3aca58faf60568e7ee537a7de73fba89919b91293d8ed28809cba749129d4d9c

Sharing

Copy URL Twitter E-mail

General

Target
done.rar
Size 33.7MB
Sample260910-txr86avtet
SHA256 3aca58faf60568e7ee537a7de73fba89919b91293d8ed28809cba749129d4d9c
MD5 ae6821dbb5bcc9b23355cab6c62409cf
SHA1 20fb49579b8ac139fd3f0bb0c25351fd7938ee01
SHA512 1d742a8e74008498b3aaaae1b722cf4346593daaf3fd92db3a8f6a2e8d0f78788d053422862f7e100ed60a24b615653eebc31f14f3d295f80f818d0eecfd7927
SSDEEP 786432:EVGTY//HJWYCUTDKBLaJWOAFBxMah2PFGuaAdaXFenoHJtE90A8YoUq:EM0XpWYCcDiWJ0/xQoAdaXFeopt0oUq
TLSH
T1397733426EF06D0F52508B842ECF942E4F7496804A676FB97593A261FDA33634E35E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  done/BASLAT.bat
- Size 774B
- SHA256 33e5d3cdc6d9d2af7e2bafe526e31f1aaef8aea94956e303596a214f1076f394
- MD5 afb2db0a2a5721e22562c4c7fdfad963
- SHA1 b8883753956bb5ae650ed68b535e3216e25fdbe7
- SHA512 6f9ab7fbf4b3f1cdee8ba6f0ecd80982bdac54a445c6b65010b06e5f4efe5718acad76c6638b8568953baf3736e7e9ba026ccd769794f1cd389e223ee15eeee7
- TLSH
  T10B01F1621214E706F6A67E6ACA4197A5BC1FC01BB2196EC6302481343AC903E51DD1C2
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  done/BASLAT.ps1
- Size 813B
- SHA256 046e6f623ed02fb000b8fba989be1c7b6e46ec60a8bed764f6fae2c25bd5ae05
- MD5 d7b6377e890f19898188492e79692c4a
- SHA1 9d1f48e3a159d0ba9e33735c95f18fd2f086a5bd
- SHA512 924355113f879bbd6c3fae92ca5ed977706291fee9f7ce4db982625711e43d73072196ed36a574ca38a8857c12b43d66bafd7950f98cef063071cd78eb08d913
- TLSH
  T15C018614113CB9DAC6D3AB4BF7936E0368FC855C80161955903CF0587F5116A43482B6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral2
- Target
  done/DURDUR.bat
- Size 155B
- SHA256 37732614a588400be72cc494afa6de421deb121eaf35a571b52ed0fceb591363
- MD5 2558e2513fff629f39084525e078f98a
- SHA1 b44e804b69980180f7ec37a6def15b9b27a5b39f
- SHA512 2a2f8cfd4e61e7b8968112c2ea9d929f3968f2b5e4a2062a59a1edcc44715ae2497181e08f09cd3c116ff921891649c3413305eee3e386898a79175198bc8586
- TLSH
  T148C08C022559EB24A0226E9F80C18BB8481ED58E63A26B43302C212F384803486D42C8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution
behavioral3
- Target
  done/DURDUR.ps1
- Size 392B
- SHA256 ddf672925ea4b4d056d2d44f3be1a3be760fc3f3152e59acdeb164a014548c30
- MD5 beb1b8109a1c062612ecaec3c75755c6
- SHA1 fed9ffadb1e87f94980a788440540d4e009f6480
- SHA512 f6569c97d6af0f0955cf57fe6f4c3161434c49ad8ca8576037c1790575d52abfb1adc1aaf6cbe80490bc597b46d06f338232a52cde226849cfb168af55dd178a
- TLSH
  T141E0AB24117CACA6C8941B0BF2434A0B1AD440E8424B1696502DF001BB8413C030803A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  done/FakeAuth.exe
- Size 8.5MB
- SHA256 92e5315bcb265798f1099ca507d5f622528beaeb3548dfef931b65daa7d6822e
- MD5 0b90d97cd039dbe241c13b847a62f002
- SHA1 1474acf0ee37adb255417c98239ea8e5ae82203b
- SHA512 56004299f9a175161a598ea57e46ae7b0747feaafcbe857db98b013d8b93201be8a58083ac805dd84de1547a502b957a1c6fff165f62895ecdbb6e28a6de5c06
- SSDEEP 196608:s+P4BXEpXnH2ph1igtlxSiLCw10+u41ZPcUcdtytvonYpPT11pZ:JPIXEAphJtD510MjAytvUYD
- TLSH
  T14A963358B79011FAF5B7403D89E69851A3F232130B95D2CB27B052662F736F06E7CBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5
- Target
  done/KUR.bat
- Size 149B
- SHA256 37cb2ef09e1176354a40002a4d6580f7ebb445ff68800b9c8e45dab558b0293a
- MD5 e78b6d1ee67bf043cdab65af6808c0ab
- SHA1 954d8019f8b3937f593e507548d0d9c7b03cdb55
- SHA512 231121d212ac5d01a1ca8803d3718de1ad6df3c4d17f0eb4bde563c49536bf84e802151bd4c67917d2b53955b917022df0b31fac072115646f9f0aa34c18a996
- TLSH
  T19AC08082134697351457C5F6C493443418088282151247C774216E1565042BED124285
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Drops file in Drivers directory
behavioral6
- Target
  done/KUR.ps1
- Size 909B
- SHA256 3778f74ad28ae85a47bb07cc73976b5652ae18decf585c4af02ea84fa6156b05
- MD5 cdbb97d6597efdbfdca5bcaf46e6133f
- SHA1 1c72cc56a9ec93cfb3f84c428ae6210657c5d623
- SHA512 798f0684563a102eacf1166a6a769e0fd16fda6f535b92b7fd35488efe60cfd4b51db0c81f111b47908e406430f43bdb2e97881da6f65c53656519f4cf793930
- TLSH
  T163116338A6226D630FF31123F2F6D2925417C171495C5CA2EA781848F1477AE8322B3A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Drops file in Drivers directory
behavioral7
- Target
  done/Unbranded.exe
- Size 27.5MB
- SHA256 4c30b8f181d5ba6648d44dd6751290bd88541e61bc95753bff3274d8e9418298
- MD5 54b2d9eb81b690d5a90d80bedf0f5a6e
- SHA1 b541ca2526bf2e31ef92e7060307aef36552e287
- SHA512 aa158523b74a1a1705f81d79d394a497cc041086a9cab1f9d33784bfd257e642272fe95141144aa4efbeb15fafe4993c0ec7c5650da4efb52410658043091225
- SSDEEP 393216:ykegrd56xJHLfrNI/wxpwGTBs2iEXGFW3lw5jJGRvPrADG7h10u6kG7ZNbmF:yZbfrTNw3GT7iE53k0mCkuyZRw
- TLSH
  T1A05733D562C853D8D7C38840734E92EBE0D3793A56EB94247AC72C039630DEA5A4ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral8
- Target
  done/fakeauth_server.py
- Size 3KB
- SHA256 d75db06fa914098f7bd0797117092a1d0bfa870f5cdc58c4a9f4a4aea1e0d8e1
- MD5 08dcc941ce92ea3918915fb5072c65f5
- SHA1 d759da8ab5d1e8340f3ccc6fd12033baab614daa
- SHA512 e63f249df15cd4df31a212b280dfa7cbad29b69a287b374c5beb582d1cc865727699d127692e4228b08e657e48a5c5911a8b98e9d2d3d799b130e196c2e0780c
- TLSH
  T1845184828C352DA7C333C32A141191A0272BBC6367191038B8EC83D9BF991B8C2F85AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Discovers running processes

Loads dropped DLL

Drops file in Drivers directory

Drops file in Drivers directory

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9