Extracted

• • Target
    kJXKCT4k4KoB1UNhZdzKh3T3I3UUDdQkoKAqFbUZJLc.bin
  • Size 752KB
  • SHA256 9095ca093e24e0aa01d5436165dcca8774f72375140dd424a0a02a15b51924b7
  • MD5 0f8529aafd724904c63e634b90a560b9
  • SHA1 6e0dff42f4183d52bb99aa001cfa92248d3abb7c
  • SHA512 c434e7f92f9eb81fe2d6ff1cb450305613bd274b0ce312d0cbc6f4a40ad037263b2367fd7d88472f23282f12f95a20f9d21d3a433cf7896bdcf6ffd9625a7235
  • SSDEEP 12288:bfYu3EzNpkiyre4nt7leCPMXRGr1iZFom7zAgZpM4lRDA0LSvHio6iWGRdo:bfYTar9nt7xPMhGr1gum7zRnMIOvHi/P
  • TLSH
    T19CF41223B600CA83E96442B0D473DB7860B2BD6996D25A1B73CD7E2FB8F2363141B715
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloadervipkeyloggerkeyloggerstealercollection

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
  • MD5 192639861e3dc2dc5c08bb8f8c7260d5
  • SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
  • SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
  • SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
  • TLSH
    T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Bourbon44.for
  • Size 6.3MB
  • SHA256 7a7d0e125514f1a6b3a58a1f237fa99d6cc9720ed2c443dc6bd84d5e0ff7e61f
  • MD5 ab2f365f73fb5516bab0d928aedff3cb
  • SHA1 ef526174d3fe676dfd87e110f9e755e50a4a61a6
  • SHA512 ccb4e4373782366edb1176f2d39b09c2fd6dddc08de0fb9f0a6f071e584f16866d619a774d969b029c6d6aa1bd526f87c6cc24edf97f4bd6731839d61ed16baf
  • SSDEEP 384:Fn2ilYPY9kWJkjwjIsbWy6jJFqvrvAB51MrfyDIgtwop8NuZrm49QpA0fg4X49AE:Z+0c+nbYc0hKeJf
  • TLSH
    T1E0662267205C3B281477D9E7CB661927FC52B01EF96E748E95D1182A0A8C3CB32F2B4D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral5behavioral6
• • Target
    Gleg
  • Size 24KB
  • SHA256 26d6902e0e41b54402db39f5322e0820821f7e8b0590a1e7d903349cbefddf3e
  • MD5 c678baa47a73e88f64178da2437abfb3
  • SHA1 0c6e2bb6635a149d3103d5681cd55f33f5c88303
  • SHA512 31642a0ee9a2895129fae6060ad993726a7f5bb189549767128cdbcf74515e222aa70f2877588f10d5ac4805b309e196b52c5994458b35f573d2cbca6b5a0af5
  • SSDEEP 384:sz1TWhJAd/jBEPQ1meNHQylJEtDx6VoaZ0dga49DWWNXX3cBP1:sQhJAjWeNwyTE1x6zGcDNHs3
  • TLSH
    T126B29ED5DB77CCBEC8698538C06DD1A75C647009A90FC0BF31A7984742A72E27B640BE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    Hovedmenusystemets
  • Size 180KB
  • SHA256 43cc4c243c7993d9ab1182265a49bb3b8b5579377a9078770032ece7a8ca064b
  • MD5 a489c3e763195080f848bcab64adf9a4
  • SHA1 8ce2195f88eb6095ceec01d32ca231f77796bc59
  • SHA512 47385c82a9f3470664e4cbde46783b324e00940642a67881f3c1966e3af15bcc033ccd754af91065e2d6ff2ea85763b62b47672f3634ca36cb83ad68cafeac25
  • SSDEEP 3072:0QbSq1dmur61xdTyg3e4DiE0PaRiVPxcF66SMJ+0u93Ix/dzgusAwwwwwwwwuIJ:0QV1djAZqyiVP+Cp0u9YTns1IJ
  • TLSH
    T16804E17E4B1C584CD81340C7ACF23D662A6559170838C7FEA355FF44AB274A4EEB2E68
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    Inspicerings.ini
  • Size 569B
  • SHA256 d1b600c65c0262b5bfadb9812fa4418bd70ebd46d9500b2fe7f2ebeab889be02
  • MD5 86eada7e1014feb788cb7ed5ea06f915
  • SHA1 3e63e49c834efabd25633e815798273f9c491c34
  • SHA512 b571daed63c27bc2eef328c489ecdc496a838a2e621d775cfb765b8e30d7102621647078adf818e2922f49a23df9a5737f5a26be307d01be2284a8d62f1666af
  • TLSH
    T1A5F0EB32814397082AE68E5268E2A65E8A785494580DF0D30E9467AE7D484AEEC56F27
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral11behavioral12
• • Target
    brillerendes.jpg
  • Size 28KB
  • SHA256 b476c0db3a24bc0c14333063d83805901d932bc4cacde24f42c71bc98034b1a5
  • MD5 42de20133f8ceddd59e53cca616b541f
  • SHA1 7de6ff843a940b6243c69a0b8000ec8a9841a294
  • SHA512 3769ad91bbbabd13bb2284dd04603d38f6d35903c1c962242dcb6f5c0d28a56cba6a7d5a0028c8756e33ef0669ec6767f56708d531f93873b7bf1cd0924e6305
  • SSDEEP 768:dMA/uKgHDC/8n/YfbieppMbYgpbW8FhFt2rv83mDBkumOPtt:dhG1jCH2Ip4Ygg87Ftk82Dmi1t
  • TLSH
    T141D2E16E9882674514110EAA1532183A70FAAD17C6075BB36A70B6CDF30ACB5E0B7F9D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    komiteers.txt
  • Size 370B
  • SHA256 14d6cbdb9aacaa52cff223bd203f5643ead68fa3c4a1df9bb11a57f4ca9a80bb
  • MD5 0b7488e775911366d566b2eea6821ba6
  • SHA1 8e565ed3e73bb96f4cb7c8e4b6c8efbded65f910
  • SHA512 20f1c7746d34acefd441ee6462448078b61ef04c054db2350fd57eb9813eb0bafc236327150f95cfeabcb63d866bad3819c4e1283907f7919cda22ba3ec2b6de
  • TLSH
    T100E0F1F0F9149E905DD11293FC04064431769700CC039706F18A131C2203BD9A26F500
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral15behavioral16
• • Target
    kultursammenstdets.udf
  • Size 4.3MB
  • SHA256 2ac635d1406513939bf98d9d0c0ae23e6e5e2f259b661c6a47f9c2877a70d1f1
  • MD5 387c8048bae382600907c0ce3fa5a5e1
  • SHA1 c31662070462d1b473a045038853029b97c89d81
  • SHA512 e3d9494b631f505b7fd63ec33a47aa3cb4049c34ea5fa6e48b01fa6643790cb9cfbc7581b89116b9f31f3ffe63f977b3553d4df6fb35d17779a039d88510b373
  • SSDEEP 768:2cmeJcNH/wI1jRcc6kIcXf1VgTwRlPVI7UFbbqLzqQwATLPqOuoEwTA8B8Ifug4d:4if2FeBIKy
  • TLSH
    T1EE26125243E6361E76D59778AA0DB90838B7BBC9BC99383017D93477B2010889A4F6DF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral17behavioral18
• • Target
    overpublicize.ini
  • Size 143B
  • SHA256 24e2aa0e082fc468c1633be49e25bcadb0da6238b9496ab534cb02c8b94bbfb7
  • MD5 b1c61b40180ccfbbdd16c82038df9d37
  • SHA1 4b6ca050999b44128df26e273bf8b72d0280f352
  • SHA512 42597f52ec55b311bf061faa2c34aa8366702865a6a4b3eda8ff74854f30264dda460b15ea383e000b8c0a4f2e09c02c534e90bbec1d1a3e5d509567ebb2a07d
  • TLSH
    T153C08CAD2C278A16A71106C61704283CEE54813C8C02A14B380E4A2081028A8013802D
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral19behavioral20
• • Target
    recirkuleres.ini
  • Size 169B
  • SHA256 d15cf39fba2c0462725562e7a869bb53aa74dc0f32e7481edc1a67a4879f9bd1
  • MD5 2a58ed802023b61d48a30969bac2ba4b
  • SHA1 39a2cb244a31cb4b99774d7d314b543c0bd92c32
  • SHA512 5d8b98e43af5d0ce4a40ef9ac998948f4758da4c53a416587f6e92a68fb741caac0ae14bf7d57aa4125920d531d584200340da21a29832136a0cac14b9b06a97
  • TLSH
    T191C0C0161C9734452FE4D71441500D8221F00B61E6F3812230B38321D200320006202F
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral21behavioral22
• • Target
    rostrolateral.ini
  • Size 205B
  • SHA256 1fa7d7c8d95907591298d8b470d233a6cedfc40f3317f948a735c3e14eb13dcb
  • MD5 b91f64f24ab6b3833c2495a16ae63598
  • SHA1 1d305aaf5e1b4fb75e3fa0e485e0caac9632151c
  • SHA512 3d44c3527e93c8b453f3cdaa55f0bc52e045bcac6bd8cf238ac7ee87dadbd3d154225eafa0319eb4bea9ca2ec6a61ec5486849df54acbe9a57dc5ab27676d80d
  • TLSH
    T1BFD022A18EA3AA2C020A2441FA841271B3AC80D181A08A993EF3A7098402848CBB81B6
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral23behavioral24
• • Target
    uddeliggres.ini
  • Size 596B
  • SHA256 0949ddda1833c8ed902246c20ee5dd81ba6961eabbc5c9df814d069d2849d7af
  • MD5 dc81ab0d264a077979b4fdf6509a012f
  • SHA1 40147de809cfbab96850d7959c1be68e1fd643e2
  • SHA512 7b052a0a57632f26d4b666b1d4493025a4f86cfef2dc0d885653d2142d29a63345c6c747339b5837a39316478ff8a2d860ccbe53950a900bb0cbaffd2f665283
  • TLSH
    T144F04778CC8B782674C123257E759D328167800483391D7FF3D40E0D47885B8D9E4A18
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral25behavioral26