388ba6e8f4efce83415ce0293fcc9e358705a1c3fd3e8ae851c06f9a2cea85cb

Sharing

Copy URL Twitter E-mail

General

Target
G-Earth.windows-x64.zip
Size 94.5MB
Sample260822-ccrnfszfpb
SHA256 388ba6e8f4efce83415ce0293fcc9e358705a1c3fd3e8ae851c06f9a2cea85cb
MD5 68f731966bfbbbe9378fd15fc31ee2d8
SHA1 9c88a9f4c0d371ba37b69c69d6ccca89677edcb3
SHA512 b25a5b4847f047077b0842befeb261b2242b55135bf583ea44f531f217e63c0f99b870d9baa13a8c1b40d6110cf122e5a3d9611e7eb4096b38698a95fb1a1cbc
SSDEEP 1572864:VmucoiZvx3tbbcXEuvC0GrIgrABu2SFbw6nxh+HzsU8h92SXyAH/beQRn2APbRxv:VuZvx3t3cdjHhBRSFk6OzNY92SCAfK0l
TLSH
T1AA2833FD74666BC9E41BF231F081BB670187506395629CF2AF2D61872BC72DE213858E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  G-Earth.exe
- Size 3.1MB
- SHA256 9d129201d47bdf5a5f2672446f718608fd13959d258fc254bcf670a2262a2a23
- MD5 eb8b0188d4d1888485e7a2298edc5350
- SHA1 72ca5695dcf9290478f70f15c9f4680096b27046
- SHA512 ba6e75e7fa4bd9571ac31ae86443ed4fa5082353867093ed36efc71fb7e8eeeb208b2b419848f4bf88553f9cf8229d121fa89164b1e96d47b74e6fa6c18bcf1c
- SSDEEP 98304:LniP0WPXCLNwmqEJZaY7r14VOY7r14E3L:DiMOk97SfrL
- TLSH
  T12EE52352BF8A01FFC67B9038D552A713FE2E424578C23D887BF8693125A19AD373A345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  G-MemZ-x32.exe
- Size 224KB
- SHA256 63a9af5b4ec167c8699b80ec7e02bfce288c84b307a990b256eaf47d976f8a02
- MD5 d6ce316aa73616f2a3f391aad601b38a
- SHA1 6daf7f7be7ec27d605af235ed3943d41c37383f2
- SHA512 c0b8bfa0212ee0e12f70372c51ed4a34726567544fbee80cbd92d797f7843d026693210719ebf251126a9bc08405328f1d9ef3aa9573ed487ed4555d22594342
- SSDEEP 6144:93fqBJxlg5N5zapTTmGDLq0IqEQqkBFQT8lhT1+l:9Crg4TTpEQqknxlxol
- TLSH
  T113247D06F68399AAC872357221CFF13ED524591807269DF7DADA1DC96B37BC302B7902
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  G-MemZ-x64.exe
- Size 184KB
- SHA256 ea413ab3dc7418cb60649390bec7bb4e84d41824bbbd20d14dd5574520fbf824
- MD5 2dc5cafa589e0d60da716de9e23d53a8
- SHA1 ec9dbc57cdc67dfd8baf60a200bdb680633f667a
- SHA512 6c798ab0a66dee7673c54345b142c2a027315ef62738dbacd429b4056dccecbea4fbea253e859b18acf6fd65eb811d8da9fa9100cbda0a5a6f53bbaf88cf01ac
- SSDEEP 3072:ZrmCibBCuZe6uHZcjTXSXpG39tI/E8gIegj/Bavea2rDxS3N:eblZe622jTXSXCtI/dgIegj/BamLs3N
- TLSH
  T10C046B87B0A2DABDD4334036168A7966B533BC48132098F712E67FBD2837DD25AB3571
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  libs/G-Wasm-Minimal-1.0.4.jar
- Size 122KB
- SHA256 57519e89a105b81bda44d92af44e0debd9ec638ba7f4ec7dce5b6e910f11c207
- MD5 ca516fb984fec48a75f7733f4ef907f4
- SHA1 d4bdefd5650996b55d6cd0a6e5dcf8b4d0d4356d
- SHA512 edb45aab5f1256956a8e2200e227eec9e8ea4e057f4637e890058ec1bee228e5618bf4b5340a6ffef2f867a1efa23e2121b0d6193fce0b333df3b25b0f46bad2
- SSDEEP 1536:bVfi8L4dAO6YQJ4fP4QioYPCj+Vehi2lYoyRNK0ypW8yDu9jND9sZ9Fn/XjIThA:bM8BwDfgAYPCj+VeRlXyM5XND+rlX1
- TLSH
  T1CAC38D2071B0A657EB17D033B583A746293D82AD644E262A38BC94D3693719D235FF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  libs/bcpkix-jdk18on-1.84.jar
- Size 1.1MB
- SHA256 c87f16ed9e5ec61bc94151e9f3646ac44e50cd448121ce84367fa4b7ec7ec1bb
- MD5 49dec53975e3a6d23d7e3979551ce3c3
- SHA1 dab889a3259e27caec6e6c2f3bde94af036b2fcc
- SHA512 01644d7e0c6041ea8c8629f6ad73f7206efa2797d954da1507dd43c5d262a161194ed84e960234cf5c53787033f1181aa4965e0d6ebfe82ca040de13ca307565
- SSDEEP 24576:vARZM/h0Hwo8Bm13dOchOpao+SdHtNjhRWbKK:vARCHsOpYSdN/WKK
- TLSH
  T12E45C025FDC2C86EE193C63B4D46EAD7FD2A41AC8284DA3305D1068B95E5E4D8313BDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libs/bcprov-jdk18on-1.84.jar
- Size 8.5MB
- SHA256 64d6c5a6121fcd927152dd182cbed39afe0fda641a970d9bcc0c9cb1858b2731
- MD5 19523b0cbcbce2fdeb98e3eaf68f602e
- SHA1 2d5651789941d2f8ae9b8771f23356de6b61e96b
- SHA512 4b7e5696830023bad1594d9f9766898f78018ec7d6ec34de23f2a6683b02803b92ffe8ab5d21f1a717eb4fafa8e22dcf3a4b6dd275bd86c7cb02609987fe92f5
- SSDEEP 196608:DwIg4/BAQBMuR5CxOk17BO0JDoxaW0veN5b9cXul/fZpLbcK:35R5CxlXO0JDiZGe1f3H
- TLSH
  T1FD96D012FDC2C46FD193D9362E82D9E7FC3A91AC9249DB2706D00256D9E8E4D8B527CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  libs/bctls-jdk18on-1.84.jar
- Size 1.4MB
- SHA256 a0591da70ced0f637f1b7e2df431dd91c3cb7c8511e6f75267e7850b2e293ccc
- MD5 bae78a3e7d71528d85ac0304df4f5dda
- SHA1 b70a9bcd45e26e24ba62656b2f78760ad5427fda
- SHA512 bd5d92fe43216ce03d7217ff9a488bb8356f97829bc7fc299359dd262362b2aa7345290b7f059d3a48ebabd37d410597a17fd9dabecc12339816930373065ca2
- SSDEEP 24576:u9GM5uAxveeqjqXoKtDtgaMAbmzPk6LlZgSTY7ZRueb/B0T:7EuAxveDuXoKPby8YSD/Bo
- TLSH
  T18965CF21FDC1D02EF1A3C57E4D65E5EBFE3A426CA1C99B3306D1462289D9E4D8A127CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  libs/bcutil-jdk18on-1.84.jar
- Size 690KB
- SHA256 b374e16963421fb9cfb01cc20d7ad8fd2f8b8188e3eef0ec0a8965e245f7619a
- MD5 7389259785516495923c3a1480cd87eb
- SHA1 79bfd1f9c6bd7431ff22e29935ec20f12f0af0d3
- SHA512 e001b244723fb3c4d1e06862bb857512015a92d7e18650ae3447a3d258274ec8ed37b8cba958397b00f8dd73463943e9a9489dd5dbddbe24b24cd6fae5ca8a62
- SSDEEP 12288:Qbx4jImnqWQgqO+NWEz0IfqSYnbs2q78rCf/4Q9x3KR6VH+E:wx4sSQnBJEbjq/H4QcQV
- TLSH
  T1D0E49D16EE87C4BFF0E3C4364986D2C7FC3A86AD5294E96305D0469AD4E9A4E4703BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  libs/brotli4j-1.18.0.jar
- Size 44KB
- SHA256 0cab5c97314362a1d0d59206eb79ace72363ceac029f5e932acec6ce6bb23db8
- MD5 66a6a4083a3a7675d8ebba13c4177e0f
- SHA1 7432f4b2837bfa4e33d325dacb0e9c63acbfdad8
- SHA512 95df27610d80b30fc58356ec11feae92f973e2d915f8338fe76b76422ea298904c26a0eee7eb1ebeddf9e0a7a42c573eb6dba6e45f62be4b0d6b511a211e4f0b
- SSDEEP 768:/A5uXo9rG2AhFeOZtTKVCWqfrZIp0CUeau6/a3sn823P1QkN7s+1Flyf1ZJDgUEy:oxpJAhFeOZd85YIpDQu6Gs82fmkf1Flo
- TLSH
  T125237E952C8C6C2DCC1A4A39C127985E273C1C27844C6739AD757FC9AEAB6FCE14839D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  libs/commons-io-2.22.0.jar
- Size 594KB
- SHA256 2b9a7b1f726fb86216dbd2c8321eabe0221dbd5b1be81c18e1cb53811b104758
- MD5 f91d54bd47c42456b4a5ae62eed85565
- SHA1 5b1e18bc0ad651ed878029d83f88d9c8189fd51e
- SHA512 fca0b4ae70e531bee74413e0b865981aa8b60a9390f789b63997203dae67be65362e95a0c35b9d4b072fbb0810114783415dd22b92fb42e5594b10992f632bc5
- SSDEEP 12288:7bPRVlzQrrMZRjs9HzwkgJAcbm1efA8hmc7QxvMrDy:X5fQrVzwkgJP5bQa6
- TLSH
  T120D4BF56FED0809DF20382717497D5AA693B8BC8D68394CF12DCDF8B98A1C051B93BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  libs/encoder-1.4.0.jar
- Size 40KB
- SHA256 90f9860925905dd97f313cffae065835eb02acc3e2e9b0051621693efd09025c
- MD5 d26a36885af1fd62e8a3c18ec51ed39c
- SHA1 41560c4db1cae2290402eee6ea0db544e8d48b7f
- SHA512 7a5ac008d4270c23bd3c7c52aeeed39abc2af5258d5e70659110013e0c4c0bf59e209d4507501892a6876ac69934a9e35c96511a7e84d37c69eb658988b57075
- SSDEEP 768:aFgW27Yg8q7OVa50ECeEiSi5p5zFOoLfuUzaPwugNJDLigL:KU7p8q7OpiXLOobVzxPJDLZ
- TLSH
  T1C713AE5CBDD0A10DFE4371755163ED5B393C44A8A8C8F30A1DB22B91DA08E895B4BBDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  libs/flowless-0.7.4.jar
- Size 65KB
- SHA256 42b31ec6cbf10e6c779e5d9c4a76f357c5e47dad38e405c9a9ca1a5fb1dea5b4
- MD5 438104dce14e51281dada6ad44820eb1
- SHA1 2d4c44c78a5180752a70ed3d26dd1915d99325c4
- SHA512 6d2ca44a7dc4bd92ea45d66f0da821bc73f67024f02049fc96109d3e432c1153c958f35aff427a41f2d423cb9d1e1679852d57675cb9b8e7523934d965287200
- SSDEEP 1536:4os3UIinVRjnTKaNeAWCc8gmuka9tZ3VAVznS5jBCD:HqwTTKMeAVgh9DFAVzS5jQD
- TLSH
  T15063BE5A778B4034F5C7A5395282CA37FD60455E514BE02F2374758E6BFAC8A03E33AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  libs/httpclient5-5.6.1.jar
- Size 1.0MB
- SHA256 1e3d8444c3c27772e4b9d42a790f06b3345a8ece4fd16d00981f2f2460e1e772
- MD5 ab01ab53ec62de3b50ed071dcaba3bfd
- SHA1 b418ba210ace28adf920f1decf64d673953d07cf
- SHA512 2835c56a960c5c926cdd69183d55f9bf84fe3a076247ada8b5849374ac85fafbe39551441eac66f3d7f45652531a9b5beee33dbbd59ae216039d2970d49df772
- SSDEEP 24576:CS7KsrirxdncKrrabuUfFZAyoScOdCduzUkp:R7hrSxnoZXwduzUS
- TLSH
  T13225C0AAD594A036D6735372F05296B6E87E7088D44BF059F4FC065BAC73089EB1F388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  libs/httpcore5-5.4.jar
- Size 930KB
- SHA256 cec2981fa7f520efb63f0787c24f10af2679e31f9f75c448c4dde40a3ae8100d
- MD5 584964cc15b7390de975e97e8eb2e6e1
- SHA1 e40011ec0dae056466399f8e414ede4772001621
- SHA512 5d0dc9ea175373a6bbf76e48246bb3f4d3c43a4ca1cc4db0a10970736a30d3fd72996cce5fe07d675eabb0cad4da1e2fd6b3100d31e7d9d4507c617fc1bbe425
- SSDEEP 24576:83Sz30oBI69q5THDAD/RNvfbAWtduHQfN/qg:O+0Z69q5Tc/AcdgQfNyg
- TLSH
  T11C15B05ED4949027E6A35231B4465BB6EC3E4048D48BB0E9F8FC5BC3E8734D57A0B7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  libs/httpcore5-h2-5.4.jar
- Size 257KB
- SHA256 2e0f4ace15db2d1609c2b06eca6012e7582afe4a99ad8d15073f62dd8edb3460
- MD5 a027e88d219ee744ddcdb32ed1e69633
- SHA1 83cdd62ef3140664f46be59c2c2727141d1c5a32
- SHA512 d9fed54460b52b68fc91502b1e7a0723cd97740455574b101929d6c77818f81340077fed7748a2b76a6d95e2dda711717caecf72f0f4d6331736fbad88ae66af
- SSDEEP 6144:dg3ArMbRnDNDpn393P4Zyo1zWnLnq6mAMQcRn3dGW:uAIbRnDNDp3u15lAMQch3R
- TLSH
  T16444C05AD4545213D6A75230F4A216B2EDBE40C8E48BB0DDDEFC66C3E8338957A0F798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  libs/jkeymaster-1.3.jar
- Size 47KB
- SHA256 0e5a2244770ce7ff44864db0c3d08b52934591a048f662e95e16c71418f769a5
- MD5 d13de8ae4a9da9f519623c7385230fb1
- SHA1 5baef090c16f3f3a1ef642537a7d338121cca022
- SHA512 1946c1350da9d34147efb4a49b25f0ddf50155c45f6c94c6d2ee8e0d8f89080d03882a5fcd1a24256cbf9896dc82af3c8e7605b33fd72b17523fed0c12cbfde8
- SSDEEP 768:5tUrqwmylczWy41vNn7QWhHWWzEF2P97E8c89XJD1npTd4:5Kr3mQYWy4dFQfWzEUP9wz89XBtpZ4
- TLSH
  T16223AE7F634F0E39DE2B71F766148722F8396BF4A759614E089E14B1ABB3E49430112B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32