a07d336992ad2dc7d085b124672389f589794b1e6a571051427255b5fa6a257a

General

Target
UFOlee.zip
Size 457KB
Sample260922-j3ha2abe55
SHA256 a07d336992ad2dc7d085b124672389f589794b1e6a571051427255b5fa6a257a
MD5 370d2cb498f31a48e646b1d98cd709e7
SHA1 022b670ac9a0da42160c2cb792b5d7e860150a62
SHA512 95cc554040d700bf93de175f6481285a15020dfc1682c82599fec20d1bc6af784033455945509a52fe8f078304009297d32d92b87627696d4d3387debf85b5d6
SSDEEP 12288:mhcIVogKZmmrJJvo5bysHTyTUoyp+/QkeP0:mhWjgml1oxBSyw/Re8
TLSH
T17AA423F65C3CED81A2696E560F8EDEE396C84A5B8316F4800CF42508589CBDEFC76539
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  UFOlee.exe
- Size 333KB
- SHA256 429be014260f55eb54c1422c7fcd16f5f5ab34fcb581486e30028ebce44da836
- MD5 cdf8756136c2cb33d20c50c36f1745c1
- SHA1 1d841d90985fcecb5660a9aa11a4d950571619a6
- SHA512 486603dc3283f43b89421c8d9c7f1d9b2012d3b16717ed47a21304b034e6e6b9b40d342f2abbce51a0e49294aa8c976bd2129b3b79fe1cb76b15350596d9a891
- SSDEEP 6144:cEpcXuZ54YsgB/THx/2M45UKqGIieqkIfH8ZBxynoULD3Yf0T:xmCLsgRTRIZqGjQIfHIBcoo7T
- TLSH
  T1B37423C50A067A9DC4D72875956839E1CE24F71FA3AEC3E13D9909C8683CBEBC449DD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware trojan upx
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  WebView2Loader.dll
- Size 159KB
- SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
- MD5 0243cb84351c92ddea3fc0334f3a52ae
- SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
- SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
- SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
- TLSH
  T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  app_hook.dll
- Size 96KB
- SHA256 af36936f9d4fc86a45cbc209e7ef33f96aae446b02c0b82a9be502f5afd3e4ed
- MD5 166f172668adf4e55c453f5aba5164b9
- SHA1 75dcb80f980a30415c2ba37394acf007b4751c2b
- SHA512 9c64ed945908cfd5d377da62f2c0b08b02d4dacad5d9fdc7ef7f00ef6d36e0bd4dd6c9c59b6a8e0d90f5c335b56086ef71fe248629ad06b84648d4002b0a5ee8
- SSDEEP 3072:kcv7flCzRilaRoG31I6pps2rCkwx6S78+mPO1t:9v7flARilaRoG3U9QO1t
- TLSH
  T1D3A36B12F1C324FDC656D17091975A72EAB3B8240520FE7F12A8EB343D62E51BE2DD29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5