26c33a74a39ab5b90d87585a7c358b69932f9e23618bff6cfe43ad5c13940edd

Sharing

Copy URL Twitter E-mail

General

Target
26c33a74a39ab5b90d87585a7c358b69932f9e23618bff6cfe43ad5c13940edd
Size 1.6MB
Sample260831-akd18asemc
SHA256 26c33a74a39ab5b90d87585a7c358b69932f9e23618bff6cfe43ad5c13940edd
MD5 f6040a7bf80abedfd5521340f20a036f
SHA1 857449be5fdd865f3ff88821fc24057578b577eb
SHA512 62f2d4426ebd842e8fc434015b8389a083fab9c221867fb5718a5384424b246b6196cc79b61c65ee14ee76200dd5197da0f2e96d46c97b56ab282a550b3dcdab
SSDEEP 49152:p89sHco1Vfd596Nx//f8o8jGgOfmLcr8gg+Xg+eX:p89Wcorfd5A//WjDw8gVQzX
TLSH
T1AC7533637A76F8A9D77E67A39A33B1B06071499D0AF63300C02CD48C291EB44BD7AD75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  FastCopy/FastCopy.exe
- Size 1.1MB
- SHA256 6c04c222649701d5a87ea2874735e845e2c22c4ba3dbe76af5918df858190e09
- MD5 04fffdac4124c82d2c96298a6ef7178c
- SHA1 26029462ea3b2cbe9ddc7ac7d31840b230a6f1fc
- SHA512 4580da1dfdcc122ed46815784a96b451a425095ebf577a837d99d87ef2e10023d00485f235eeb83d91a8b5bfa1179eba0a28bd2a002542738b9303f3d6b57893
- SSDEEP 24576:17MRAEc1TLFqmBi+1sYI4DchekmEaKA5VO61jZbJey:pp5dQ6M4DeVmNO0jZcy
- TLSH
  T1CD357D1177929472E5B205318DBDEBA6563C7C240B308DDBB2D46E1E1C706C2AE35BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2
- Target
  FastCopy/FastCopy64.exe
- Size 1.2MB
- SHA256 943d95c4813220b65121737f60147faacee11ccd38dc7a00ce79b782a02c1791
- MD5 2b514958c29ff8ec3ac069943d9bdb69
- SHA1 ed0ad9ba474eb8d7b6f4d38a8ed4e9c57bb84f12
- SHA512 067b998ee03b44a0a98e2d33c9f1f60165a0f81b7244499a9730e311df87d8800c74e5ce2ec9bae12a7a4c7ac23e327bdf8e50a2db7b069efea8a06c8f4d587e
- SSDEEP 12288:yGtlqIvF+/T8I1rRaGVEx07Frpw+Kn/yTg+wa+zTzdTq59LYfKBE0bVIN2M974OG:yGtlq7T8IFk4zgdm5GCNVIN24nZ8
- TLSH
  T1C0456B5163E500E8E5B7D538CDA24767EBB278120770CACF23A4564A1F37BD09E39762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral3 behavioral4
- Target
  FastCopy/FastEx11.dll
- Size 382KB
- SHA256 2c86910824a0d57febccd0b7aecae881a564ba2e774219c4fbd53692168fdfcd
- MD5 0b08f40cf062d0e232d3b98cef452df7
- SHA1 a5c1fe8e8091dc8b34b10c8038a58b58d5f16bf8
- SHA512 5779b677f29ecf137c085de7d4e82ba3d1c3da767326040923fdf1d984a2129f8a7758a8e6690a8ee7da851b2ab013c662e83ac22f76cfb7cf8d0de9b01c04c5
- SSDEEP 6144:hxn7m7fGtlqTmV0AKuCM449rG8YRFE3YuPF8snDmet8:MGtlqOB44NG8YL9kWsKP
- TLSH
  T185849E45EBB904BAD17B9538C8B38129EB723C594790DACF235486991E33FD09B3E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  FastCopy/FastEx64.dll
- Size 328KB
- SHA256 d44323d1e062de3856a8736a6e23edfa5477278d2e5ce9861bf284705e8164a5
- MD5 f40bc66e5959c2e974393660aec7d077
- SHA1 545edd3c7cfe9192e5f2cf002ea52890da77613b
- SHA512 1a73cabd9611882d2c7bc4f381c8771605e66860533a2634b80d5b19f1fe8b30e773cff8f06ba1b068584d6a46e342e608bc3134ef2a583898c9e57cc01ea5f6
- SSDEEP 6144:lUn7m7fGtlqF9cViLVf9QG5MR43ANscwPnqofte:NGtlqnf9QRBWcb
- TLSH
  T111648D51B7B514F8E1BB963CC8E39129E7F278251B90CADF035483552E63BD0AA3D362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  FastCopy/FastExt1.dll
- Size 246KB
- SHA256 bba486f6250dc127aaa210a642c30edde09ed30437fe1f2d8ccf30a3d3fd864b
- MD5 02f4cbe58c4b5cef61dbda4044037fd4
- SHA1 b943ca420501f28928a7b7f7df23572649225b3d
- SHA512 3dca64bd29669c24fe2e37e25576ae04c882ad54ae0f9e85584f80daa13e5abd092c4f3974d2eec9974a1f36500b4b9aab9781a8dead805df8c1c9c44ed0002f
- SSDEEP 3072:jIIIIW9NrBv7rdOriIt3tTkJrvGIKbsuglkrhBCyIK+yInhFepOlcrBUZtfT9:jIIIIW9Nr+ZAeIGvr3KnhFeAQBUZtr9
- TLSH
  T17534AE413AE18872E5BE4E3086F9CA35667DB9205F70C8DFB3948E281D626C167347DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery persistence
behavioral10 behavioral9
- Target
  FastCopy/doc/FastCopy_cn.chm
- Size 119KB
- SHA256 3d149a12975efa3d5c6f775f0a8b232b2bdedb87547281321c39fc54e2c3f942
- MD5 b8800d24da44f68bfef4c43be5746d8c
- SHA1 f3d6dbd0524ab35c52c6a568f3cbaac6b99d866c
- SHA512 e65d55a189de05e0aface776fd432043d3498edfcbd950a75e69a75437b85a7848d3cb72fc3f49ed4cdde254392090a47075476f5afb25d7df5c5d35eded2090
- SSDEEP 3072:n78B3SRulMjYYWiFghSCPpyxbcRy2xvFeJCPpPAFkfB:n7eYu2j3WiH88RQ/xda/FO
- TLSH
  T133C31216B819763EE15846320BBA712DB5115E4F2FDABD7B69082F403A7867E3BF0131
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Checks whether UAC is enabled

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12