872b928f1fa4f63e6a73c21171bc986317b694f48a91ce029562879b0ac4501c

Sharing

Copy URL Twitter E-mail

General

Target
Fishao-Windows-Desktop.zip
Size 22.6MB
Sample260905-rfa77sdn8s
SHA256 872b928f1fa4f63e6a73c21171bc986317b694f48a91ce029562879b0ac4501c
MD5 e18bfa551c6a640ec5b057c54167ed81
SHA1 9a149ef35a34f2ee141d5edb50700927c31ccfb7
SHA512 dd3bec38993a7860331cef8db53a9ca6021982dffd41afce8ee7778beba43f0a87c112ddf350543340a38d56f9a5bd057c475be49fa7e7f4e009d29423882d19
SSDEEP 393216:xVAtOONsNZmXXPlK/gHt7A31ngxffnnK8gMmDUw5MlexcoWRvQWul+A5aoJ6MHj9:xVAtORmP5KOHnnKAlMWhQWOB7D9
TLSH
T19937339E238F1AE1B2E7241A4A701D8F823864E7975CB3CDE554D630C164F8B2276F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  Fishao.exe
- Size 4KB
- SHA256 120fa6938973992d905cf7606af641ba352ff573b149c5689a3909bb02adabd1
- MD5 892ff34c1c0a5d80c47163be084028d5
- SHA1 7157304dc414c608965cacf3c24ec34729e08886
- SHA512 38115891148ffe495fd180396f622c57440c006b14c2f010ab76f115d02d197f43df34c8bca1230c453142bb5072bea7576bab247f3260143232fe960eb6895c
- SSDEEP 48:6srz1Nw3t86sFiDZbl1szdhD3WuulM+hGqXSfbNtm:xz1Nwa6dgpgqkmzNt
- TLSH
  T1CC91A80193F84926E4BB4B702DF3871017B1FA115977875D69A8021E6E62710D923FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  FlashFishao.exe
- Size 25.1MB
- SHA256 31a318ddc71b0ea6e3787038de39401071f5065ec737164311443f19fefc65c3
- MD5 5f5a2ac2da6e6a79473162577b516fdf
- SHA1 9db8066e15fe4ba34b03a515863960c2dab756d6
- SHA512 435988846a91408a6e32dde295f3f8ffd7b275dfc43617d7c501f1f9d5187ee67a314a1621ef12c0b718499a789e5fab9dabe81b6b1827e36f3376e83e7b5f2b
- SSDEEP 393216:oG7Ey7mkWzPpPV2i1+/N6qenQagtgl1gPwXe9e/wvDkfIFukQau3eXs/iS40:oYEyqkWzxPf+/UQanyPspmDeIFugso0
- TLSH
  T12247D023E2414471D0922279CC3AEEAD5168BE15873455CB23A47C1BA572FC3EA3DB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  FlashPlayer.exe
- Size 15.2MB
- SHA256 a4b333ac1da12026989549015303d82231982838bccfb544ba5fd188746066f0
- MD5 08c13d0cc4ccdac79b38821e846a53b7
- SHA1 7736efc1c76e6a80132a22e1f9fc87a5884fa375
- SHA512 87e953e053e249a5c202ff4639aee6fa5915b0b86e69ad5eee76d9091545aa4d201a8477d1c2525db9d3ebb053476cfd9ef31a8c7b232a4dcf84c2dd86f35860
- SSDEEP 393216:nZl05YflfxgkTVfdBL/tEJ1+lFj99e2xXX+QU9DrFkpBK:nZl05Yt+kTVTL/xlFVaPP
- TLSH
  T12EF69D23A60144B1C182217DCC3AEEAD617DAE15873415C753A47C1BAA72FC3AA3DB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Play-Fishao.bat
- Size 285B
- SHA256 19b2f4156cc49025b5057625a8dd45ae26cd0efd3ff22ee445f0f93a2ca45d1e
- MD5 621aa46f5d721306a2220e59bdd48c9d
- SHA1 1c10dae81e3e06147cc55132d79bf17d30f70078
- SHA512 61f835985dd4b90482f2280f9a1679a549a00ddededd5c7aa2a2c5024e146e8f2bc9995397d44a0f73517122babd5dbdbc596fd986a8b8fbe7441d39d109d53a
- TLSH
  T149D02253B32E580AC450190820BE00B0F812025FC2272A34E18F45AE010A3DFF22C201
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8