4f3fb730f5839b2587bbd6681acfbe2429caa598454137f5fa403e64882d7566

Sharing

Copy URL Twitter E-mail

General

Target
Новая сжатая ZIP-папка.zip
Size 9.7MB
Sample260831-sg4rkshb49
SHA256 4f3fb730f5839b2587bbd6681acfbe2429caa598454137f5fa403e64882d7566
MD5 ed14ccd9d247f015fd13aaa0f9cef91b
SHA1 9cd65aba10953f5d0502ee147b1e8717116cadb8
SHA512 dd2cd1dd7591a6f8a2c14fd71c1102d3b7c263fd11742b68a8dc0cacaf457b28d127b51efea7b6526034a0902418937e82c36eee7850e27775c4c2e7663cadcb
SSDEEP 196608:9/9yNfDB5U7rmx3XfusmbWoJA+izVF77hrPeb8nH5DtOlKhGS/gh4Cu:91GDEXmx3XtmaiA+kV5R2b8nJ0lKZ+u
TLSH
T1E9A6338209EA0BA2784CC73E5AFEA1D6261869F55D1DD4D1F5A03C139B501BA2FCB0DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution linux

Malware Config

Targets

- Target
  Новая сжатая ZIP-папка.zip
- Size 9.7MB
- SHA256 4f3fb730f5839b2587bbd6681acfbe2429caa598454137f5fa403e64882d7566
- MD5 ed14ccd9d247f015fd13aaa0f9cef91b
- SHA1 9cd65aba10953f5d0502ee147b1e8717116cadb8
- SHA512 dd2cd1dd7591a6f8a2c14fd71c1102d3b7c263fd11742b68a8dc0cacaf457b28d127b51efea7b6526034a0902418937e82c36eee7850e27775c4c2e7663cadcb
- SSDEEP 196608:9/9yNfDB5U7rmx3XfusmbWoJA+izVF77hrPeb8nH5DtOlKhGS/gh4Cu:91GDEXmx3XtmaiA+kV5R2b8nJ0lKZ+u
- TLSH
  T1E9A6338209EA0BA2784CC73E5AFEA1D6261869F55D1DD4D1F5A03C139B501BA2FCB0DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Installer-1.0.9 (1).exe
- Size 9.8MB
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
- MD5 f3c25a3f9f0298df7f616425569f29eb
- SHA1 3b104a986f9b54b5afad33a1e2dd6e11126cdcfa
- SHA512 467cd145d72728f79c130a337562b9d6a8f426a3b631a19a773071309783b560db7226bcf519cdfda1a84598ca21e52f4769f05c0e6ec254ab691bb35109e807
- SSDEEP 196608:okEbIPQNfiDq3tdrsGj4CH4k4TL1JNRX/XURvSyGZ1GihcwFNdjO6:tY1wW3tOGcm4kGLDNtkRvAEip/
- TLSH
  T187A633C355F90AF2F06EC23D4EEA5181D736B8B62715C6C3A2A018335F226F45E6B197
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
behavioral3 behavioral4
- Target
  [paste-co.de] madium patcher.py
- Size 5KB
- SHA256 8d98befb355d7cdceeac0375d4a1d294db3c4d7565ef4162b9d31ed79b6a8e2c
- MD5 2352d068a3c2565420b821ae74f49a97
- SHA1 006c33aee743e9b90f96e1525c87e016fa1d52a5
- SHA512 755d61a55a63cee5b7b7f7cf54d24f08634153cc1467b165aac5b48958a49d787fc24a0a98bdebacf1bf2188cc7475a2d3469abaefecee739828d8a01359818e
- SSDEEP 96:QsHaoARgFhpn65d6PvjVB/fMqpDUrUpqanRElnoU0VDL6EBpH2pfIqwBrQzfckml:Q5XQPMGv5dUqdoUpqaRKnB0VDL6EXRqk
- TLSH
  T1C8B1851699B154E0E7C3A1EA495944197AABF91B7310D271B8EC8FAC2F9C438D2709F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Process spawned unexpected child process

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8