399f5e0c17c6fd90d794e0bc59c918165d6c98f59ec66e247736099a07863b21

Sharing

Copy URL Twitter E-mail

General

Target
r.Zip
Size 3.1MB
Sample260909-pg3mqswway
SHA256 399f5e0c17c6fd90d794e0bc59c918165d6c98f59ec66e247736099a07863b21
MD5 ccd682c7621e7706bd224836ed23c9c9
SHA1 c05080232166fc1f5f61b66c3e7848d07b523891
SHA512 b8b89c6e28e811be39f55711ee0952e9ea974a573e1a4da9bca95d3bc4d0a07b14d93481be5355e6ecfe42a748865bd37a45eaf27127664bbba857b5a3cd9684
SSDEEP 98304:MfaA0EgrTBtc0PI/LvAecqB1rXsuoZDyC:MaBNUvaqXsuG
TLSH
T1C9E533B81A0E3E9AD8BCF1707DA05EBB575C409D97660E33B4C126E9F67A4004793BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  1.bat
- Size 1KB
- SHA256 4f5ce73065d63ac57c34c2c24282caeee737b0790036da4dbab19d90c4c379dc
- MD5 84144ad71c8a290c729961d583bae4c1
- SHA1 a2f80ffddaba19db51a66dabf48b087278a909b9
- SHA512 85b3c40a5f85f91c26b6c6625533d9b60c7fe0646c245e3576a65c75e0affac343b26c9fda7f0799fa010c464a6d92f94d97c7ef42f2bb14d271bb4f0386bd7d
- TLSH
  T14641255F784EAE2EB96473D091A38919878D53AB1810EBCCF3D8A4833A09303C755E96
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  11.bat
- Size 2KB
- SHA256 6413f8681087402683d64074a7ff58d4f555566edb7a404634190c92b071a080
- MD5 0f906a7d2fc2b0bb73edcad8bc45bbdb
- SHA1 411657f58641d1562d8248391495033b892d2c47
- SHA512 e213f03de282d5ab57dd83a6d8c52a855dc26f0286e3baf7e437055fcb53776c9cda56746e76334831ffafda6d33a49d490b5924aef56286eeb1799d1d22f236
- TLSH
  T1F041CE4B3C459E5A2968B7D016D3562EC68543C65C30F7C4BFD6B09732013811BAFB8E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  reg\nts64helper.dll
- Size 45KB
- SHA256 cd2fc8d7fd856fa04f7dcc5d3f5fbb8b99ed7fcac26c77322d84ab4c0f0e4597
- MD5 5c9d1d25c3aa1afdea2013f2b06d82dd
- SHA1 002d0b684c5f6f51f7273c0c7e7af337edb5b982
- SHA512 455b0c5d56071a7b9b194f790a10eec9b613d2ee96d230d159a60dc5e751ec12fa1b10530b63ab692ebcd24cc1796a55470236cf536eb733aee7155aad599288
- SSDEEP 768:5fQnz21CrYsClPdfr+E4xlESGowjT1t7JCBfuWVIKsIQjCBteQbtoXi4z:5fQnzGCVIfg4MBGWVHPztJ4z
- TLSH
  T1B7237393259106FCD39FDAF90FA65AB1A2B6F0582AB1335857F142176E63C90E7EC340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  reg\wsock32.dll
- Size 31KB
- SHA256 a4c4c0fc6f6c8ea89aa39d6a974ab3009284b6d29db013274828af51b1cdfad8
- MD5 8b304eb719e976ea9dd4e1f8367de0b0
- SHA1 56452df3e9757d90f7fc83e9bad8efe14767ecca
- SHA512 228c3fd4410da7d9075d0f5687bff6d1b29573981d1de623130e9a2e65885a1f43569fd35be4dcad02ddb21a5910737f3b8c8d939553ded8f44d1ae64fb95706
- SSDEEP 384:Bi3aNu94p4kfzjrl/sT8PUmN16jfoUx/KULigYBktIFU8xTiUfXDe:M3aawD7fLPw90RCIVxiuXDe
- TLSH
  T16CE22A07FAD4C5B0E0A1CAFC4C58C76BF36CB5706ABA54A5BAD91FCDF82B1514218B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  rserver30\2052.lng_rad
- Size 98KB
- SHA256 7652f5c01acb0c190431194935a59371fd182cdbd5fdfb9e84f8e5394f5ba3f4
- MD5 360803904690c807c20845ba10e64b4d
- SHA1 5e75475373bab670a00b4982f5de954b76c41789
- SHA512 8e73f7388dc0a4d949b0c63c589a49ad9d07add43984c5bdc47924b5f8a0c6a4631904d44a888fb414fac7fbe669926ad6ac010b85d63169526aacfb9596d38a
- SSDEEP 1536:pUs2jxBG1xHaoM6E/98m98a98H98TeU6kdP/0:GNxR98m98a98H98KU7/
- TLSH
  T103A3C75613FAC565E1769A386EB347623335B9006725CF0FAF10AA8F08B5D08ED52F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  rserver30\ChatLPCx.dll
- Size 381KB
- SHA256 706c5b1053c72f17dae0d1a79d541de006d44ad183d6e7d17fd9dfff371262a6
- MD5 0f784435a0aef4f935c8f57cf7e54703
- SHA1 4db434fc3b4f1d58ced51ff9cca40c6c72657d8f
- SHA512 1af8b8f79f1ba8f12944a9c60ee6a6ef4a0ea42966355079e9ef91b687d0996480a4b61659512230f1273c5e80aae058c77a73444ffacbac4320efd502c09617
- SSDEEP 6144:GVKRZori/16p/qEWVjlKNgNQOYTfcDFdqPbX/gbKOeS+5DQc9:Gzi/olqEilluTfA21pQG
- TLSH
  T15C848D3331E0E536D0BB27309865A7954AB9BC205B7485CB6BE13D9DAE716C1EE38307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  rserver30\FamItrf2.Exe
- Size 165KB
- SHA256 e090333c18f2d8c70fbaa32472567203cd1009270ccc180f8bf8ff874cd4e9e1
- MD5 ef7ea9a60571d64bd5839a5a8327b20d
- SHA1 81c6eda76a75155fe3e7ab435fe6f085cdd10123
- SHA512 f2d672ef16a950b4165e2c5c98eb7dc55b2f255c099bf64237da41353631c05f7270ca74ae91d673a13e0905156c3230b31f1782e8aba104f8baaef99918ea12
- SSDEEP 3072:qBNQINWJFTK4LiUd0jav5x4NW4sahbmGpW:qfQPq2LiPsag9
- TLSH
  T1D3F38D003680C073D49249BA8106CB395B77BC515BA65DCB3BCB2AEE6F397E1973A305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  rserver30\FamItrfc.Exe
- Size 165KB
- SHA256 6ca1894ce68f305f6f01041a9f7ea88a6998ea5e650e70736d282bf782787bb5
- MD5 27c2d891f6efeb429dc89834e00ccacd
- SHA1 116b08e97f5da5e811e702190607a4d86845af93
- SHA512 e177f664c4003dde13fa9eafa1997f97bc031406c008785ab7a30db96a5e8d5bbe75aba5c167d3ae16d365ef96adbee6203ba59d87db4209ed1e6a0ba440c7d6
- SSDEEP 3072:3BNQINWJFTK4LiUd0sJjv5x4NW4sahbmdx:3fQPq29niPsagb
- TLSH
  T1EFF38D003680C073D49649BA8106CB395B77BC515BA65DCB3BCB2AEE6F397E1973A305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  rserver30\FirewallInstallHelper.dll
- Size 47KB
- SHA256 48b5a9b9dde94d25b4121489735fe5a94738a1dcdf7a33ddfabb9cbffd66ba7f
- MD5 6bcdfeb8f72d04fe3db2967edcd9bfa5
- SHA1 70db691f27cb6273cbbf4bab04b3637618b68645
- SHA512 af5887c83bb342b559fb18c2a958534f58e2c514c1bfaa4348f4cc95b0011444c6089904bb87c4e2cb34e42290a51cd6a563613a765b6d88b02358f4d0213fb9
- SSDEEP 768:kNUfLHByY5SaO9usgkQduum2rQG7ekKH/mytwHHxMYXpbwXZ3wh3V:koHDKA9kuuumkQG7ekOtw7Vwgh3V
- TLSH
  T132236D5339616033E9C38AB456EDE7119A3FE25017F149C7592842FEAE927D12F7830E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  rserver30\RCursor.dll
- Size 89KB
- SHA256 0debd4ea7060f371b4fe42e09949de35c0c627364757c10862eb83c5c00b6489
- MD5 fc166b57efda6c0ed48ecbae3acd896b
- SHA1 dee604b2e97e9f35223b6b2004ad0ad2b0562974
- SHA512 598918ad86891542307160f908e0cc8fca784dfe7e554dd4f773127303538726057a5efad8df66e1e5302e41a7e7dc84d10e3c3e61b65f996d444a50446ff887
- SSDEEP 1536:g2LAoRDfBNTLiMSNtEYwkbUbtnQ5ai8ZkchAgho:ZAoRPfGnCZnQ5ai8Zrq
- TLSH
  T161937D617955C873D88746BC0859D706AFBDB5408FA9C4D37FA80E8E2E717D0273E20A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  rserver30\R_sui.dll
- Size 401KB
- SHA256 036aced4a64d67520b74084cd566c455a0db2f0bf5f738319f76632f630ceba2
- MD5 936c55a7f7de90ead52514148c873006
- SHA1 09304862d48769e48479e2b823f60445b990e137
- SHA512 d3215d009b8c5543a191f43f57a502876dc941bd6fa8ff27c3e06fb27e99b0f01cd5818e043d8f6609e8e1e1f17d9e9fc31b854806f3341ff88ded508b6d8a0e
- SSDEEP 6144:Lgrz24tSUMB3R/6E3IIIIwifQT+Jt+67dvlC76UJ5gTBMXILsagK:0rzrLa3R/6E/0INLUITeXm
- TLSH
  T104949E42FAD2C0F2E99A493430A7E73B9F3E5A4A0225DBD3C764ED955C22141E63D34E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  rserver30\WinLpcDl.dll
- Size 313KB
- SHA256 2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b
- MD5 b166a1bd564ada9c0b1c9eadb04b147e
- SHA1 8a8fff142c03317a792321c2aa2554822712b3e4
- SHA512 dc1bef2dbe9a3814864e9d68396e0512156563b05d35986aad3b628c94aba5bfa3a0a47a96985e223ad7c10ae5cfcf4a8b99918cc04104dd5873e30a66febcd9
- SSDEEP 6144:Mj8MtsrUo3TDmWBySmw7Q5Sq9YEsagdHK2gq:otsIo3TqItmhSqMHK9q
- TLSH
  T19C64AF207695C0B7F91601BD420BD3691BB6BD115B290DC3B7E12EAA5F323D16E3E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  rserver30\WinLpcDl2.dll
- Size 313KB
- SHA256 dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951
- MD5 1d710de8a1b118aa143427998d1747ee
- SHA1 5db784fcb1b2e00fd3fd2f403efff88cf6ad5cfb
- SHA512 021af1bed3f34bf1a85ec66bfd6daaaef37dce39f502d54e5034fecf1b1e3f5fbbf80052f259f54ab4afa9d75b2d494bd2691ba8b7f49a6f15dd74a5a695838e
- SSDEEP 3072:mmKkOcs//kFwDEyTxM+9I1v6jt+N8aNznOGu8Li6igaOpsBHcdbNSacEl52J4sak:bKU8xMnyjtcMqa24HcdhStOsagdHQJc
- TLSH
  T10B64AF31B791C0B7F94642BE050BD32A1AB6BC525B192DC3E7C52E9A4F313D16A3E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  rserver30\raudiox.dll
- Size 205KB
- SHA256 52df336097bc6b33a917eb9128d3bdf58952667cc24c200cff5a41fa06996b8b
- MD5 c0bba4c5d561744c237acf053e8f5b1b
- SHA1 0dcf35fa1f922a028605193b7818d910942cc150
- SHA512 deac2de89eb0ce9a9b390ba03ef8e217d5d3178a03d96f798daa8817040d67fdebc91691b10736f671f0ecd7b410a61cda3f931571ef1f38036f419747412594
- SSDEEP 3072:lYI0qGgs3LrwBlKOoT1HhGKef7YDEVJQjHHk+VQFWH9ooJJcg:qssPcoLGDfV7enfQEeoJJB
- TLSH
  T1FB248E637B8480F2ED8BA5B5105BA71665F6E2000B75C9C3F3F82E659E102D16A7F387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  rserver30\rchatx.dll
- Size 281KB
- SHA256 ebcb90451ae454df312b90a374be7142242cc0b6e8b51683463db2d138c63106
- MD5 52a194fc0beeea4cc81f1801530b96c9
- SHA1 9992776bfa36250603ed02e03614afd9da688cb2
- SHA512 ee9653c955ff839e35b3914014d77cebe58c3618d129ddc09ccc0f7f9f49281fd97b8542be08fbbd2ec382a1dbb0d030d0d65479c54c1be2ae10474cbcb05329
- SSDEEP 3072:9HxmZzv3Cg7P2VPHMaVPzlqmHhfbc6whZmuoqnbmlomZj9H6cOGhAvNb/0NBa4Tc:2TaV7NshYuOp7On1sfa4TaYm
- TLSH
  T1AF548D3331E08432E2B71730653A964649F5FC214F79844BB3E53D8EAD75EC29A2AB17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  rserver30\rsaudiox.dll
- Size 169KB
- SHA256 e02e59e4af1e5ce3c475d6beacf8189a9e2342a013b3c957de0ab0098bf7450f
- MD5 97b88d20d8fd104f205e16b10724e816
- SHA1 1576d597c14c11e46c674c78d898edc992aac1ed
- SHA512 3ef894a97468df139a238f019341ea85dfc3ca5a8da8d896042ceb8db2c7391dc035086f64b8e0d2c309953b5a4ff088a65d4efae595d33a6c39b735d16435f1
- SSDEEP 3072:HxvIjxbhZvbcnrIRki05xel/Oyn9+7oknM8dJ:HNexHvRm584dvJ
- TLSH
  T1A4048E737A90C0B2D987A6F50456E70B66F6A7014B29D8CBB37D1E991E207D01F3E386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies Windows Firewall

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Modifies Windows Firewall

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32