aokigahara | 90ba3d86cd04397496adc3843d9a054705a35991f3d591b4a0d6f55c7f50cdca

Sharing

General

Target
Files.7z
Size 574.2MB
Sample260916-re76jsbc53
SHA256 90ba3d86cd04397496adc3843d9a054705a35991f3d591b4a0d6f55c7f50cdca
MD5 5161e6158aac7098d970e14973282573
SHA1 8f730c71c97f14ef309737d11efb79c0eb2f57a9
SHA512 ac45d8a5aca5a3e13a7548c92ce8a98269235f03463de3548fe60b49e28d42fec1317591f38abe4ff1eee94c0f53aa28500f5e7eb234cd2e365de5850cae7141
SSDEEP 12582912:ffLp5vJMxWWMJhLw2xKc9OfuRJCYejLVIPfr0iOdiyW7bhFK/HL:ff9/MxWVBLx39OfuRCE9y+bI
TLSH
T1AF5933DEB419A18883027773BEABA019057CB67DD09ECBB7249AC029C3C554763D1EED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Ansiklopedi Setup 1.0.0.exe
- Size 89.3MB
- SHA256 38438e1127cb08cc237c97c16e7642ce08f91c9c702983b8035b8d6bc17d2577
- MD5 09fbc545255d9442b57892612c0440d4
- SHA1 8719798c058b84841afb025bfc2fe3136da78b58
- SHA512 6c0c6455011225e906f41ec1be1684c439de2c415a03083189bb2e6636dd008101f21d4e41ed897049675fddc287ca64a5919fc42e5f8bbbef973c7f57d78f77
- SSDEEP 1572864:8iAistcoIksESPaUfZySXFQ17G6RUI7z1cjr+bgoDAbTwTavRJUf3VwfGit65jHL:8iAisGoIXPZySXFQhGvEz1ckKngkGHjr
- TLSH
  T1CE28338925256100C33413FF7F74F3F81718E5284B46D6D3A2D8C47ACAB9A9E33956EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral7
- Target
  Ansiklopedi.exe
- Size 200.4MB
- SHA256 7783adcbaaa224e9b780e8d969af57a24e4395e4f27e4262ab18b3517a8a6ce3
- MD5 616bd3d3859bc6c2f0ea895138aa2154
- SHA1 4ca83fddfb927b583ffebd3db3d507ab3888fab5
- SHA512 39b3d178a8dc294abe1f916ed836acd7a2ed94766f75f2a71de282937b8a60ff175df108635bd355bd9b98dd2974c7d4fb94f95c7141d15865cc3996c37c3824
- SSDEEP 1572864:qir3YkVksSEZWaMZDjL3r2sHCDTnq/jxOiuYSeh019IZQEKzVn7SfK4lJroH26Pq:jIAnVb+/jVSbxkg
- TLSH
  T1C5A88B13E29601D9E05DD1758B5A9633FEB2B80A4B24A3DF2B5407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral8
- Target
  BOM147-Tasinabilir-1.2.0.exe
- Size 54.2MB
- SHA256 2a50b207a98c026d4b61dad692fa921a8bf57921c43c8a370c6756bd6dc749d1
- MD5 65cf1e4e4217ce2ba4c515f902eb90cb
- SHA1 a5e24c518612ebf0d1280103ec53ded7137cd67c
- SHA512 fd87a305929a25c1ab236491f0d2cf8104746bf27764b94dd847cb8cc1dc0ebb1b377430387621fe681a490d416fcb8c7adc94f7533d2c462cc43dcccd9c740f
- SSDEEP 1572864:5zbY69SQSdzvOQKlDOZVeAdoGrWNnN8lFE65ByabVpQ+Se7:Vbt1SdzvtKlaZVLd/WNCFEhgXH7
- TLSH
  T1C6C73375FD535EE9C009FA39AA04E1150A6CA707C5798A51C8A137AC70421CE5FFEECB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral6
- Target
  Centra_1.0.3_x64-setup.exe
- Size 12.1MB
- SHA256 26de84b9273282df95aa1038242861c12031329cc93ae5c3cc027d6044cedad9
- MD5 223856ad38bbd450c8fc468a85eb6cf6
- SHA1 9e2ac97f647890309b106e252330668e5b1a0bc4
- SHA512 fc7f2d1a34a1f06a4e32e6e4a912acbecb9a02c2a7efc0e3946037eea93b78ad62698a044d710cec5087e29fb575351f5ddb1a3b0ccd42572a2428def25ee575
- SSDEEP 393216:wwoiP7+h5iY9brOJUCLo4IKwbSb11cRrvjYG:wwoiD+h5f9brOJJNIv66RgG
- TLSH
  T16CD633E0DD45C0B7FD88AA72E091CD36204C31F5A909CEC945EBA8553EF5BD521BE8B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral5
- Target
  Release.exe
- Size 85.4MB
- SHA256 b69ef895e81fb7a267150605956765044516ec32d6c2aa02c73ffb20fe5070cb
- MD5 1251155ccb30622006f2408a722c3439
- SHA1 b67025d5685e56a7465d14794dc6de65dd2e4ab8
- SHA512 515aa8a44a52e25bc2f6c5c98dae1a1314837dd3aca3ea83b5beee6a894281568d8392b19866b6848d8da0c37195928a771db9bb3e5ea502709ad2d5c46525d0
- SSDEEP 1572864:bLdkzcSawWKa4XIjpyJJf1VDgKZipTenyaX103SAr4r3x/GlCQ2TsbZRC:b21WKaG2yzfVZaLB4bB5YbZRC
- TLSH
  T1991833DE8549F6A6FB12A2311F221FE5D42836D6916E897730C99C38E7321279FD403E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution aokigahara donutloader loader persistence privilege_escalation spyware stealer
- Detects DonutLoader
  loader
- Family: Aokigahara
  Aokigahara is a Windows stealer written in C.
  stealer aokigahara
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  Setup.exe
- Size 124.1MB
- SHA256 8700357287c82e270197354a18f5654d52be890e518091d78060346a03912cf2
- MD5 5c5bd9fe6d6ab19525a132fede2e78e8
- SHA1 7de8947222c483e670caf64f8ff5a44176eb209a
- SHA512 1f41e95efc9614e0a40bdc889978256f981c243be65a37f8272611a569cf871a3f0752f10fda44cc562ee18bbb2f8f9058b04fa1a9cec9919aa2e9ef07990124
- SSDEEP 3145728:CNBtvIMw0fUZPh1/xbnExIMw0fUZPh1/xbnE1:XV0fUZfdnjV0fUZfdnk
- TLSH
  T16E582256E2FD00E8D4BAC1B8C6574627EBB2345513305BEB26A48A252F37FE16E7D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral3
- Target
  tancerscanner.exe
- Size 68.3MB
- SHA256 5c7889967b024a5a22832cc6aa442463a98a0c33f932e71920a9d0e92a9e5416
- MD5 d664aa20d546ec6a9ffab2ab8bbf11c7
- SHA1 b8834842e03c33c9023d241d5087e28dbc508a40
- SHA512 61187482971c46bc92a67379dbd127df9cf8631e20eac70b5177bdb5bac56719cbbe7f2a27515ef10a1f6cc90e1c3884ccbfdd297bb98c3309f59eaa4cb1fe03
- SSDEEP 1572864:2HpmdNebTSXYElokQlC8cZ7ocnpn0fyqU1aWEUyGgxdnXuM9C:2HEdNebeFQl3cZlnh0fy7oUyGgx1VC
- TLSH
  T1D2F72356E2F900E8D5BBC0B8C6575517EBB1345913309BEB52A48A692F37FE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  ÜnPOS Setup 0.1.11.exe
- Size 247.8MB
- SHA256 b8a381f3c8a4f074a46d276a0776f132549593b0d9c88ff2fff7d6eaab62b19a
- MD5 96275062f08a075e0ad943b54b5ea08b
- SHA1 2a4c809ddb9355ce61b9bb995be08a4a9fb8421f
- SHA512 dd03c24849f9beba477da2831f74418d5b872e964afb5a0c463331f435f710897f3d96859a0ec352a6e545655049b312701c8b0d7837cdc7ac226c20385e4d66
- SSDEEP 6291456:1HNo80soWqygyma+uOq5v8oNe1nFngOq5v8oNeYpQ9ooooLoNaYHVixp:Yvs5qnFX1q5v8Yevnq5v8YeYK+DIxp
- TLSH
  T1D3C833CFA465509DC34B6B33BCE9E01205A5F7FCA2AE7317282D811A83C5651A3C5F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1