4f0583cca711cd9c4b3e3aafc1b580762e655d83776e02ea362eb3d0257d3a28

Sharing

Copy URL Twitter E-mail

General

Target
docusign%20%282%29.zip
Size 16.2MB
Sample260905-pm6atacl3s
SHA256 4f0583cca711cd9c4b3e3aafc1b580762e655d83776e02ea362eb3d0257d3a28
MD5 e03a2456cbdc977cd161ddb061282531
SHA1 4494e6c20d334c813fcceb9c97d108d4a7478c50
SHA512 d77e816b67fe87c8521d139cfa1f6dfe131db13dddd744d47e0540029274a3cdb22465cc170948d0e2bd56b6db773dd1212686d06cef6900811cc85d73991837
SSDEEP 393216:ktGV/h/Cfi0HPAlAQEJR5U6rrXGWbR/OoswE+cDfeMnsewDZG:ktK/N6DPAlAjRRrrDRV4TDf1nsewDk
TLSH
T150073327F7A2E571C337AF5B91B486C720B6808E25C1E456B48863341D4F9F28AB1BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  docusign/Device-error.php
- Size 4KB
- SHA256 b360638546fc327ca2213bb62dff67427387020b9199020f27713e00e442902c
- MD5 398016d77f56bbef8d343267a0fea3a6
- SHA1 4b1c12d832af07c2cdaeb998ed031e4812670a0d
- SHA512 871ce62a78f5a8a09cadabe6a7d98ef4794c7e1a20a95c55b36937db88f7ba53b1c35d3ea0e70c6708e96d3bcd6223278333cf69a34356663054fee39807d27e
- SSDEEP 96:tFEHHWF12yfbYup5NadqYyJW6W/IC8vCc:tF8QbfbYk5wqYyJW6WgdCc
- TLSH
  T126A1521B16F35021792360922BF677077BA1D453C44EDE693ACC128CCF866E599A3F6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  docusign/Mac/download/docusign.dmg
- Size 5.6MB
- SHA256 128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e
- MD5 7b7733a794dcc45e8d146e1f6439b588
- SHA1 4f1d6b1618064109e363379170038d3543a96e7b
- SHA512 ecc577f6eb64004f84270e8112a2a0a05c13ac996f64d40e62f34aedd5d4ed150807f738cb812131683ffc562bf8af6bec2db9882bbaf2f3804cc2f5c464dfcb
- SSDEEP 98304:REDn3B/RLIrAZWRK6/yuosCPY9bpXC7zv0MwbhnElihP2ljbly12uLow:ORZL9Hvy9bRCHv8ElsP25bgnLo
- TLSH
  T1FB4633FFCEFD5A54E8270BB5800990878E7AD45F7A66C471F4850BD2B88E1EBD990132
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  FleetDeck Agent Installer/FleetDeck Agent Installer.pkg
- Size 5.2MB
- SHA256 e460d2866a36e72f51c4e0a3213e5d465ffcf44ca475b0c3978aa1c40ed49c2a
- MD5 f107d639f0c879cb0324dcf316559cc3
- SHA1 723b7752f63796290da0e4f3d059e86d6e8da904
- SHA512 b6842b5557bfefd42917817e534450ad466f248d4afd9dcc38c539d03083b7fd8dc9a25c58727e7d3de202189818ed2ef1f70de2832a44c2c0614b9771558c48
- SSDEEP 98304:bEDn3B/RLIrAZWRK6/yuosCPY9bpXC7zv0MwbhnElihP2ljblyhMi:QRZL9Hvy9bRCHv8ElsP25bgX
- TLSH
  T1BF4633CFCEFD5A24E5274FB68018D1878E36D41A76A6D071F4881AD2F58E1EBCE40276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  docusign/Mac/utility.php
- Size 295KB
- SHA256 e9e6a6a564cf56c00a63b49feba06b479fa7538672afb503c6c3041677c4ba39
- MD5 a4fad45bae1a2d71b2b81847cd09f90e
- SHA1 c8907b421c7cb2666c1b1830b8375d8efa0b269c
- SHA512 cedfe21719372d4bb330035029aa0fdfe776650ddd33a7e10c32e7fc2b89f4069043147f915de9a3e9e6c3ad321a4e641ce278523ce91b3019aaae45d6cec56d
- SSDEEP 6144:1Edo2Cp6Edo2Cp9lNuO+L6qFnxw7A+27rpZiow:1Edo2Cp6Edo2Cp9lNuODqFnqk+27rpZI
- TLSH
  T19654123157813DBB583CCA8C72D13E842E98DECFC6B8924535F5A0E382EE751ADB1259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  docusign/Windows/download/docusign.exe
- Size 10.5MB
- SHA256 cdcf67b83044febe66300cb2a17f25a758b14ba7ab37a429cbbf393baf19feba
- MD5 69ca8d41f09b4c57b7e7e5f13e69bf3c
- SHA1 953e55a3780535c0da67b6f459f9b23dd42b9555
- SHA512 a5a5a89204106a81b35d8a1cb62f042fae02e9aa18c218171df8bab8cfbbefc6b536b64c1e0b7c0c00a707c39d459ff0bde6d2465afeed8c1d6f16b6d0e04277
- SSDEEP 196608:aaZk+ww0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8m:wnw04RT9R4PkE7Ap84p29qIT0Z6rXr8
- TLSH
  T149B63313C57BCCE4CB234678D6E10A46BB4A058A9C5AB8D4F584633E55D34ADDF38B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

backdoor discovery persistence rat
- DattoRMM remote administration tool
  DattoRMM is a remote administration tool that can be used as a backdoor
  backdoor rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 31KB
- SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- MD5 83cd62eab980e3d64c131799608c8371
- SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
- TLSH
  T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/SimpleFC.dll
- Size 175KB
- SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
- MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
- SHA1 99778940e059238ca23a513e717d4db2cf34e606
- SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
- SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
- TLSH
  T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- TLSH
  T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsSCM.dll
- Size 5KB
- SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
- MD5 62efa7b730eb0523a026ea4325403b77
- SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
- SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
- SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
- TLSH
  T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsisXML.dll
- Size 11KB
- SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
- MD5 13deb9a0f4e4286df01abc85e1895e09
- SHA1 3174853b32407fd85220de844b390a18a8a76c97
- SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
- SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
- TLSH
  T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  AxInterop.MSTSCLib.dll
- Size 240KB
- SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
- MD5 0f581e56ed5ba500ce5d98d105b04a37
- SHA1 b6e2cade601bc6fd15e7f07ed41a4dfa4ee0a589
- SHA512 9034b8c289ce3ac9386d43473a019a9b45d9de82090e7da90c3cfbb00c8e9aa1509eba4787958495ebb928481f7b42edd184ec9e0c0009d4f2f2ec98bbd92fdd
- SSDEEP 1536:/ri+u+4qhkPZVb45mF2UQJlPg85ycFtIhH0rOP7gVzySImpYQ6BDdrMkwbTTj+6v:TuBqhkPZ61wOrOzgVbpx4aX+6C1Z5gd
- TLSH
  T15134CC06DFD54AB9D2CDA7FADC64114DC1B6D2C9604EFF0A6880A8E11E477B34C9B623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  AxInterop.ViewerX.dll
- Size 40KB
- SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
- MD5 edc5e696c4ad70f0be6301f703ab3672
- SHA1 9c699039715db6bf6746e438991988f9cfaf8ea2
- SHA512 58d9441d9648ece7f0284da75fb79777679e4f00610a71399ad2a22df8b418995f6a3fa06d69c17e62faeb3e7f061e3b3ec13ccf2ac00a809832594943c33760
- SSDEEP 384:2rezJLlifR3sVk72M6InhrJqOr9xun+mB1UDn0mVLAp8RQJ:wo3ifYBIpJqe7mUD02ApXJ
- TLSH
  T1B30394009AA48EB9E2E6C7B1F5F582514270F9C67742F75F194588D9C903B485EB32F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  CagService.exe
- Size 19KB
- SHA256 74c94094f7fe86c9969093456c4c167f129f9e1943c29c669b8e57cce3b3b07d
- MD5 05bc5532d193dd7d8c9809eefe5f6717
- SHA1 1fcee2c1c9ecf87cc62fc927db77b49b56eb289d
- SHA512 dc76b192c4e2465ae61396765feebbb3a3cb39c6a23a03e7ce6802a8097bdc27824d273d70cdd725cf797c7e06e9fafd9341fa1f422f4a916be0b7567d788cfb
- SSDEEP 384:r1EusU+04XxgXhJUOCklfyOyTJYy5qm2j5u:pEu302L2hVomL
- TLSH
  T1AF92E611A3E84B66F6F76F715A7206064E32FE9A9C70D34C26A4005E6A73B80CD7177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Common.dll
- Size 16KB
- SHA256 ab94b6aace3b74ed0fa4a70a199606e1bf8c312b81d1c075f1b3a40e47922cba
- MD5 997dc0eb0f031a6b5b0f5bbcfa45a056
- SHA1 47f9d69749316cdfb9c746390acf3219dd75229c
- SHA512 1106a0adaaff227cdfd27038de53098b2522d7696393e8a6cd722c308178900a676a5e4221899ead738802e64f7b3af40d0d36ee27359fe4b4f01cdc76ede43d
- SSDEEP 192:66HEVOfEEHwZI9SZM/ozVSg8eiCKiomqsEwwOgcsdsCLN0OHvPb7+e3gbM47MN2o:78RZI9AhN25kqsKORsdseHvPbi7m20p
- TLSH
  T11D721B398B38C33BC69A1A31F551DE6913B5974AB241CA9A8A14E85F3F033DA44059FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

DattoRMM remote administration tool

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32