8861b011c9e28dea2d8aab2102b16048298c4d3a60f0bc251d0df6725e81d91a

Sharing

Copy URL Twitter E-mail

General

Target
main.zip
Size 12KB
Sample260826-a8gr1sbd23
SHA256 8861b011c9e28dea2d8aab2102b16048298c4d3a60f0bc251d0df6725e81d91a
MD5 80518d2581dd2663be7260a097ea864b
SHA1 552cb6875ca4957c148a27302e9b8e2cc51ad387
SHA512 232231631699f49a05448a29de88089ab5492e84b2da74b8ab6bb91b4e36253eeedb8aced953f3545bcef31d32350996feed86309764840b74c5773027208bd4
SSDEEP 192:N/2kRtjO9IxzrsUgJAZUBVCTBBLBg6p2PFi/7pV9vyZGYLY50bk7jpGqK6wVNaZi:N/2kntxcAeBVCxv/T9vSm0E9VKBVNacD
TLSH
T1E542BF037A319827F0A2AE3E90F54A01522DAF27B4584BF51EB154F68F1F6F4098766E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  app.py
- Size 26KB
- SHA256 b43c6bee242f3ff2e785f28f1a92552edf1aaa9d75d8f4f84534bd2f6e867dd6
- MD5 664bae971b71db2b716139cfe45a5047
- SHA1 f94153b094c9f53555819e6ec5a8e1d724f59242
- SHA512 caf0f7e6cfc23c3872fdf705760b0f3ab8b5a7d19e4a60e7907c639c7c97fa63b6b9f3e73101ad768cb2834ef96ec0fc5d56bbdfd4ad146da071f0d6b43f4353
- SSDEEP 384:kVGWKIJdtq2RlZr7D321OsUXm+V0rcFeFdttD4h8o:kgWrPtq2RlZr7D321OsQL2r3FdTD4n
- TLSH
  T10EC28422EA0429A5A343DC6BD497B9432A1E2A17460D0879B97DA1F04F2C477C1F9FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution discovery persistence ransomware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  assets/icon.svg
- Size 745B
- SHA256 2925773e26bbfdf5c0bea1dba0bb65182385df9ce83454eb1b9dbf609d41c543
- MD5 e558d21638efa943174f84f7c079f78b
- SHA1 8cc141a5231001c5e7aaed3adde297cff9ca4192
- SHA512 46d6adea0248abf50ccb151d78f3356cd4dda3f636ce452c8d57b65be0134df3bf556ecb69888d48851c2a11ca9143b959e1890d1f1f84b5c1df7017ff6937b6
- TLSH
  T121019CEAA98C6836F511C2119F2D3232669B70F6134C80B0FCC05C7A0665ADBAC7F4DE
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral3 behavioral4
- Target
  main.py
- Size 229B
- SHA256 7b0d2c36ccb13fb29cc6c52ff8e3bd7cdf74ed0e2fec515e5dbbe7076e2e5724
- MD5 0cfea627448ebd338f4ef1c8ba8bcb7d
- SHA1 cc964604eacf1689cac37571390f3ae6dbde6938
- SHA512 3a164867a28f6da1a354e4b4f6b8061c18aeaaf5a95cc5f7d1c06d9939705c1acc7129650c68c66adfc06fb20a8d90f3fc1ccdf079ccfd060e987fa032856650
- TLSH
  T146D0A7028154A8604E97448E6CA9C04533313D131546352DB4AC869B6FA426387507EC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  proclist.py
- Size 1KB
- SHA256 32589daca774f29401d56d0080163654b60fe35d5dc6b2c2611afe372a923627
- MD5 c12f0f0f29f2619d597bff77128e88fd
- SHA1 87faa2bbf55dc50af32e55a2f4c14eca511fd850
- SHA512 71b9b6c49f85f555ea4cf8316b9bed238fc355799334e64b0a9fc05715d496cd49be165d265c777f381213d9e10df4a780da467e386d9238afd18bc478c09083
- TLSH
  T1C531BF829D8DE2D06AA36154E607D2525D6A281B07B93D3437BC43B61F1CE3EC470F65
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  scanner.py
- Size 5KB
- SHA256 60009a4e8f6d5f83e2aaecdb4b907b6c5b808d13985766873e856a0578b3f7a3
- MD5 4b6eed4ecc2b872352290aa5aa1f9de3
- SHA1 232995a3b6f00fbe6e8332855c3732e2ea426906
- SHA512 3e05f18721c2d931035d696bb087068210e2d2109595a6863d4238081964050a7215609c988c1925fb06b4a7b411a290ad6846aebc247287a62a278f6eb1d549
- SSDEEP 96:hymHI9tgeRjcdZDGAfdF37W5UuqB1pwGmt0hc7KE8m5mMpmm3ly2CFQgNTqQhmbJ:QEf+jAZCAfdFrWhqB19haRpxly26NuQM
- TLSH
  T160B10F71B8A2B894D313C91D4893F4035B6D6A13520D46A4BDBC56E0EF64171E2E8EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  target.py
- Size 864B
- SHA256 2942269c2fd81d06fad3114d089da465e11861ac5e3508ca854801291ae9dd03
- MD5 f30f1f93f87ff024b2344d27323700fe
- SHA1 a1282942b63ddf90344ed4c09b219f4118ac4037
- SHA512 28702b3ff6a6fead09c1ab129d037a2540ef47e886b05441362883dfa435bf2e03b296adf9f8b258d0611a6702d7e5fa8294b02b4470de152a15e8664a709524
- TLSH
  T1EF1189113F581731CFD240168D4584A10DB71ABB066E38A8BA7CA2B52F519BEC3D59BF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  winmem.py
- Size 7KB
- SHA256 abf47c0954cccf20df27b8cdc0feeb9f9388d7708cfd40a7e6dc0c1487fbf5fc
- MD5 63cb242e6e4613b28aaac86f96845205
- SHA1 080870d2c45215a7d74b63546a2864ca5b8d9896
- SHA512 ccca36271ffb65dbd4fce812dc0a039d066d02b287929377a9266e3e2e1a218c709acfb97d2458209c5e8a759c80e6d396bb7679c12a688ecd9132d9638224e2
- SSDEEP 192:KCetZWrzCVz7V5CDT7DFXUUfsUUfZUaT4GMZuUAH8De4LTfeqiso:NXUUfsUUfZUa5u2J
- TLSH
  T1D0E131079D8CE29467E36004DA07D4817E16354B5EBC1E3CB7ECD2B2AF2A63E8671716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14