4275e4be5661a82faea8d38f02392ed220bc0078191295d9e5050a73b1b509e2

General

Target
aey8tp.zip
Size 37.5MB
Sample260907-a58rbstwbt
SHA256 4275e4be5661a82faea8d38f02392ed220bc0078191295d9e5050a73b1b509e2
MD5 6aaa603f9fba4a27c1baa5eb8cb7f44f
SHA1 ae4e14f2c31eacaff192856dabaf9c43bc7dd317
SHA512 492b6cb43c4d7c2bd0ae5b9a05c6459363a3f53683a93442667c1e87c8789cb918476d983fca0a1e8a79e0552e7268a9b9f2227fc5217237001540675b2886e7
SSDEEP 786432:j1c+EJYu5PctFyOkYTj5nW7q7wQd5PctFyOkYTj5nW7q7wQe:j1+JY5tFzkIj5W7q7wQ4tFzkIj5W7q7K
TLSH
T18287334CF689C8D056A424D3839678EF93DFE099B891C997B15BDF30570206BE8A8C77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SiriusQT.exe
- Size 145KB
- SHA256 e6c26a82206f6d7f0d10702d93fbe44f2e5c288b033633a46ab65f0a23f186aa
- MD5 65d1096269abe9c8f3a19b174e68c471
- SHA1 c7d35a4f3157fe6310223032f784ffd408f7dee8
- SHA512 c5bbc745b8c0a7d17e302f9e5e8fa7480088454753f6db73fa2020558aba890a6cfeba9b40882be171924357d953dbd9ae3343714e66aa76a5d387a667ed6325
- SSDEEP 3072:sW/n5oqQmL6ykmIIgQF2Vw1aD859ftVl8L9Dm+vX:Z/KqTkmIIXGwUDAVOxv
- TLSH
  T184E3F707F7E521F8E477C23989A25626BB76B83407305AEF57504A3A2F227D0DE39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL
behavioral1
- Target
  plugins/Clipper.dll
- Size 703KB
- SHA256 5b8814c54179211d807df804f60db42bef9f9dc2d308dd6c76c45202d689285e
- MD5 8e7d001063429957f280ca59a6fd13ff
- SHA1 f3c378fa1aad749560f1d8c77eb4237723e84660
- SHA512 f21cdf6c0b49c09fcb8bbe49f33fb507956687c16e1a1c415950049046d284e5613d1000350a9894a0a756b70ee9c76402f23422cc5d3a1315b2871e7601335c
- SSDEEP 12288:o9pUnCzIsc1Nbs/KNUbF5ushMzMnmwCgk8Of7nltC0jTKLfuI/WWTf7Vf3Xeft1e:o9pQQId+vh5SMvCguTl9TKbH/PThQt1e
- TLSH
  T1E9E423CC34CA46249B16D6CF3916A8481CFE74F28D6F5A59A261FA001F85CD4E7B4CAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  plugins/Keylogger.dll
- Size 957KB
- SHA256 b0ee3bd8ba9fef180915d1836ed96587c0a9295efee1eff19f458640f80da688
- MD5 57ffc93dc445e29698c08a0ada6118bc
- SHA1 e9d0649d72371b3dea9da63be152331af2655ac8
- SHA512 91ee1996ede9a873e7fc48967a4aca76c054e3f7e07f652474a2f0eb323f82327c58c597e7c244e0251d9191cfa10a04770cf9e0bbf55f716c558a346d30351e
- SSDEEP 24576:EHO9ipLCi07HsCNB/eTC6XnGRJyJ7NitFD24DaZHqBOe:uOUpLp0rsoB2TbXGRJyZNkF6MBOe
- TLSH
  T1292533226D00D52D4B222551FFA2E3AB422B3C262DDEFC8E99BB145DD9C534C3B8C575
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  plugins/RemoteDesktop.dll
- Size 1.6MB
- SHA256 61f81d700b74a80c96af4310705867e1abee49991ffb173a549fb3fe87ca25a8
- MD5 0a683c30b7d11bf44489f08691451323
- SHA1 5759e1497385aa2e21c57e887bd63bd955c51a7b
- SHA512 dd213f8c6b8961a46c27357a38c651a993920c2c731a5c9adaf4a14039690928389c9fc6c5fe54a906e293739c1ed199f3132f6b28827596c6e5b80742b5839f
- SSDEEP 24576:Zr9bwc5NlRQohMj5cgoDubslQjZYsrl4hGUjS80tLYqnqppRy+5BIY3/A4K18G6:Xbwc5NlSyMj5ho6s+jZnUjC6y+z34Pv6
- TLSH
  T143753303F45D060DE5A373A74E322E0CC6E094D63C5B5D29B5A3AE39592B02E497F72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  plugins/Stealer.dll
- Size 1.4MB
- SHA256 848f9733fd3b604aba4ca83fb18233e0a82c13fa6e24db079d7a5982fb1ef7a5
- MD5 c922103391dccc8838871b80239f6a0c
- SHA1 7d676ee4024aff591b58a75f1812475802c74085
- SHA512 43015e60dee8737c3ecab9337ed6468c8eb4d53057fc37227a2251136c9e7e83250ceaa485457d38325d1e715d4966f7b2964e4fdf0fa39bddf7fe5a96248160
- SSDEEP 24576:reZ94A/Ev3j12FrD5qwqPZVbdJM8qJMteq66fDLXHe7EMFCQE7/SX:uiAcQrD5YP/3qJrIP+7xFCQE7u
- TLSH
  T18265338C5DD5208E2A54E768F221324A764CBE43B5D9E3AA21574EF011843F0ED7DABB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  stub/QuasarStub.exe
- Size 145KB
- SHA256 e6c26a82206f6d7f0d10702d93fbe44f2e5c288b033633a46ab65f0a23f186aa
- MD5 65d1096269abe9c8f3a19b174e68c471
- SHA1 c7d35a4f3157fe6310223032f784ffd408f7dee8
- SHA512 c5bbc745b8c0a7d17e302f9e5e8fa7480088454753f6db73fa2020558aba890a6cfeba9b40882be171924357d953dbd9ae3343714e66aa76a5d387a667ed6325
- SSDEEP 3072:sW/n5oqQmL6ykmIIgQF2Vw1aD859ftVl8L9Dm+vX:Z/KqTkmIIXGwUDAVOxv
- TLSH
  T184E3F707F7E521F8E477C23989A25626BB76B83407305AEF57504A3A2F227D0DE39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral6