03aec7e0a63fca7ad548fa22dedfe3ba15dafc7c2cb816a2349d74e002051c0c

Sharing

Copy URL Twitter E-mail

General

Target
Program.zip
Size 485KB
Sample260819-phsh6atfke
SHA256 03aec7e0a63fca7ad548fa22dedfe3ba15dafc7c2cb816a2349d74e002051c0c
MD5 0158ead47af5bbf5f5fe8deb170fd58c
SHA1 b50dd0653be1576b6adfa59a1c4258cce6fb3535
SHA512 2a75023d1989298321dfa17ef253186d60b8b6de2262a51dbd71e61acef94ce1665a6b6e4dd7528abf0471597c5e11059d311b401b100cbab34d95a17adbbf53
SSDEEP 12288:02h8UZ7cUNk0BP2a5sbPLqHcU5JN04Scg/4An8bW:9pjOM2a5Aq8G304ScNAn8q
TLSH
T157B42347E0424735DCA4DD317D227DB35892ACAA2913A2E06B7D784743CD2E71DAAF28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  Application.bat
- Size 2KB
- SHA256 863259a571e3ddc1a74563165f91a1754cac19f6525ee04420deb97c025d6da6
- MD5 f0cff3c1bdda3ed210ed310c4fe4cc91
- SHA1 c96a6285143d1628fea4701583ea3da10e0954b3
- SHA512 fe4cd8365154ae3a2e27765029859c9b2bc898e5f3bc808af47a4634316732189d1e1c4f1f25ce8f06bd32a07e93318be80846c80551b5b5bfa7dc2ef38bdd70
- MD5 SHA1 SHA512
Score

6^/10

discovery execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  config.txt
- Size 232KB
- SHA256 4b1ba932f06251267820b1af5f0a533f869e809bb9c6a1729a8097553d2f874e
- MD5 4105ba81016bb74d5326a1a4bf10faff
- SHA1 20b8b587eb744939af4005f0f6d45a95bf70dad6
- SHA512 314af74be9161a4d10faee1c7ad820ee316564d12371929ab8a48ba4dff18444ec9ab117e82cb3ff1c98255b7f512af2eaa15dce5984dc8fc04e10de6a4e304d
- SSDEEP 6144:cJeZZB0mju0p5+5pflaggUemJ8P1KARouPfFfoZ9GVcGrJZ8YFY4hy92mzW6OC:nZZB0mjvp5+fwggvP1KkoSdfoZ9IZZ8r
- TLSH
  T1193418D03A602FC156B95D46F434CE6A421F3A62AA42188E045FF6F43745BC9E91BFF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lua51.dll
- Size 592KB
- SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
- MD5 3dff7448b43fcfb4dc65e0040b0ffb88
- SHA1 583cdab08519d99f49234965ffd07688ccf52c56
- SHA512 cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
- SSDEEP 12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
- TLSH
  T162D4BF41B6C3C0F2E5E21171047AAB760E3E2D114716CCEB97E439AD8D346E0B6776EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  luajit.exe
- Size 89KB
- SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
- MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
- SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
- SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
- SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
- TLSH
  T1FC935C00F5D2D071D5B3593558B5DAB04A2EF9311F259FAB339813AA4F301C19E3AEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8