdd031227d790c

General

Target
Tax-Number852690.zip
Size 4.0MB
Sample260817-wysx7ada46
SHA256 6620e9ad75919ff168183d2c6bb4fc13870cbf4573da45b859bdd031227d790c
MD5 bc7082e05ac26a668ee65bfbb6fe2c0f
SHA1 3a9849e528210275ab486f57ab8b7cd1a05cb6c0
SHA512 70b5db2c677a57cd8fd4faeb5e94dbfb011d5b9fcbe3f44280d7ae6535f109104a573aa9f54da64e7f36c87d3c434b5865c5c49f94a08c715dca4df263333171
SSDEEP 98304:4wPlFvDoBl05wfOXK11AAmSnpoEs7qM/mTUdCoSpZdeG:4UrWeK11b1s7qMIUYP8G
TLSH
T1531633E198602A1CD4D1BEDD769CD0DD32E2E4C02296C7C25B429014FE2EB71F957EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  INV-No.20260817164222.EXE
- Size 1.2MB
- SHA256 233a7de23438d09cbb277a0ebb11f71a2af9c53d2cf5ac9e4af368de0bf20a3f
- MD5 0eb29371e8a79d9d88d4b38e14e7fede
- SHA1 011ace7a722fde86968304ad2e1adff3857cf203
- SHA512 729e5381747479c5d9d06a2868398858be6370ab0b72ec468707fed0b9c1525e828d658f280ee786c3d2353ecca3617d61e5c189c5c1ebb8ce7b978df454a94b
- SSDEEP 24576:cxcrYVkxc3bY9uB6TfuiBNNSuuOqF5Cb7KhU2k8V9TsfTlYN:cxc3cf6Tfu+YlfF8XL2bV9ToYN
- TLSH
  T14E457E21F501D132F8A704B286FD9B6E992CEA20071450D3E3D85CAA9EF15E27B3775B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  hdpGmS.DlL
- Size 5.7MB
- SHA256 1850e93db051b17becfea9775f0a0241d565de30b9059e5122589fce0e31725a
- MD5 aa9c8d958f4567a6ea61cda676b8eda3
- SHA1 6f6c59845a1383b5cbaa8d12db5880e3e3631617
- SHA512 283feeeac041ed4238ce9867530142236a6a357ed52f9642bc09d4079f744c6d502fb8e882b63d408133a030a156a1fafd63f70f0d55641463d6797bff730d51
- SSDEEP 98304:Jjv0DwP38wtCkCUyFJeT5ihmAcmI5JDROVYoZ4OiZrq1DfPHNADtV6v+zM+rwroX:Jjb38w9bkmAcmIbMV9Z4O7NADtV6v+zn
- TLSH
  T19F56D0117DEC0467E0AB03318EAAF2BC35BEBDA43F2561672784F61EF9313515A1522B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4