9fa6feccbf28af91bb7d89169667a358b3e9fc6f6be6ad6ed09bf0c3f0d6314c

Sharing

Copy URL Twitter E-mail

General

Target
HM Perm Loader.rar
Size 9.4MB
Sample260827-3kab9a1gqa
SHA256 9fa6feccbf28af91bb7d89169667a358b3e9fc6f6be6ad6ed09bf0c3f0d6314c
MD5 1d31d09a0129c9f11e98214bcb3e9d32
SHA1 16ecb717b33045b4cadf6cfd7302b8d77935ac7b
SHA512 dcfc54c115bb1a0ce5457202089be960508f835deb849b180bff5d10858d335be1de97aa95a9d915875968a2b12f79c53fafb3d2f41a398fce1610bec2b761b0
SSDEEP 196608:eQpYng6AlnJCUVR9XzaEcNyy4TmKbUiBgRRaTvK75oBapEgSp/rQhGdTU:blJCUTpmEcNwikpgf75iapEgShVdTU
TLSH
T1FCA633399C97351A7AF18F06C0EE2149E3D58623793D0F61B95CE17EEB3B2E84412B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Targets

- Target
  HM Perm Loader.rar
- Size 9.4MB
- SHA256 9fa6feccbf28af91bb7d89169667a358b3e9fc6f6be6ad6ed09bf0c3f0d6314c
- MD5 1d31d09a0129c9f11e98214bcb3e9d32
- SHA1 16ecb717b33045b4cadf6cfd7302b8d77935ac7b
- SHA512 dcfc54c115bb1a0ce5457202089be960508f835deb849b180bff5d10858d335be1de97aa95a9d915875968a2b12f79c53fafb3d2f41a398fce1610bec2b761b0
- SSDEEP 196608:eQpYng6AlnJCUVR9XzaEcNyy4TmKbUiBgRRaTvK75oBapEgSp/rQhGdTU:blJCUTpmEcNwikpgf75iapEgShVdTU
- TLSH
  T1FCA633399C97351A7AF18F06C0EE2149E3D58623793D0F61B95CE17EEB3B2E84412B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  HM Perm Loader/Debug (Before Spoof)/Debug.exe
- Size 928KB
- SHA256 4fd38fce6859a66fe8fdbf6d6d0ffa6cf307e4005c0b47fa9abe14d6b9dddb09
- MD5 a4129faea3ec88b5624ca3d991a8ff05
- SHA1 83b2ac2570a5ba5def672b9cb47121375a86851d
- SHA512 9915dc6a1e7bed6236b2db81f1a569e5ad9964f6898ef62606a66a56a86e4a8e414ed36e3dc3e17f53b51affb31f8ee35a402feccef79eb251a55c49e114b336
- SSDEEP 12288:g3SA5UVFcWbXEbr9MczThKAQ1Movm8odC1nwG/penX8zoeVvEY:eV5UUEUbr7fUj1MiPenszbVvEY
- TLSH
  T15C15CF06F2D442ACC017D9788977E31BEB36B89607265BC733E855A56F934D4AF3BA00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  HM Perm Loader/Device Cleanup (AfterSpoof)/2 - DeviceCleanup[Run Admin].exe
- Size 101KB
- SHA256 51be83b9d14dd68e0293569c58159addefdccb110115e04725fa55813808e862
- MD5 e4c538c50a04c488eddb36f499812faa
- SHA1 76f35ca65e633f99855bfb2ef3469a1bf02d1ed1
- SHA512 9686c89f12575889469f9d4b784378feaceb1db118af9483b44aba5288ed09bbda7e747a5693c74678ce053b43f5acfd7dc826ca5ecf8bb3e2d98f4ea875cf30
- SSDEEP 1536:lGq1J7umgkEh32EWQ2c7dU9h3Z9h5Prm2yTOL2fCQ1/OnCw:famchgQ3xC3HnyTOKfCQ1GnCw
- TLSH
  T1B2A3D5567694C0D9D4A68871CDA1C2FFA762BC258D209B1F36E4BF5F7F322409E28712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  HM Perm Loader/Loader/Loader.exe
- Size 9.5MB
- SHA256 1ef1c3a821a1869c290eb58fdf24788495b4c90f8b6dc0174770d2757b112bc8
- MD5 bd1830bf33f4a54c6555bde08a088771
- SHA1 ba667fd54876db74838843e283a24ebe7180531e
- SHA512 fdf919b8426dff9aa51492bbb23d49f9e6af1e0cf58f6b176b0da76065f30ed163366cd51242fdb8d4dcafad7137a00f40cfd35aa2b72c21af822f8e5784b70b
- SSDEEP 196608:j2Xg7eNg1VgzeBge/y6XyxYJsvAtxfdLx9DiTd8pEyXqe7PTeRPm:y+AKBge/tXyxYJvxfdx9q6EyXqe7PF
- TLSH
  T1AAA623FD6148365CC85A8434D437DC88F2F6512E0AED96EAF2EB7BD1679A820D507F08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  HM Perm Loader/Loader/loader.config
- Size 32B
- SHA256 e185d25537c2e31666d8537417cf6aa41d38a48d5150bfe197b5ffdc80e15d7c
- MD5 e464f41f9c8cd2722a399e3aac5da564
- SHA1 4933d948072e238a2a6ef8599cd07eb5ca3f41b8
- SHA512 089a90c699a56d3acf18659be856a809f439db6f5ac1a8631cbc1b92c2fdfb1e9897ba2b56cc2aaffd918b221805f476e8119f0e1f1359980989e9b1b706fbd2
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10