ba42bdad2501519c6132ca293e6f11a5d719a635390394e32c88bea7860b0b06

General

Target
Madium Executor.zip
Size 5.4MB
Sample260822-e9qhrsvydw
SHA256 ba42bdad2501519c6132ca293e6f11a5d719a635390394e32c88bea7860b0b06
MD5 661e9c4454ce4c0a8358fddf31403307
SHA1 362db334928c2faafa30841e0b9760af175133a0
SHA512 0abb173cf86068d1c6b3852a6c7a578ef0a4d6d43be70b713e247be0e737b07952e388ce277f9eea804656e6f31fc675240128277d9b704caae37d6ce2a62059
SSDEEP 98304:MclUKfpyt9+wBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzx+:M3+Y2w/tyd3w++lz0by+
TLSH
T1A846022BF38B647DE06A56366AB29210953B7D116A128C4797ECF44CDF321B01E3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Madium Executor.zip
- Size 5.4MB
- SHA256 ba42bdad2501519c6132ca293e6f11a5d719a635390394e32c88bea7860b0b06
- MD5 661e9c4454ce4c0a8358fddf31403307
- SHA1 362db334928c2faafa30841e0b9760af175133a0
- SHA512 0abb173cf86068d1c6b3852a6c7a578ef0a4d6d43be70b713e247be0e737b07952e388ce277f9eea804656e6f31fc675240128277d9b704caae37d6ce2a62059
- SSDEEP 98304:MclUKfpyt9+wBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzx+:M3+Y2w/tyd3w++lz0by+
- TLSH
  T1A846022BF38B647DE06A56366AB29210953B7D116A128C4797ECF44CDF321B01E3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  .Store
- Size 3.4MB
- SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
- MD5 15596b41dba42cdcce4f677fbbc86b6e
- SHA1 1ed1e69e72028150f8562bff5ca1dd745874329a
- SHA512 d4e0d64f71027ecc6d85479542ed682359b37446cb1dccce5fa2972f152e27f3cb91a8ec0dc61270bc40038751a58982d4678efb929a3bc6d3546e072f51a9f2
- SSDEEP 98304:HwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxm:Hw/tyd3w++lz0bym
- TLSH
  T1CDF5234AF7951CF4E5A3E2758AA1450BE3737C563B3093CF2760566A2F232915E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation trojan
- Downloads MZ/PE file
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral2
- Target
  Madium Executor.exe
- Size 2.0MB
- SHA256 2e7b712c81f660c1cbac176d0824ff8655676d6c874e39f4d2cd4393e53811d8
- MD5 1d63b067ce8ff8fd0476f434508e77cb
- SHA1 8b7d9db8b3fd014dbf72cefb5a5caa9956dc3a4d
- SHA512 89ba5d0639c63a0d5fbddb9c2c9e939a925066ea55a72b5517d2aff391cbd6301264ab844fe1d986d1530612d554859269d41adb3f3efcc63c5b1d866275b2a3
- SSDEEP 24576:iXfPki0RBC19GXIVdIIPSgJXpJehyxwKlvdXgKfpXrbEL10B+kM/PfcXmH1bmBXa:wobMzB2+TwKfpbR+/T1bmBXfqZ
- TLSH
  T169A5C03BF28BA13EE06E1A367A72A210553BBA1165164C1696FCF84CCF355701E3F687
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3