e172d3c0e95df744b9c031e20969249acc4ebb5372cdaca49daaacea5062483c

General

Target
10092026_1436_06092026__ZKRS#953800837526.vhd.zip
Size 5.2MB
Sample260910-ryp43shc98
SHA256 e172d3c0e95df744b9c031e20969249acc4ebb5372cdaca49daaacea5062483c
MD5 0d4f928bfcb4f3dcf322361a1e30124b
SHA1 6147b1e3f3066ecd64ef2e9d282201c7b6dd4bb8
SHA512 c4ac9bf22877ea90e2ffce17eb3c13507de8aeeb3ae693c38d4cef05f2ee43681a4446dc456256a51d0a06cce08f07f9f356820f9c545d655b17f38a632b5391
SSDEEP 98304:K+RueghYAijdyUIcNi9Wv0NxAxXcVgQvI76Q7nrAgjhOxkFayW:K+Rueg05I5Wv0NxVV1I2wjhOXV
TLSH
T1D5463351F41152CCFD28DCBD981776E1E0F1B847E82829E693B4485BA49713BC3BEA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  D.83040704.EXE
- Size 3.8MB
- SHA256 4090a0b9014c607ba076841b2c2d957e031a7612f6ae46151dd41517d53cfdc8
- MD5 eb02dd65c981a8c626934e5b96b43302
- SHA1 004c1571fa1e75fd13b54ddc75fd07a2aa967087
- SHA512 064c1001adeb825d1760b4ae0f9b22296fe9961bd038c974a6e771000352d402eb274f8dcda48d98417208a9660e65b895b48d54009e1dc30b88ad82d28820f9
- SSDEEP 49152:fTuYooyIQvMCbSwkQEk/exEnnHL75LErl0GPjyziET9/7buChgpXd62:fTuIygwiZGnHL75L/cv
- TLSH
  T1A506BE01FF428171F8E30A7A92FF577E4E39A9104714D4D3E3D419AA89316D1BB3A39A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  LUA51.dll
- Size 5.3MB
- SHA256 3049bd70fbcab71d68696ce6331e7da860f98dea6f9b63afa67fafeb17bc980f
- MD5 5fd5f8bdde0553ee2a853fbb991f351b
- SHA1 929055002e4926f14629ffd98b47686f22bca66f
- SHA512 93d10933c1ea317d246e1d1b8a5626a8c9299e31c8e3f6fb6a909d50fb67522edb0c7bac1ecea66ecb7288a4f0d42fe4dc3a6e2c01afe07465fa103d2547f9ab
- SSDEEP 98304:CJPwTsC14klK0g04bzucg2znygnFmHpeenC8zEN4OiZrq1DfPHNADtV6v+M:CRRIXKD04U2ygnFmHpDnhEN4O7NADtVb
- TLSH
  T16A46C0313DDC3176D00E8130CE7DA2F9FAAE7D642B65009B1580BA1BFD317A25A1B95B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4