a3570d71fc3ff21913cf67d53e994a09e4aa1e01dd450b3db049920f2821a7c5

General

Target
Oaken.zip
Size 88.5MB
Sample260827-mnajestalf
SHA256 a3570d71fc3ff21913cf67d53e994a09e4aa1e01dd450b3db049920f2821a7c5
MD5 91e02c750f546ba53bb86e8649b0fd86
SHA1 d8b104dd46deff48c52c488bbec8cafefcc47b8d
SHA512 04f0e50095349f4f8e0ca59d701ae701423747193c2778b5a1fb86b971b1755c0e334ff618127c696b229757d9b5510798ac072a216fe41e1ac1d1c2ce2d6498
SSDEEP 1572864:UpuQbwvt8k6crazFsVDgUTryRDo+khLxrqeZtrAkOWMgUib4VTFxb+w2B:Upu2Gt8ZJIDgUTgo+KxrjroWM7Trb+/B
TLSH
T1BC1833D9E0E112FCBF1F61F896FF2F073AF2249E8622194D9945E7DA5154AC3C4AE201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Oaken.zip
- Size 88.5MB
- SHA256 a3570d71fc3ff21913cf67d53e994a09e4aa1e01dd450b3db049920f2821a7c5
- MD5 91e02c750f546ba53bb86e8649b0fd86
- SHA1 d8b104dd46deff48c52c488bbec8cafefcc47b8d
- SHA512 04f0e50095349f4f8e0ca59d701ae701423747193c2778b5a1fb86b971b1755c0e334ff618127c696b229757d9b5510798ac072a216fe41e1ac1d1c2ce2d6498
- SSDEEP 1572864:UpuQbwvt8k6crazFsVDgUTryRDo+khLxrqeZtrAkOWMgUib4VTFxb+w2B:Upu2Gt8ZJIDgUTgo+KxrjroWM7Trb+/B
- TLSH
  T1BC1833D9E0E112FCBF1F61F896FF2F073AF2249E8622194D9945E7DA5154AC3C4AE201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Oaken.exe
- Size 65.1MB
- SHA256 778d4008e992ce0e1cf38c9df6634335b4d822bd0c79f61302040ae3fb123b4b
- MD5 c38f209e4c25b1a3eaa998c8072ed3a3
- SHA1 676f3be1eadfb11f46752dc5011d5291d799ca67
- SHA512 e9913cf82f9296e445530870c444dc93b1728e93fab168875b8bbe36fbf8e16720a7e41ff1466d2403f66dd0ecdfb75c32fd78bbadd7ac0e6cdf136aa859dbbd
- SSDEEP 1572864:F+Fpq3Ya60BkEMNHq//DzbUkOHqfoidi/XMBG7deHdBP:YFva60BkqjzbRO+MvMYxeHdN
- TLSH
  T1DFE72356E2F900E8E57BD0B8C6571617E7B23459173097EB62648A692F33FE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral2
- Target
  OakenUpdater.exe
- Size 33.5MB
- SHA256 eb405852f5e03809ea9154fd6da1f75e9684ac6d68b0520b8c71323dca3bcc46
- MD5 a0bc4f9ed43239697ad88ee1d2db01f2
- SHA1 f2dca1fd919b27be94bd7fffead2ac789bffac32
- SHA512 3c71546fd5c493ea58cd88bd45aedcb9bd5cc805eead1cc71614d81adf6d40e018a9a16feeb0278f0aa7ee334faa7363237f7d48c59fb6f6da0f62d01fa24053
- SSDEEP 786432:CIPnSpq36471sb0BkpyMNHZS100C+//DzGheULQY:CiSpq36a60BkEMNHq//DzbUkY
- TLSH
  T17B771256E2F900E8E57AC0B8C6575617E7B2345917309BEF52A48A692F33FE06E3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  bootstrapperversion.txt
- Size 6B
- SHA256 be695fc8092ad3706d7d7d3b5104e1eaf8fe69666e5958e375c9952a06fa9514
- MD5 f4d35e9ae17c46f078fe63b9e86ec6df
- SHA1 f993f873300343a57c72ba514c06e41d922e43c1
- SHA512 7e9921073dadddea08f3240701ef4a3199f6f0f97f55b55d6fe3dd7333512048e7795eeb0c2fb4012ca915fce4de660366cf750823a4d97e0aca0a1f0a7a64ea
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral4