6a89aeb59955783ff081691e336a82bd5d9325e82e34f9c1e0c780b61de94ab4

Sharing

Copy URL Twitter E-mail

General

Target
Gorilla_Tag_Free_Download_Build_19266270_Archive_full_8474.zip
Size 783.3MB
Sample260819-1wy4msvalc
SHA256 6a89aeb59955783ff081691e336a82bd5d9325e82e34f9c1e0c780b61de94ab4
MD5 4b720d0da450122ee4b0893f347dcdc2
SHA1 b72875f1aa0190830656c55e2582c215a07880ca
SHA512 7b896a656f9311669f0d24ad29ddd3232a661bc0e306d5709b46c8b46974e42195d3efa5fc9b9c4dde00b30d76601dc7ca0809d1bc6f1ddab8765994bde308fd
SSDEEP 786432:CwdZGVNWCcROCkX0vXihnPYz5SQH0TZZoo:CwuWC8O5kviVgND0Tz
TLSH
T185893315C92CE4C3FBD376B878B0D157CA2F607532DF9299B59932F4AD8A9006F2C909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Gorilla_Tag_Free_Download_Build_19266270_Archive_full_8474.zip
- Size 783.3MB
- SHA256 6a89aeb59955783ff081691e336a82bd5d9325e82e34f9c1e0c780b61de94ab4
- MD5 4b720d0da450122ee4b0893f347dcdc2
- SHA1 b72875f1aa0190830656c55e2582c215a07880ca
- SHA512 7b896a656f9311669f0d24ad29ddd3232a661bc0e306d5709b46c8b46974e42195d3efa5fc9b9c4dde00b30d76601dc7ca0809d1bc6f1ddab8765994bde308fd
- SSDEEP 786432:CwdZGVNWCcROCkX0vXihnPYz5SQH0TZZoo:CwuWC8O5kviVgND0Tz
- TLSH
  T185893315C92CE4C3FBD376B878B0D157CA2F607532DF9299B59932F4AD8A9006F2C909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.ilY
- Size 332B
- SHA256 1761d6e8d77cda523c893077a943b34a7cfbf38eff4c76a78e5af1f0047df139
- MD5 9d8eed5f0f667c5b2a1eb44872d23d69
- SHA1 6553629912ae1a8e0ba3b47c6d5b1492184bd67f
- SHA512 bfb6a3b390442af2caf297dfd5112e788ac40a37c08101cb5343fb0b198571b28f75252758002a1f9b24f5db1e96f8408cac75b028b73f5e22bbd190ce01e93c
- TLSH
  T1DCE0C054052B5CF64A010F0461760C03D38965605573160881ACB841917D715FEB9018
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/BRhtokyU6viZ.lt
- Size 10.5MB
- SHA256 7fb7665746a5f6a165b4b3a55a7c8420cca757c723bd84307d8ffe32c1a38126
- MD5 90e46dc39a741f68fe35d5fb1b60c898
- SHA1 f19b64a20af1c643386c11e4a054a866a96b3618
- SHA512 50507aeb2924fa073d728db6d94dfb79d989aa5e3b83662a61e83fde1bf659aa73bd769d4540ef12c6a56b577963e4ba64b953824b40f34120953e90a9fd0f12
- SSDEEP 196608:aJvSx2HyACFqbB4Psv7vsYi7FS4NPgFi2N/ICWbXAyNVBsqfiLID2j/uRFRsgaJo:kvFyNFq2PksYi7I4NP3WCV4uvFaIr3S8
- TLSH
  T11BB6E74A8B157B96907977B34F22943D4E540ACF9A76C9ECCF56D00E32D163903FE2A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 b1eea636026db236fd5eb7997fbad3d4894f840ce71cd0e44622ea88b4e00e76
- MD5 d1792daff77aa678cc021f2dbd1e00c0
- SHA1 a78ff741edf962e911fb6f06e9ff2a3e3da56d2c
- SHA512 88ddbabd890e2a0f66de54a173d2f763b0f52e7356dbf6c830db24561e3dd44f1b1b03a4f04aac0db5455d4a904a9d49b21cb7ce4904f4b963190f087d5fe3d9
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/Fk:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYF
- TLSH
  T15684230988C710040EBC87A97105FA7CF16C6629A3EA637965E7C6F5FD1EC662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/py3analysis.rpyb
- Size 69KB
- SHA256 120c88c01013a6c1b880b5dda96e2edc27da4b993a23820c15bb6bf7a9e7b228
- MD5 dac32bff2067f0b3acfe796f528d5ff8
- SHA1 a79aea3ad937ff57f1192a72abcf2fcb362eb19e
- SHA512 64b78b7e1fbdd591e7566e7c848cba6fc5d8a7ce329d599d7c6f467ee52b2b9ec6e20cfab76ee47c3a8446d8c8a73920f8946625e645e17edfb6c330ec4148b3
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRpY:fK4FJumM68gsjFliwugQikL3NRG
- TLSH
  T15063021A8159773BB400EEBDBAD6DC44C534F6C03ECA43A39F59B98853E4DA03656BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 6aa0851b96c284df604742e099e0e70806dae1ba54253fa6eb05a7fe7a4e3ad0
- MD5 18664f107eccd0ab2941eb0f8a23faad
- SHA1 668641e5fc4293999fc4e6a1341085a1fe726cac
- SHA512 ef575b833dc89cbe9b65e85d8baed43435b2dc9c47a94ed3f0d2acf42331d081f8cff664971d9f4aad952040e9f829194a93a706b6d8be3cb4073b935ea799e9
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKV:Z77jHIL0vBzbiE54gbyDdkqL///qHay
- TLSH
  T135C31227BA3C584858A87C5ACE819FDA06E04C0EE28FBB4B41867C9C9C1F552FB51DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  data/cache/shaders.txt
- Size 715B
- SHA256 059151d08842c9e03ead36d19db0249d6d1cf3324773c0bb5ae681046f7de6f7
- MD5 5807dfd7a14271ee2757dd5eed6193da
- SHA1 542683dd22b95c77641c480c7538acf9c791d602
- SHA512 4e88019738b291cc91622d762da9c984a3f1b87166626232cccde4c10f811a04181bb7ded0a64691bca7d1b89fb556bd14344f90c22533f9cfae55ca2ebc05eb
- TLSH
  T1EA014E4256EBD630EBA0730888F6D5CF3A4311E756CC8AEC943075E2639134A0D9D8B7
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 41aa770a32c05752a832a02435a4a0f526feeb9901772bdd43e3ceceb1f23292
- MD5 ab160b62067e0adea391288e7afed67f
- SHA1 d138e7a22ad08727f8538d5b58fa5bb044ba1378
- SHA512 c72fab70af361f3b09ad9e06ad3ef4fd59bcc62d7377ef5100bd9a8ce4e21b91c3782b25e88b800ca5806d24250f0490f4f407089080d42b878ca1c5ea34d4cd
- TLSH
  T19C31F49ED33E2F649781DDAA91706AF2CF4A1310F9FC78A8595B9770054B633604AB70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 1KB
- SHA256 0d6d0254ff491c2de3fdc94583368247df193b9427e29d046d59df1c2e4df58d
- MD5 d864fe84d61c801cd6b81ca13d5b9a02
- SHA1 6c2f1c0e739049702072593827779147d714783b
- SHA512 9e679e0dad8484268a11846d035b322b6695db540dbbb9ddb51768ddecd9bfc1e597486daccd14e2b061a153c865b0a2f5c3717ca8cc7c66ace11b0e3b1619dd
- TLSH
  T139117294DB688037734C35A2314502E28422AD3A3931DCAC06C33D2F41CAFBA2C78DA2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 90832ab1224b0cbba19469121a350fa42b2f98bb2e05bfd96fc7cabf64adad41
- MD5 afb032c4ae184595aa59097357e9fb4c
- SHA1 90919a33cf493cc49399e23ec6b6925baa0fa623
- SHA512 d2cc85913343e19715e14caa270f5e4c4fce04350a2818d9b3dc4008e3daee51915997486e4fce9e5ddaff9cb3647f0ef2dad131d44a829ef52cafba846c5409
- TLSH
  T1703174D0E246E63B119835A0E6075EE7B4410D6A78E0DD6C40C3F41B009EFBE1DB1D03
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 9f9740e7f4c9bef0b058f2f9990d00d4fb7638413b3564dee39c060fd41662c3
- MD5 220e0a0930b1650720e14aaf35e3b59d
- SHA1 f9edc5f96567529df5b4ec8bb2d5ac97b6d3ed23
- SHA512 d30d74c1b86ddcb62990e47467f67855b1198abe19a24a3901c481696ce30017740e8b569130bd7612b4a72bd2dd9c30d931652d20c8970fc94399e58a93b35b
- TLSH
  T1F13137E9933D2B609380E8EA603176E7CF1A1310BAFCB498688757B11947537A049A74
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 6KB
- SHA256 d0740709e92525e1207b85fdfb69041ae80aa23497f43662b892a3120a59e739
- MD5 37e3182fd5e3c5475e95969b8cb4bccc
- SHA1 e17e817a5b5267e544a7ac9742b8c6f822761164
- SHA512 b1494b89ca11164c78186106f18fd53bf1b9675e7230a5430a81f39d3187fa6c67c90bd85699eea99b51c96b508a7c08753a36bc596461e57f8dabfe55d05877
- SSDEEP 96:ttTlZ6i7DfbKvW2rfhcJ7vZH7z6G+WsB2llHnJaKmpm4RVbC7NtxOi8iutlR:vzR3KblGhHiG+WsElhnJ3mD3SNnt5uN
- TLSH
  T163E19E4195DCD626DBB940F089842753DEB10A3C06BE8FF19CC81D53CAB0D4B4B588E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 940B
- SHA256 8e4ba06b3a2807a2c5cef39845cceb2d8536566b783ed0a2244817d8cd61f80c
- MD5 b154e038b1710feab3659dc68c4f94d0
- SHA1 bef9ebc737ad8819a05d45884d2c3ff0215210ff
- SHA512 b194694d4d585628ac863a8a54b2789fb9e16eb4892aabdbee0b7362e9f33e765d1f68dad0fa4ffec7d21dd809b3a8a11e0673415584b12a9442de21d555ef85
- TLSH
  T1D211C8FFC934C1A89029373C0102CBF09870F11C1216958CAA6DC238BAF065AD79B1CF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 709B
- SHA256 eb7638f2a19c89b58893d1e5353f8d8b0938a8b165dc71249d418ef1be2935dc
- MD5 7427cc0e43dbb7572e195442c86de394
- SHA1 6bd95e666f289f289135d475439e3a6b9d182701
- SHA512 e6f1595caed67af413d2474516f5cbefefc83085a09a553628eed37e825034b0c1b08469c30c365acad9550726a5427d6ffda5cf69ec5238e60838f54d2ab15c
- TLSH
  T18A014961D43B64B35EBD7565DB352570B1B6740506709137006CBD3DB550CF08677771
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 1KB
- SHA256 750738ebc1f9d0a68a2daccc0548a777acdf88ffa7199a89dcd5b617c5b2e684
- MD5 fa836446f894bd645c3e9fa4e0beb9fa
- SHA1 63a3928d5a4fab6723bbdf0c04490fc68ecc699e
- SHA512 45ab2122c73711e726cc2397a73b605da613ae678689df74088d323a336f5d316497e175044b049fcbc4aa01b3c8fc3ba58eba3566ed6c561fddc7e4247ec34d
- TLSH
  T12C31A7C2E764457331450114B16A895381885CBBB534ED1854CB793F8BBBF3AAEB0F43
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32