999eb2969108960db0e4c97cba4b1483fab1c099d6cd732c7f9cb1cce8114c21

Sharing

Copy URL Twitter E-mail

General

Target
0FF1C3 2016-2025 Latamhack.zip
Size 11.5MB
Sample260909-cwtbds1apd
SHA256 999eb2969108960db0e4c97cba4b1483fab1c099d6cd732c7f9cb1cce8114c21
MD5 adb0c943badacfacd27808cc48446220
SHA1 dc6c3b9dd6a717c981b52bf469393f62887e3ad3
SHA512 3ebc18140ec2a6915017b778811193400d5aeb73074168c7688893a65689baacb09b10a11770bbcd0146811627428d0a1ad07171e4616fabb9e9133598758845
SSDEEP 196608:iwFSUN9Dt3fbB+ucgrmcL400nnCnMf61bfZT3rvA9/mW/On5/Hlftn:iwHDaucJtnCMmfNuuWiPpd
TLSH
T1DFC633880EBC0DBC38ABCC59B7199B22F7D75D35A43827B1905D22847B32CD999F8D85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data/v32.cab

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data//i640.cab

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data//i643082.cab

Targets

- Target
  0FF1C3 2016-2025/OInstall.exe
- Size 10.9MB
- SHA256 414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
- MD5 ebc58647462ad9c76395ef451064d115
- SHA1 14e470812f13b278b2694a4cec5737a39784e9dd
- SHA512 8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
- SSDEEP 196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB
- TLSH
  T111B63376044290B6E0812DB6520EB4F5661E3857189BFC642D4BCDE87BBADC3D7D2A0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx adware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  0FF1C3 2016-2025/files/x64/cleanospp.exe
- Size 19KB
- SHA256 5ce462e5f34065fc878362ba58617fab28c22d631b9d836dddcf43fb1ad4de6e
- MD5 162ab955cb2f002a73c1530aa796477f
- SHA1 d30a0e4e5911d3ca705617d17225372731c770e2
- SHA512 e0288dcf78092449d9cbaef4488041131925387c1aedc9e9512da0f66efe2fb68350ca3937f6715834e62e7c931c5dad0fc8bc3c6c0c3daedeff356d6feaac2e
- SSDEEP 384:gQAInWKpEFFzpjq37oIOU6GHq33QPiu431VP:gxWTpOFagUb2qiu43P
- TLSH
  T1A592C4B40BF601E2E1BAF774CEB50526E872FC122A329F5F069184451F32A51EF76B16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  0FF1C3 2016-2025/files/x64/msvcr100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH
  T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  0FF1C3 2016-2025/files/x86/cleanospp.exe
- Size 17KB
- SHA256 3fdefe2ad092a9a7fe0edf0ac4dc2de7e5b9ce6a0804f6511c06564194966cf9
- MD5 5fd363d52d04ac200cd24f3bcc903200
- SHA1 39ed8659e7ca16aaccb86def94ce6cec4c847dd6
- SHA512 f8ea73b0cb0a90fac6032a54028c60119022173334e68db3fbd63fe173032dd3fc3b438678064edb8c63d4eceaa72990ce039819df3d547d7d7627ad2eee36b3
- SSDEEP 192:Xdaz2FKIaphXuVX3uKny+gASTGWyQG0eJIL+uVl9tUDY5Kajjtl9w++zOzrPwaur:NbFuUOvAiG0gIVDKDYgmh02HPwzi3An
- TLSH
  T15B72F7216FF50862E1FA4FB06FF04125AA77BEA51D71CD1F564046091932A83A9F3F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  0FF1C3 2016-2025/files/x86/msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH
  T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9