dade9c1b618e82e6499c7daa7f2a21602f2e2fe42914182a485e174909c8916e

General

Target
puente-agent-windows.zip
Size 4.3MB
Sample260909-epbtwabl2y
SHA256 dade9c1b618e82e6499c7daa7f2a21602f2e2fe42914182a485e174909c8916e
MD5 d88e3ba4be586a9e8970aa334e1d924f
SHA1 f09d342e1352f64076167050bf06eec8d242134d
SHA512 2b6430970a0974667ae60673ef3b6881d2ae169e11857609ed486b2f504a612a07773a63999b4b275c36ffdf30dfa05ac9e6c110cdc8071a2f573a9a12b927b8
SSDEEP 98304:3W+3JloDCcfxx6Ec5l801/GI1WmfGtFPlYlyZetrmU4Tc3NPVLr:m+5l+ZJcb88/GIN+tFPlzktOTc9VLr
TLSH
T1682633ADF5B3CF267E4C51B49DB317924BC027CA5AD03332A833345F49A77E4628A865
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  puente-agent-windows-x64/install.ps1
- Size 4KB
- SHA256 d36c7870238223fd2d8704a8573d5c4cd60c37a027aa9c3a90da6eada5a47210
- MD5 c04cf06b2cd39ff7248e80cfec8ff459
- SHA1 20789015d654c293bab16707f42867439354cbe6
- SHA512 7265c923b757efa103b87e707a91e6fd07ab28db4b4cab1100dd78005f74d5fa80dd975a52861f0e1c4c2ae3d90c6b693e0a348ee714340fc6129972010b301f
- SSDEEP 96:+1S7F+4Cn+ZTR8UtwEHmF07zlwq69/pMkCaoGNFkIBboFEQxn:+1S7FsnyD1HA0nOqQ/6kCahNFkI4EQx
- TLSH
  T146A1B939EA8016A68AF30105DEC3E755FA1C80A9604C4585F3FE8241FBC974CD6768B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  puente-agent-windows-x64/puente-agent.exe
- Size 10.5MB
- SHA256 19df1aeb47dc9b5b9d0b8ac496ea88c16db750b0d1be708b25249f9441cf5986
- MD5 07cb71c0a439bae8684afad6a716e1d6
- SHA1 21fc5d3484f15c5030214d31b1df26eb25b0b6ef
- SHA512 72cfd7859be2b2c0ea83c52430023709dfe19e2f808d0a6c7954d8a98df3e878b175af130c6014e79265db4d7a07ba612000ddc25c0694036d9598e9cf56550a
- SSDEEP 98304:LDZ7RkFW8LqZxnY9ZGJPWnNc8SQBeTQYAxJomVhloTZLWez6s+sfLjuEKU8VCw:LDZmGcBLh2L6ssJ
- TLSH
  T1EDB63916BA5B98ACD19AC870834A8A775E2130DB1B36B9FF40C445393FA9BF05B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4
- Target
  puente-agent-windows-x64/uninstall.ps1
- Size 1KB
- SHA256 c577bf28c4e8fd45fe053f5c8953315b11e57fa3fd4c2bd0203f6d7cb7c2d268
- MD5 768e66cf7d77d35bdce08cf5470ab985
- SHA1 ff0f2b38865b54e8a70ca161c280e001a300b4e6
- SHA512 e8f4950af9f030aba92f5dea63ec633b5a54ee0a745ec1074ca1c4b3f9ca8961b150f2662bdfa3ea8340e0572fe9ee1056dd73d2568dbd05fd9c1d171cabfa71
- TLSH
  T10521E04197D025958AF50A49D8CBC36EF59D826E10DD0301FA7B8909BED161EC7520FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6