914cbc6a5f3fe0f8f7c92b868811fe6daa191e5cf54f8553af1477825ef4fbdc

Sharing

Copy URL Twitter E-mail

General

Target
siem-agent-windows.zip
Size 10.2MB
Sample260831-bhfbyavydw
SHA256 914cbc6a5f3fe0f8f7c92b868811fe6daa191e5cf54f8553af1477825ef4fbdc
MD5 a71e43727eaa8508c4b0be79f9fe7759
SHA1 4de8375381dce7b1747c2abde43ca201b1542eb9
SHA512 acd3c878799e16442c06b3b53a656e252bdcb579f32dcdddd50a95e4c1b7771f8729c4b045a14e5219b8751267f1e387833d732d964a05493edda12da787d13c
SSDEEP 196608:TJbGRnMUIzq7Nz98ybCOTWMXEpM++Jt0j8cQpR8+0mjX6BpoTEMS87RBff:TxGRycz9JbZqMX3+em8c0RImjXeCEMSy
TLSH
T1D0B633FEA4CB428ADE8A73BF4D5083147AC089BA7BB54CE73C192565146F783BE5D024
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution pyinstaller

Malware Config

Targets

- Target
  siem-agent/_internal/VCRUNTIME140.dll
- Size 116KB
- SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
- MD5 be8dbe2dc77ebe7f88f910c61aec691a
- SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
- SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
- SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
- TLSH
  T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  siem-agent/_internal/VCRUNTIME140_1.dll
- Size 48KB
- SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
- MD5 f8dfa78045620cf8a732e67d1b1eb53d
- SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
- SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
- SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
- TLSH
  T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  siem-agent/_internal/_asyncio.pyd
- Size 69KB
- SHA256 5bebeb765ab9ef045bc5515166360d6f53890d3ad6fc360c20222d61841410b6
- MD5 477dba4d6e059ea3d61fad7b6a7da10e
- SHA1 1f23549e60016eeed508a30479886331b22f7a8b
- SHA512 8119362c2793a4c5da25a63ca68aa3b144db7e4c08c80cbe8c8e7e8a875f1bd0c30e497208ce20961ddb38d3363d164b6e1651d3e030ed7b8ee5f386faf809d2
- SSDEEP 1536:VoxWFyB9uENvvAdAkc0TTILNPIasWxtISOno7Sysxg:ViWFyRNv4drc0TTILNPfsgtISOnoN
- TLSH
  T131638E83A3A0459ECD57A278D5632F67DBB1F2520A01478F62A8C14F2F6375247FE722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  siem-agent/_internal/_bz2.pyd
- Size 83KB
- SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
- MD5 5bebc32957922fe20e927d5c4637f100
- SHA1 a94ea93ee3c3d154f4f90b5c2fe072cc273376b3
- SHA512 afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6
- SSDEEP 1536:i2sz7yc51BVo1QX/FPI11IK1cDm015ssO687sjkD1ISCV087Syyxt+:dsz2c5eQXB4am05spd7MkD1ISCVzL
- TLSH
  T1D8839E92E3956AF5F81F81BD56C1036AE771B954075083EFF348C25A2F02F816DAC36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  siem-agent/_internal/_ctypes.pyd
- Size 122KB
- SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
- MD5 fb454c5e74582a805bc5e9f3da8edc7b
- SHA1 782c3fa39393112275120eaf62fc6579c36b5cf8
- SHA512 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d
- SSDEEP 3072:CXw32spTVYgFoj6N2xE9sb7VFf/EkZBq5syCtYPU9pISLPTj:CgGEOgFoj68ksTf/ENs7
- TLSH
  T138C36C0B339400AAEBA34179C8B36E07D7F1B41B175183CF1294C69A2F637A76E6E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  siem-agent/_internal/_decimal.pyd
- Size 251KB
- SHA256 b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1
- MD5 492c0c36d8ed1b6ca2117869a09214da
- SHA1 b741cae3e2c9954e726890292fa35034509ef0f6
- SHA512 b8f1c64ad94db0252d96082e73a8632412d1d73fb8095541ee423df6f00bc417a2b42c76f15d7e014e27baae0ef50311c3f768b1560db005a522373f442e4be0
- SSDEEP 6144:vnXBJvhy8AJOMg4hmRWw710z4ez9qWM53pLW1AW/ZJJJWtCk1mGc:ByJJOMiRW+10EHFpNc
- TLSH
  T11E446C17A2490CA4DE73807488979B57E7B278960360D7CF43B48AA76F573A323BE744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  siem-agent/_internal/_hashlib.pyd
- Size 64KB
- SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
- MD5 da02cefd8151ecb83f697e3bd5280775
- SHA1 1c5d0437eb7e87842fde55241a5f0ca7f0fc25e7
- SHA512 a13bc5c481730f48808905f872d92cb8729cc52cfb4d5345153ce361e7d6586603a58b964a1ebfd77dd6222b074e5dcca176eaaefecc39f75496b1f8387a2283
- SSDEEP 1536:JgHpgE4Z27b4ZWZnEmIAtISOIx7SyZUxN:i14ZeEmIAtISOIx7+
- TLSH
  T1D9538D09A69544E8C96781B8C8A35F57FAF2F1511B10A7DF0368C18D2F237C3A7BA752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  siem-agent/_internal/_lzma.pyd
- Size 156KB
- SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
- MD5 195defe58a7549117e06a57029079702
- SHA1 3795b02803ca37f399d8883d30c0aa38ad77b5f2
- SHA512 c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b
- SSDEEP 3072:Bsvkxuqgo7e2uONqG+hi+CSznfF9mNopXnmnu1ISZ1Vk:BnuFo7Jg1NYOp2uO
- TLSH
  T1ADF33992A394F0D5F6728C78D6624F17D7F6780A0320929A02CCD37D2B1FB759A2A317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  siem-agent/_internal/_multiprocessing.pyd
- Size 34KB
- SHA256 3c34031b464e7881d8f9d182f7387a86b883581fd020280ec56c1e3ec6f4cc2d
- MD5 2bd43e8973882e32c9325ef81898ae62
- SHA1 1e47b0420a2a1c1d910897a96440f1aeef5fa383
- SHA512 9d51bbd25c836f4f5d1fb9b42853476e13576126b8b521851948bdf08d53b8d4b4f66d2c8071843b01aa5631abdf13dc53c708dba195656a30f262dce30a88ca
- SSDEEP 768:W1Rp7eiajKCQnAxQ0zdudISWtl5YiSyvUAMxkEk:CRteiauAxQ0zIdISWtr7SyaxA
- TLSH
  T185F27D53E6A40856D823C9B5E8935F2AE571F7460B21C6CF2394C14E0F323426BFE79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  siem-agent/_internal/_overlapped.pyd
- Size 54KB
- SHA256 d5f89859609371393d379b5ffd98e5b552078050e8b02a8e2900fa9b4ee8ff91
- MD5 7e4553ca5c269e102eb205585cc3f6b4
- SHA1 73a60dbc7478877689c96c37107e66b574ba59c9
- SHA512 65b72bc603e633596d359089c260ee3d8093727c4781bff1ec0b81c8244af68f69ff3141424c5de12355c668ae3366b4385a0db7455486c536a13529c47b54ef
- SSDEEP 1536:Zinr44gaZPXxCJ/+yZdDDrhISXtl7SyVxy:ZXJ/+yZdDDrhISXtlM
- TLSH
  T122437C06679004D9ED37C17DE4A70E1BEBB0B1965650931F62A8C64A2F737836BAF3C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  siem-agent/_internal/_queue.pyd
- Size 31KB
- SHA256 dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173
- MD5 b7e5fbd7ef3eefff8f502290c0e2b259
- SHA1 9decba47b1cdb0d511b58c3146d81644e56e3611
- SHA512 b7568b9df191347d1a8d305bd8ddd27cbfa064121c785fa2e6afef89ec330b60cafc366be2b22409d15c9434f5e46e36c5cbfb10783523fdcac82c30360d36f7
- SSDEEP 768:xOz+R6rbVKMoNpISQUA5YiSyv86lAMxkEzc:xjgbVJoNpISQUS7SyU6dxPc
- TLSH
  T1AAE28D83AE545C56C473C97198A35E35F972B7924B0183EF2224C15E1F323837BBA769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  siem-agent/_internal/_ssl.pyd
- Size 174KB
- SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
- MD5 c87c5890039c3bdb55a8bc189256315f
- SHA1 84ef3c2678314b7f31246471b3300da65cb7e9de
- SHA512 e750dc36ae00249ed6da1c9d816f1bd7f8bc84ddea326c0cd0410dbcfb1a945aac8c130665bfacdccd1ee2b7ac097c6ff241bfc6cc39017c9d1cde205f460c44
- SSDEEP 3072:AHtmUArl7bOGLbfbmeq2wfq6XDQJsY2GvMe1ba+VRJNI7IM/H9o/PCrXuI51ISCQ:Ym5lfOGLbjBOq6XD4MejTGl
- TLSH
  T102046D47B5842EBBD813E4BAC1230913DBF1F015331257DE48D6D6460F17B4AAEAAB63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  siem-agent/_internal/_wmi.pyd
- Size 36KB
- SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
- MD5 8a9a59559c614fc2bcebb50073580c88
- SHA1 4e4ced93f2cb5fe6a33c1484a705e10a31d88c4d
- SHA512 9b17c81ff89a41307740371cb4c2f5b0cf662392296a7ab8e5a9eba75224b5d9c36a226dce92884591636c343b8238c19ef61c1fdf50cc5aa2da86b1959db413
- SSDEEP 768:9mqQhTcYv/NxO01ISCiO5YiSyvoAMxkEzef:9m7GINxO01ISCik7SyOxvef
- TLSH
  T161F28E67E7940895E93BCAB9C8965E27E971B5825B11C3CF331882590F323C1AE7E371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  _collections_abc.pyc
- Size 39KB
- SHA256 917650914aae7021671b1d69a0111a2f6da285db6e2086eef163fe3fb71f5202
- MD5 3000314b1187b1a3516bc71ecc5c7f7c
- SHA1 01c09f52467c0bd66e55e4bb718a0391e613ee1d
- SHA512 14e17ff52c9bbbdb5b661d54479adf41fa1cca92a863c55e4c841adac482ae6f0bf0be974d1613e1ce73d3bf28aa5f4c79200e5c3b2ca8f0359cd4920e043794
- SSDEEP 768:b1R3ycHW+iOnB7nejN+vk2pmsZ+nQmEyxGjj:BR3HHW+iuxnejN+vk2pmpnQmE42j
- TLSH
  T1E303A444B1F2E877FC98F3BA4626491EB32B9471F745C7631C1740A9AC2F6908D62DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  _weakrefset.pyc
- Size 11KB
- SHA256 8da0cc7e8766f257163bd409c542a12524a8f4331659f958d723f5a3fff8f5cc
- MD5 6e34f39ade20dec78f4c2128ca3aa2f2
- SHA1 cb02f29d6fcef6e6b701bd6b771bad941f06e0a5
- SHA512 9b5949de7b630d19f672f4f1c904ccedc439181c185b4b3352b96bdd19bf3ccd83c5c64d4b073d5f7177922c91dae8f6f241aa4d6e7a3c6dd91e04d71d5f0e5a
- SSDEEP 192:D088gw/TnrErQdX9qnPHpAJ6FLQnE6mr1R23vJJ1BXWo:DpvknrLNqPHp8nE6q1YJ3Wo
- TLSH
  T176324F84B1A1E8B7F899F2F64F521B0EB3268466F56CCB035627C0644D5FAE4EC518DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  abc.pyc
- Size 4KB
- SHA256 61c9491b75959161dbc1d4c74812b6519a3fb433ad10c57eaff7db4fb12ceda1
- MD5 5336fbf37d3722e2ddeaf942d815eb96
- SHA1 6d29dcf6be26e92b41dca0c621483530cb6c5812
- SHA512 873eff4f58be28f7b5f82e76f5a01fc36f7330f5c1069125b2f9fc55a0a960304f65f57645062da4b32d680d99d0e5ab2513635d6af364a725a5cecd15bcc001
- SSDEEP 96:eKwHt8qOL11WUMAGstjgq8ibZI4lZrslgRm:eKCKqODWUMjstMq8N4ltg
- TLSH
  T150A191547393E0BBFEEAF2FE0506159EA36B8A21F2095757392701A10E0F6D04DE368C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32