687be09a8c1d1bb4c9d9fc6274bda167deeebe4e0c181025bfef7c0d270b2f3c

Sharing

Copy URL Twitter E-mail

General

Target
687be09a8c1d1bb4c9d9fc6274bda167deeebe4e0c181025bfef7c0d270b2f3c
Size 2.0MB
Sample260831-ffqgcavekf
SHA256 687be09a8c1d1bb4c9d9fc6274bda167deeebe4e0c181025bfef7c0d270b2f3c
MD5 b5edebf93e2e0fd94e60bc0d7c77a7f0
SHA1 1c675cf0b123c5f43e2af49156d829bb9b410ea4
SHA512 ffbe2cc3110a5af1b6797420eceb61c78849ec68b5f965ff97470a18d6f9a357307f3ca422e5ce88f09f061a6b108dc44a5c47cfeba6b60fc3e00b88b68ba99e
SSDEEP 49152:5vhHlliw6Z/h5K7sA87wP0kC1NM3XhWB0Y:5FOw61DSUa0k8MhM
TLSH
T1309533031AD10C66CEAA25B21673A2391F6FBD77B2B36037EB747D592160462673E703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  687be09a8c1d1bb4c9d9fc6274bda167deeebe4e0c181025bfef7c0d270b2f3c
- Size 2.0MB
- SHA256 687be09a8c1d1bb4c9d9fc6274bda167deeebe4e0c181025bfef7c0d270b2f3c
- MD5 b5edebf93e2e0fd94e60bc0d7c77a7f0
- SHA1 1c675cf0b123c5f43e2af49156d829bb9b410ea4
- SHA512 ffbe2cc3110a5af1b6797420eceb61c78849ec68b5f965ff97470a18d6f9a357307f3ca422e5ce88f09f061a6b108dc44a5c47cfeba6b60fc3e00b88b68ba99e
- SSDEEP 49152:5vhHlliw6Z/h5K7sA87wP0kC1NM3XhWB0Y:5FOw61DSUa0k8MhM
- TLSH
  T1309533031AD10C66CEAA25B21673A2391F6FBD77B2B36037EB747D592160462673E703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- TLSH
  T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/Bridges.xls
- Size 69KB
- SHA256 78fa16c0c9729c24490b6e5c4f6e5dced341dd10061eaa401fb64e060917aef7
- MD5 957d7f5457ac408a9f857bb08009a9d7
- SHA1 7471edfb40c4281b7be95501eb74571ee90aebe4
- SHA512 dc1898ac02f0aeb870b437531113b77ba077389b293d8dd9c6efafcd0ec31d5d2366150fc3e7f4da41d096ee77ee225abced24ecc89fbc057b7c372477a0cf6d
- SSDEEP 1536:zFwl73NevGeRsWNF10X3znlXWsFICWKujoo8Sv4xPrOdL:zFwlQwU0DlXjuz81PrML
- TLSH
  T1626302EA301CC858453807CB329867A24B10D16D69B167FBD7AC70D81B3C5B3AA963B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $TEMP/Claimed.xls
- Size 278KB
- SHA256 3107bbda136191b8c48993f61df185d6e9eb8686f9cf7200988a601f430c3337
- MD5 d6c8c5c7927491185eeacab6301115e5
- SHA1 84abe8eb25ef7d23ff63839b357665f7705b33e0
- SHA512 cf9b8b6f45fb18a65dc67615a10df86e2a4942e6997284d5c606d26f3197d0475166d92ec25d23c77983b3f344ef2978c72738cd55cd76cb6fa23f73e168d632
- SSDEEP 6144:1BW9qNJRoeaWW7VOi6bU8t5tKUEj9sP5wl9dNcqGkYhH:CwDRI8t54fjW8bL6H
- TLSH
  T1825423080CE5532BA97810AA162B613F56029676BEF72DF7CD6DCDD94D8583CBC4832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $TEMP/Constraint.xls
- Size 284KB
- SHA256 1c57f40d41707bd6ab62d521dd903afeeae50446211217a6df47f4a83b57f368
- MD5 77193c3aa31318fa679e8ff9c1cc9186
- SHA1 202b9cd167986a28b8ee02beacb21edf00910637
- SHA512 0214f648106b01b5770f2a66e7edbbe97d55ff5dce3cb4966e39f416666b054ed6410ced65eb197cae9b377a5cef47789d25101aed4e603e787a6239654102f6
- SSDEEP 6144:/kixpfg5td+0rpyNpuH7W9JyHJuoGei9xAG6KGOPA7D/qnANfH:Vxpg5n5HaLyHAoGeinz6KGOg/LfH
- TLSH
  T1575423674E318D24C98367A707DF74EF8F1EAF4919BB3091EE64478A8415DBF282604A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $TEMP/Moved.xls
- Size 30KB
- SHA256 ba627b57b823047f7cccf624a3f8ff3f6e584df28f29b65ed47f3f7fa6a12328
- MD5 57d732fbc63c28c9e9d5a98e10206b8a
- SHA1 7610d7ece4aba656592a0b0715fb52e896d0c725
- SHA512 156205e3eee7d07b70c5e4ef7528d1ce246729c502c4a5b3391637b9392cf4de738fb2c90045559a84be0623d8cd78580e58168914ecc2c067393cc597ca11f3
- SSDEEP 384:tCjRVc+zjfkXjD/WUyUNUEoRlktEYVZ31TSYNHCtMniJbkuBdW1a2fDr8X:QRrzYYUSE6kvPSYkiniJbkuBY1a6MX
- TLSH
  T114E21AF061ED12E76799F2A3FE9083877F71D2661432006EAE2BD9D89604C6C533573A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $TEMP/Organic.xls
- Size 164KB
- SHA256 2e8c175b9b982ecd59a9f259f80c7c3053dbc85c03852decc896d74a797651ca
- MD5 9ccb2b77c829f978ae7baa44e4a8f62b
- SHA1 6672df5992b1f354cf743b52d9a22cbfe4427aa4
- SHA512 7420a89208976e04ff9c9bcf1b5c2c82bfd12993557fa7378b1e89fffc30bdfe54fa2618c07b2010bbe491b585aebbe3feb19a9ebcc5a52f0a8fb7b5cf041c8c
- SSDEEP 3072:fYVe6mKoqIuu/4wZSsyQ5mzhZRRCokzx20Y3GEXUZ/qbJgv4pSyxHrpe:4xNa47sy04RCoG2gEEZ/EJgv2LxHr8
- TLSH
  T16BF3230396B74D9426C25DC6FC27D5084AA67DEE097301137A3B1F6AD1999E183FEC43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $TEMP/Physician.xls
- Size 133KB
- SHA256 cfb1da81f9179ba4a37865fdc5474f3fa0a0ee1b2c8ded344d770d945560aa7b
- MD5 44d8edf9af9860e17364614b56e8b604
- SHA1 4a676b07cc93177a167d191bae4c6d528886b456
- SHA512 33f6112a0fbecdbd78a2fd6245a6cf878130f88c17de94136f620ce7aeac91f5e0332de78a0a8c963a4e539b13587ff8c843608b4727937adc5a22b94c6c194b
- SSDEEP 3072:UHBg/UgQqPvqIKt5d3aEE5m8giqWqRBu7wF47uAvYHYAGMujT:qBgRK55Nwm8Odu7wDQDLv
- TLSH
  T100D3128CD25A4D9DCB7ABF41C79A273A2D9D2EB2A3D200329D5074530A1E606C7D5FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  $TEMP/Sustainable.xls
- Size 258KB
- SHA256 b638fb992aa31ecec3347007aa236f4dfd4cae583d586eb1569b6fe67d50d11c
- MD5 1c7940582406d25310327b4a77f1cbeb
- SHA1 06977aa64e006b88ab504664a1074c100e055154
- SHA512 0fda5fd49ffb6cb41a4ec854850dfb0cf8202e5ed3593ce58d2a876b060acf51b33df75f6d1fdc3cf1efbcabe057d56dcbd6e8df096b002f62cf88b5c81912ba
- SSDEEP 6144:5xe+666ADFcLFjFbkIZjUSyrkhH+tMeJmnD:57666H1FvZo3DNJmnD
- TLSH
  T1774423FF23C814514C55EAE736678E14AEEC23B3B277560AB93B9D9CB050401787BA36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $TEMP/Waiver.xls
- Size 239KB
- SHA256 2acecccacc225da6e66c1f0c444816d0c7a3d72c298b6a0fcd816ad24d214f9c
- MD5 adc475e8ebe245e51e82d0887a1a9dd2
- SHA1 299a3c015734704c2f5bd4b39deda3ff7780c57d
- SHA512 400b371041a5fa875b136363b9f85a16c0ca8f29eeaf2de39baa463e1f970f22a899c3d25a1703798e4de107518f16bada84674a10fbe4df9e1fcb6a3719ff65
- SSDEEP 6144:+PTvVkDKAlmqjM3AmBlWJEwUdwka1cOjFrIkDyo12oJLcwWMX3:+7v6KMmqjM3AmBlcEhykPOjBIkDjAkIW
- TLSH
  T15E3423B2C6725A50AF9F053AC1115DBCAE9BAC528049E88EF3D62F21356026D6F343D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20