9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb

Sharing

Copy URL Twitter E-mail

General

Target
Software.zip
Size 349KB
Sample260825-wv78psxcqa
SHA256 9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb
MD5 3aab4c9294c7abe63bb278102938ba7e
SHA1 4f3fbe9a1c37aa0ee7ed4d4a2feb4e1af7dffa81
SHA512 30674520a27a5ac2ebb2904d874dd6df2bd57798bf0a59327e0babf601eddc6b96fa00898f2aabe93f989b8b96eda9c5792d846c43ca9c64d7a76ae2acd6f5f4
SSDEEP 6144:euUPsgJV8ZHLO2Y1RZbDGFIPMKseQnJ16DXbfEnmZ3J51ewxGyWPfg7lCfYasoP0:D+38ZpY1PDGmPWerrEnm1x5mvQu0
TLSH
T1447423135C7F1B06CA4439729DFE6CD84392BB88E63E670A660877DB101E54A3E1F6A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  Launch.bat
- Size 49B
- SHA256 9c5c562b5f7c10882141a505728a6d9fe36ccd5c4fef5099a74f11bcb7f71284
- MD5 144f19dcd29f6bef334db29b75c4586a
- SHA1 e4f7cbc5b41cfa9ae658e09e2edea5cc36598832
- SHA512 bccf576256dfc8e721ff445408726d4e5d651de755a12f53590d94f218188e4221336c8126b773e0c6635bf908010de5553b12430c8ca11a66ca1707239ab78f
- MD5 SHA1 SHA512
Score

6^/10

discovery execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  lua51.dll
- Size 413KB
- SHA256 012e772e3c72c5f500aab86e78e99afff222bdc8d914bc32bb244ade03d5a486
- MD5 2f0394640486f2ac8dfb23ee05f904a9
- SHA1 63b5af9791a1feebafd0be67f2a33391025bc887
- SHA512 af1c033162b75b4fbd28fc8ea33f264aab116dab0054ee6beaf899b23eac65aaf0303825f9e133ba7645f2f9421d5586a841e34e14c196c2c0b7e74e43821b05
- SSDEEP 6144:rQfFVKb26ouykP5eNASsJtQ9Se0mTdXyR/XcL3UL106wDo9ZOF+63DGl/jQI1L:rsF8b26XyvNAHJW9hXdXu/ML3UGyl/0M
- TLSH
  T1EB946CC169C744F6D19755B094ABAFBF8A358E024025C8F9E5E8FD1DED33B82142721E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  luajit.exe
- Size 24KB
- SHA256 30f7bd2e98df2ec3405f3ab4aab5be8f0dc1d9ac638286edf390c4ddb74b4316
- MD5 e1bae2b33bbcf7d1dad46f57fe537141
- SHA1 56cf50befe699b038df8c4a0379a11a904e22401
- SHA512 d4e8e72a850b4aa1f5709dadcbe649fd3dc7973cadb8aa158c3396b9ed03c24e49cf5d1c8823cb2d7234389fe1fa13c6bc29174a5e46e6f4cc4995a9ca065b52
- SSDEEP 384:aru40kZ6Ctgp4t2bW+J3Y5C+0mnoTIhNjgiKM0/Ik4ACDdXH6:aqtkZ6Ct4FW+J3GC+znyEAE6
- TLSH
  T1B9B2C6A97C8A7CFFF4965278D8E1027ED27F99830B22447ACB68DA34D5B73F5445A002
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  userdata.txt
- Size 234KB
- SHA256 0ed8e43a9b0bbb8754ec1ce195e07f6af5e5363ab039cda32413746a3e772fa8
- MD5 3900f59be2ef3852fac16940e172ee3f
- SHA1 2a2ef9cd83bdb635bb3da2fe6b6a42c9b0cc657f
- SHA512 b33e2592e36af6bc2052f66e82fc3a4175b9d098429e466d6ee01994d2eda37af6c3a3a107dec2862f1d01ca642910b427807d60cd7c5a020ec1653260a64862
- SSDEEP 3072:ln2pz/MckiU+RVaHWO/AHPby1AgPpjA3DKK2vGGLgMyx7vg5bqFjf62YnuviW:ln2ZMc9S/uEZx03gvGmOkqFb623
- TLSH
  T1133429F2356021C1196FEF86D4629C18A11F3BB2D943398E401DF6F83BD85DAE91693B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8