bd450ff7fd4450c8e62e60f36cccc20efe94d90b2d0c45556d45a3c878a7cd17

Sharing

Copy URL Twitter E-mail

General

Target
Release.zip
Size 489KB
Sample260819-pgfg7saq3z
SHA256 bd450ff7fd4450c8e62e60f36cccc20efe94d90b2d0c45556d45a3c878a7cd17
MD5 b6756e0bfdde1c49e8468119b657cb0a
SHA1 b023ccc526a324a525869e72b98575e47880ddc4
SHA512 77aa596cc89569c3c1f6b10540f44df460556d3f5ea2df71a113e88ce89abf7dbc211a225f336ceebf0f71609ec37f7932ec7d2a7c7b371d96a651d692b5e9b6
SSDEEP 12288:Jc5VWaJWt2t6HXuNM4psXlkJJ0gmkLpqwHMpiZ:cwLtCN9sXlFgmknMp+
TLSH
T1AEB423281E51084CD71C17AD82EFD96F7EB1A824E4D57BAC437841C16E9AEEF05E0E36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  Application.bat
- Size 2KB
- SHA256 cde5317f0dde5e4d210218cd4b3240e29ba615c9f01ec3c522d0b6f00ff8c1d0
- MD5 2c1df4c6df108e048351b4ca36d8e80c
- SHA1 ad077ddcd6255228e70846e628d74d5412a6641a
- SHA512 f3a2e56499279697e19d0eb3eaf6b99923e92757bd8a2f51d64dde99d7a51ecbe58570377e4774e7c60329c25a5ec8cdc16f8098746880fba9d9add10b96ca3f
- MD5 SHA1 SHA512
Score

6^/10

discovery execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  config.txt
- Size 232KB
- SHA256 4b1ba932f06251267820b1af5f0a533f869e809bb9c6a1729a8097553d2f874e
- MD5 4105ba81016bb74d5326a1a4bf10faff
- SHA1 20b8b587eb744939af4005f0f6d45a95bf70dad6
- SHA512 314af74be9161a4d10faee1c7ad820ee316564d12371929ab8a48ba4dff18444ec9ab117e82cb3ff1c98255b7f512af2eaa15dce5984dc8fc04e10de6a4e304d
- SSDEEP 6144:cJeZZB0mju0p5+5pflaggUemJ8P1KARouPfFfoZ9GVcGrJZ8YFY4hy92mzW6OC:nZZB0mjvp5+fwggvP1KkoSdfoZ9IZZ8r
- TLSH
  T1193418D03A602FC156B95D46F434CE6A421F3A62AA42188E045FF6F43745BC9E91BFF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lua51.dll
- Size 592KB
- SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
- MD5 3dff7448b43fcfb4dc65e0040b0ffb88
- SHA1 583cdab08519d99f49234965ffd07688ccf52c56
- SHA512 cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
- SSDEEP 12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
- TLSH
  T162D4BF41B6C3C0F2E5E21171047AAB760E3E2D114716CCEB97E439AD8D346E0B6776EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  luajit.exe
- Size 89KB
- SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
- MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
- SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
- SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
- SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
- TLSH
  T1FC935C00F5D2D071D5B3593558B5DAB04A2EF9311F259FAB339813AA4F301C19E3AEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8