070798e224b8e025f19c6839c2011e522692b813a045fed6848f9cc87d6330a3

Sharing

Copy URL Twitter E-mail

General

Target
dawn-installer.exe
Size 3.3MB
Sample260912-zd4ezahe65
SHA256 070798e224b8e025f19c6839c2011e522692b813a045fed6848f9cc87d6330a3
MD5 770ed1e6d3fa2e9ae3467482b3567277
SHA1 da93d1c6e1ce05971c29bab7b5721a880ca9fa70
SHA512 6068d0b867a34f5ad8a812dd520a5ede752728b04dc4fc58a95fd39040f147b77e19250fc0312ae6ddf9cecb04271e88a471695a8f003a1632d7d68c86ba85e1
SSDEEP 98304:uvuHiNj4jrdTJCBuqMmw4h9niv2WxHaL5sTzz:uHNUdgx3niO5e
TLSH
T1AAF52260209D9027E69E5E327312BF6605636FE568CE2432F64B3E9FF835B72D845903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  dawn-installer.exe
- Size 3.3MB
- SHA256 070798e224b8e025f19c6839c2011e522692b813a045fed6848f9cc87d6330a3
- MD5 770ed1e6d3fa2e9ae3467482b3567277
- SHA1 da93d1c6e1ce05971c29bab7b5721a880ca9fa70
- SHA512 6068d0b867a34f5ad8a812dd520a5ede752728b04dc4fc58a95fd39040f147b77e19250fc0312ae6ddf9cecb04271e88a471695a8f003a1632d7d68c86ba85e1
- SSDEEP 98304:uvuHiNj4jrdTJCBuqMmw4h9niv2WxHaL5sTzz:uHNUdgx3niO5e
- TLSH
  T1AAF52260209D9027E69E5E327312BF6605636FE568CE2432F64B3E9FF835B72D845903
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution persistence
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Install-DawnPayload.ps1
- Size 19KB
- SHA256 f9a3c631a75bb7f160430a761b5bd1dce081f19beb15f5b12e547bc195da4157
- MD5 fb1108a18e3ce5694c7d41efc712c77f
- SHA1 0bc231f0ddcb4e21cc43cb5ca64df5fe10e0cb50
- SHA512 bcf7f599bcbbbf7eb813bfaaae16f9592897f0c8bbf9b3d337d79f92fc8ebba4e22dd8f4f01896e64e340f6f0cf100eb5a16055497f555e3d3690646e9030ffc
- SSDEEP 192:Tm1gSk8fiXtpmbKV4byyiSniSQTJSFCHhBtEh2JClyDhBt7QroQW+/e2smtuM/y6:Tr3oXt/9NONghTKs/cr+
- TLSH
  T12B92939A3AD420B549C763BF399E40A07A6B401F656D4E10BCECC3446F6D43C9FDA399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NScurl.dll
- Size 7.6MB
- SHA256 efe7d99833a05f3d25cb7b151f156de3b1ee347306d2bc23a920828d3831b06b
- MD5 923540c263c7e649801d996a5abe6151
- SHA1 622133ff6d471a1f1b34ee6c06320e744403f4ce
- SHA512 5ff4c3b28a15fd22f3294a397f638031e0a53efcf96fa7cb46e2397a193e5beab33dfcd627a5dfadfb136903afeb0b40328e41bea07551edaa9e5af2e855f986
- SSDEEP 196608:U1eO+SNs5e4BWrZay5LDTs4bY6Bj5vuMYAKzOZE/XZfZZ21jPB4:WQcFuMU7Sq
- TLSH
  T1D6864A94FFCB44F1E90788B088E7B37F8B34A7158025D6AAEE5C1E56F933701161A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/Resolve-DawnMedalDownload.ps1
- Size 6KB
- SHA256 4904908a060ebf730d43b2e2050f78fbe8e6926bf91e006ff3dd5aad47ffec3b
- MD5 3eecdc1d8020177a07883bd544d88c3c
- SHA1 f244f7cd1017d34071ff4cfea0092d6fb37323d6
- SHA512 8833596dad57d6c09871850cd9f9c59ba125ecfac352f775edfc5e4c780d75695297efc4b7e80d30ba9ab95dca1dc3301a5b90d07b59841a0ccd18ccd1205f94
- SSDEEP 192:IpRwV5bD/8H7mAaOyqUQgYob3OpKSzEQYjDSoyyCfC/7yiQfIgywDSMbMbUtySn6:IpRwnLeAHDjUWX
- TLSH
  T14BE1518A28D2549A1B0B70FD5CDD4A18B9355487244D0C20FEED82C9BFC8A3CF6F5799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $PLUGINSDIR/Resolve-DawnPartnerOffer.ps1
- Size 5KB
- SHA256 5609d4fcf3eae0ac800fd28f1a50b635d4fba1212b164e33a9c82a00e2d258de
- MD5 76bc89f928ebe612a2025946b30bcded
- SHA1 db355da25f22013c7e0163d519a8c70a1b4444bc
- SHA512 c75fbc6edeb30e32434df8e424e6d6ea19b8f61532ce99da588eb0847065d8e444b3047fa2e8779c6f5106fe893ebaf63bff24f135996fbf18d647edef30897a
- SSDEEP 96:WtShar1SsQFGlDzaZXWCrBer9nw6CbNNXL7yYGpiQZA/XH5/tLVZwjDn:WtShs1SsQ8JCrBer9yL7yYGpiQu/XHJE
- TLSH
  T180B1962B6C89E135365730790CDD2898BB3D808B121C2F18FDDD82A4BF76635C2B5B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16