0fd4b367585fb42acc4c28e12a48695cbc9f4f62fbb1c19e0ab7af4a76cb6203

Sharing

Copy URL Twitter E-mail

General

Target
EBSFormsLauncher-win-2.0.2.zip
Size 10.5MB
Sample260908-wv15dswerb
SHA256 0fd4b367585fb42acc4c28e12a48695cbc9f4f62fbb1c19e0ab7af4a76cb6203
MD5 678b32e844b460d6019b214de826f148
SHA1 d305db52e1d531571bac2d0f37c27ad534084e03
SHA512 fd40c1b72c917cdb98666efe2ebf0fa3366944cfca88b4b548b75c5966bc0f1567c09fc564d0e4263d9c46218cfa34bba4d58f659fe63bc527a0ba968f964f91
SSDEEP 196608:ziNKRo2t87zCxqU4KdoJSaizv2UCo9fYbHCQKspH+IUBAYdeasnlcZatPwNvNZP:2K64kzCxqUyliL21MYbHWV5B3r04x
TLSH
T165B6332881796DA7FB67793260B5E50BAB5F83E578C4501B0C4F82E1AD57CB02B1F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Targets

- Target
  EBSFormsLauncher-win-2.0.2/Install.cmd
- Size 749B
- SHA256 737feec4289d1924764a80239cf11cda0f425228705e686a555545975b35ca6e
- MD5 a5c68430b17da75bd66dc69eba139fa6
- SHA1 6d92b3bde7da31927eda903f6c7ecaaa6c989ee0
- SHA512 3cc8a826776ba664da9a6b4b7edd88b90e114c12d3970b25f12b03f6af21447d1040d8eb45fc5d1b83f74631cc457bb34c13316df6aa58c4625d64952f0c9e4f
- TLSH
  T13E0190181833F03938F10B69477F4B47D7CB96E3134B59DD69B300945D6E04552976E3
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  EBSFormsLauncher-win-2.0.2/host/host.bat
- Size 577B
- SHA256 8063022feba69ef2747f0edf14644b053f6d5a8e3d382bbf166de77f0ecef3a9
- MD5 f42a858e8feb3a17895529527813070f
- SHA1 90d716bd2bcd3bf0892374d720a1560fbe784ff0
- SHA512 a2899e79609956ec7dc1b22312f880a6543cf43eefa059c289c4d44221e7eea9d30119d52f68b2f7cd786ca1ebe052c9b4cc29ff52557039f8012770d9bbb8ab
- TLSH
  T194F081990D33E2B5481192188B590A8BE3CF86FF52996CCEA0F740644B059165AEAFF9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_asyncio.pyd
- Size 71KB
- SHA256 675587b1155c875ab27e24302d53f38e41febd3c080bc190c3e4ffbdb51fe76b
- MD5 92bb0e743902c0a9f5568934e3e184d7
- SHA1 797fcce3abd03cd3cee6d93a117f7d9458d1f382
- SHA512 5e7f5de7a87645dfdae2f453700a4d2e23d25af15fdff6ffea46ba4bc0a978d173391bdf7274073f400728bde57676dae00f2d87486ab7cd27dbaba716cbff56
- SSDEEP 1536:Vi9HPCXGsROcNT9sVgWW0UUAVIsvn7yEJ7Q9vfIUX2G:Vi9HPCXC4T9sV9HtAVIsvn7hG
- TLSH
  T15E638E8692A4418BCE97F2B4C5636F93FBB0F6920901575F60A4C18E2F533D183FE625
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_bz2.pyd
- Size 84KB
- SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
- MD5 77294e590d14a22d98862c141e7ea4ae
- SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
- SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
- SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
- TLSH
  T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_ctypes.pyd
- Size 130KB
- SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
- MD5 0ac143334e94105facaddc5fb20fc691
- SHA1 28cf13be0a0eb84f48c919e68f78852aa4856853
- SHA512 00b1a76760b33f054a785be9e4818879121cf5cb60b716d19f2c22c8c58075eea32e626a0962385b18babfaf5d5e33244c09c2e481f99a93577cfeb1647a22e7
- SSDEEP 3072:au1mymWLaxMd/w1KVMSf/Fa4IP0JrsFXI/1cswRIsyPyW4IiFx:ac4WLEMWmRf/FaFP2rsFy0zx
- TLSH
  T161D37D0B775800AAEAA79178C173AF47EBB1B453171187CF02A4C69A2F637D25E3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_decimal.pyd
- Size 276KB
- SHA256 f55d81378a3261a7073fb71aee674152265b6f24ba6f375f9b939d5a117d8e6b
- MD5 702e1bf0ffab5193217f6a028ef60bee
- SHA1 ff3a307db903d6289cfa209eedf898661aeff5b0
- SHA512 cb300dc0b5b39e29483bae9990ff3aebf7d798d923bec212bb1a1a3f15e6941a9166d78f62cbd24b256de16c114e933ffbaf19041870e9e58cf4a1df2dbb48b2
- SSDEEP 6144:yW7kA9bTIDaMaODhOgnPE/9qWM53pLW1AlTMkbNaoR:yZABIaMzhOTyfokRaoR
- TLSH
  T1F9547C57A2490CA8EA738078D5879E47E7F278960360D7CF03A48AA73F83793676D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_elementtree.pyd
- Size 133KB
- SHA256 58339737dd818a6d0bac98403158677f2f7d54adc7c673b9a8a18c8b19ab11f6
- MD5 6d422b0996d3c625b4ba5f1648541363
- SHA1 10b13483aae415f0518a63213bc92b483b61b274
- SHA512 fb09dae62a9002663e998a4e5d6ed6e2ff1cbcf7717a8cedfb3b86de9f3ff231da149c785335ba54cc3f050b366b9ff5c0219afa1c0b564d80449bd0fec71ddd
- SSDEEP 3072:Gi1pd8NMLHY3k8Gn9tUCZNlujgcZNbfg8N7/VnfdQnNIszfXZZj:Gi1pdo3k84MCZNlwN9zNfdKRj
- TLSH
  T1B7D34B8B7265C06BE0934038E6678F56DBB7F9A20E0087DF6284F29D9F233917E59714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_hashlib.pyd
- Size 67KB
- SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
- MD5 7573b8a4d0d7831380d7c12e7fbf0160
- SHA1 769e7bb2af17942ee4ff51f077333ee1cb4c05ab
- SHA512 d730a674cb1585b5adef712acbd2cf212f40824c8c516e958988cbaaae823422cbe5279da180a29a30457cf87a7abac45e24954eb51094a93b5bbf3d2bcff2dc
- SSDEEP 1536:1qXn1xAu1lEAXfXQfcV5TaPutFCAVIsvIByEJ7Q98fIW44DKrd:W1l1uAofcyPutFCAVIsvI4W4Iqd
- TLSH
  T136637C91AA884092D96382B6C4E34F83F975F352571197CFA2A8C0CE2F237C39776756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_lzma.pyd
- Size 155KB
- SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
- MD5 a0e27c2f376dc80dfc3f884963a0f416
- SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
- SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
- SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
- TLSH
  T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_multiprocessing.pyd
- Size 37KB
- SHA256 6c4ca996eafc99aeb246d25b5a9499d01488b643dcdabee6b48137f179b3deef
- MD5 e8641bc9817d98a88c8c9cd6a9f7c862
- SHA1 aa6bc4ade5430a9fd75f8980f830bb042cbe58d0
- SHA512 1c8329a35252703be4f802fe9ca621717eedc67ed3ce53cb4e75cade277fea254ab03fce0a7e764a6ee855b33d2f5fdb354aea97c07eecc1cb2b34e4c36124f4
- SSDEEP 768:orf5SZTZMF7Dz2HSFIsntxZyEFqU+Y7N2Ip48MTxf1mltPRVQg7:YfGa7Dz2HSFIsntXyEJ7Q9vfIZRKG
- TLSH
  T198037C86A6684057E963DA31C5A3DF86F535F7930A11D69F3165C2CE0E373C2B36A30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_overlapped.pyd
- Size 56KB
- SHA256 626675dc9fc5c74beb72cd278322a8313b68b22161e34473f8b951c238e72185
- MD5 6fa4f4a0ca88288e75b8acbbefc09510
- SHA1 776b92578b529d46c8b5db76b4171fb9170788fc
- SHA512 c2ef25fe1fc0331e1baaf4db541cb919330c8330080316d1dfb97b569943a19dfdcb61c0f92718a7664340c450ec245c18ebf8f4158b479e8bedffe857ca1af5
- SSDEEP 1536:PyaLvQyvNJ8V3PzKArkXO5pIsWtEyEJ7Q9EfIgHU:EfzVrkApIsWtJY
- TLSH
  T15D437D4A679401C6ED67C27AC5A38E47FA74B3D34201932F61A8D24A2F737D2A71E385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_queue.pyd
- Size 34KB
- SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
- MD5 922104c7bd756944703d7b93fe61bd99
- SHA1 72e672f312d58b2c241fd08e4493add4b5206ba8
- SHA512 8cb948d05a679292ca3aac6df32add50ca59af14e981aac0e12dbd5ccfe9cd2d303bc2eb093522fc0ea86c761727f56e8c400d9b28bd8f026230c8ad24d2aa56
- SSDEEP 768:Y+Md/6rp7gVh6RIs9UH3ZyEFqU+Y7N2Ip4+oTxf1mltPRVDg+:Sip7gVIRIs9UpyEJ7Q9+UfIZR1v
- TLSH
  T1C5F26DCAAA684487E963CA70C1E3DE92F535F7D3961186EF2065C2CE1E173C1E369319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_sqlite3.pyd
- Size 126KB
- SHA256 1f79bc24e1736dcbe487e711ae04b19fbd19498818be46010d862912d83df1c2
- MD5 5eab758b4638b64883b2bad61e84d00c
- SHA1 f3a80110b4e0d783b7ffaaf0e8a32bfb22489343
- SHA512 be9e3761c827b0436a447d801e0869c767860ce93557454dea8d38bf3dbbd22df8ac5269f492c39c7d9efb7bb44793a8d191439f7cac031c74822746592b112e
- SSDEEP 3072:OBwLQGS/4P0SHLgCJqc5yO3otq5vaDUVIsvQ9W4IbIf:o9SHLHP5DYq5vgUSf
- TLSH
  T16EC35B6B631800A6F9B792B8C1734A03EB74F562572143CF41A0C6492F777D2AF79B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_ssl.pyd
- Size 177KB
- SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
- MD5 25da0255096a1b094ccba672a6b1d6dd
- SHA1 2904e90fb039f7efa5be3aac3dd6c074647baea9
- SHA512 69601cdfdfe07bd9131922a7a693ef2bcbc3a589dc68c455d12d4bfbffe173d61de3237107624144aa07c230136916c189a9c7de0e6879b30f085219ab1ea2dc
- SSDEEP 3072:4ifuOjwYdI1bnMlfU6CPnzsvyII7IM/cbPuC/JWdIsL7PW4I9Q:4i20wYdknqU6CPwvySgd
- TLSH
  T1C7047C47B5945AF7E813E4F9C2234903EBB0F145321247DE48D6D64A0F07B4AAE6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_uuid.pyd
- Size 27KB
- SHA256 6748c182df6181cff8691da72dbb81f4f7f446ac7482d5dfe671f2b5333aed5d
- MD5 10229248d3b5c28dc37c56b9d5d7f675
- SHA1 b88fc015591b24a5ebd360177873dff51c862530
- SHA512 f111229fbb6afd420a507493980552ac98edca4bd30844015da4f45be8e0055b3474683f5b79ee122b48173ea3d06bc7a5f08c298b9ea348186462c5ad3ef8b6
- SSDEEP 768:sHVj5ndIs0w5ZyEFqU+Y7N2Ip4xTxf1mlDeI6FKpU6v:sHVj5ndIs0w/yEJ7Q9jfIUF2v
- TLSH
  T1ADC25CCA9A648043FE939BB0D1F2DE43B939BBD35611869B3165C2D60E533C1E31A369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  EBSFormsLauncher-win-2.0.2/host/python-embed/_wmi.pyd
- Size 38KB
- SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
- MD5 b21b5ac59bc63da2f59feaa70de04f07
- SHA1 5d5b0788b9bb91b8ea0a0ca6dc97219a1892cd0c
- SHA512 133d4070481e1dc359893a040da88c1438f7c1c90522178c437c4244f549ece0fdd6ccae0d221637f002c1ba638b2ef79e6ba51bbad59d0d0b667b2cc98af286
- SSDEEP 768:12/EEqrVmjsluFkc9+udIsLiJZyEFqU+Y7N2Ip4LwTxf1mltPRVygR:QE9BErFkc9+udIsLivyEJ7Q94fIZR8c
- TLSH
  T199038DC9E6680092EA67CA70C1A6CE53F575F7935712C38F326582990F233D1E739329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32