d38bfbbe470df7edba1429efa044e22b34b7a066cb25e9fba784c4ea1c54b288

Sharing

Copy URL Twitter E-mail

General

Target
Archive.zip_Archive_x86_2757.zip
Size 836.3MB
Sample260924-py4lcstgph
SHA256 d38bfbbe470df7edba1429efa044e22b34b7a066cb25e9fba784c4ea1c54b288
MD5 cfb0e6feea9c5283ed786f346409c52b
SHA1 6711672a46087ea6a37c505ec6e481f19fa7430f
SHA512 0eedee45c6d43eb0f52c458da1cabb134016966c03a741c25635217dae21e5c3331f3889459904b5fc1ae610dffc8f0f0f9b95aa8cc20f384551e04ab3a6ca30
SSDEEP 786432:evN1XH+aa4VWHn2I5IuJaP+FF/qO0zX0vXihnPYz5SQH0TZZoO:evPuafsH2UhLFFSOskviVgND0T/
TLSH
T14F993314896CD8D7EB537AB4B470C197E62F51B231DEA2DCF99A32746C86C006F2CA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2
- Target
  lib/python3.9/encodings/utf_16_le.pyc
- Size 1KB
- SHA256 bace53ffba34a92409552dcad8aa1c476db925157fd3255344ec3bf0de374d98
- MD5 3bc7a2a7167d687b65d941b0586c62e3
- SHA1 0078098c6b19735fc101cf6816a6c302e8a92a15
- SHA512 d45d67c74fa0daf70bda7b9fdadc33220560422553271c7fb001a433168213078c590b63e40c23de1e5a4f11ed103445dec8c36c933fdc92441ffc8f19be10e6
- TLSH
  T1EA3154C856426749FD5DF77E000ABA2C1D5D1235B204E5877F89E1A6CD452902C33B1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lib/python3.9/future/moves/tkinter/__init__.pyc
- Size 728B
- SHA256 676e3ae411cfda89c088e75d5d8aa35ed7a43c107e84c58578b1a704bd30cf71
- MD5 ec2089e3d6fef0f16e16aa4d91f3d408
- SHA1 6c61c56075fd4534c038a190b20ccfd923b3394d
- SHA512 efc6679d64678324ae6dc1563bdfb6e7b89bcf908a81fc39d45cc462352c35befffdbeec2d58c062a6b5643dd26b7a4e36f4adc891c722858f88a547dec23cf5
- TLSH
  T1FD01FEDBD932EB36F198FAB2B2AA5332C0F92C7D63C578247A4C96310D4B1A09438345
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  lib/python3.9/future/utils/__init__.pyc
- Size 19KB
- SHA256 ad421d571f9c34c86b7f88faf45e0ff6d4239a526b5f84dd75a6dde7e523f9f4
- MD5 70f2cd4b2ab8cdf0f934a2104bae7a04
- SHA1 82766889ad22fb08ccaa33424fa1cbc7b42c47c7
- SHA512 4de7f614a482c0054df3c98cf6288e2b0dc0687f28e131621ff5fd75deaa1f7843aa894e87e0d65791a5214ed904879b4d2c293832ac296dd0689dc43288abd2
- SSDEEP 384:E9bcSLAhzg9VPjY92qjBiZbsruynrBAPJGcQaboDS0yRJx8iFeD75s9bZELQgGbe:4nAhzwVPjY92qjBiZbsruynrBAPJGcQT
- TLSH
  T1D792D5C25FC45D57FA92F2F8C16F6244A314E237B3449E96B46D81BB2F062690E70DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  lib/python3.9/getopt.pyc
- Size 6KB
- SHA256 dc4ce1554edb6d58a276b90b8166511923e599eb74020ad16853841941fc4980
- MD5 56512ebf99c37e2dbe75b2530e39fa12
- SHA1 97dd4927c389effb7a27ea679b964f437d2c8f9e
- SHA512 fe3e9134e9a30747ba00b87e193c5d1b76583800d98e14fb989a5f51939b8ab44ed2debb340c866f85a3ff9e90f06698ae695975a6fc33ac351a593aa44bf640
- SSDEEP 192:lyHZBFFEWHQZsncPyWwQky97GqpY7CoXEl:I5f6rZsncP5WyBGcY7CuEl
- TLSH
  T15AD1C6823AC563B6F8DBF0FDF12757595234D3B5330990422801D3E41E63AA6A773A5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  lib/python3.9/getpass.pyc
- Size 4KB
- SHA256 d8cbb3d73ce1b6d9f30ffe73fb25cc691073057082733acf6d8f3ea701bb009b
- MD5 b930d99ac2d4808172360041687908f8
- SHA1 aafee86da659bedc0cbfb03e53d17a9902e25973
- SHA512 a50915013dd1f97950d2ae2af297e603e37bb243711103bed7404d5ad7b7d5bb15a42dee2adba04ccfe603f796109a2832ca8eae7cc61c62508d4fbb46173352
- SSDEEP 96:HptoLt8i52fJDxwlNzPfQaTja7iLVAf6QZEvfE/7zt0TY:stifAHQana7iEdKcTz2TY
- TLSH
  T1FD91E7A6F2002B36FD10F3F1529E43F19296F13B126A85513C7DD21D0F9A99AAE707C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  lib/python3.9/gettext.pyc
- Size 17KB
- SHA256 7c6c6e830469505bd16bef97af05e284813e7256fc039e2717194794221a36f8
- MD5 cc993ba4003be2f30451817bbfe47be8
- SHA1 379fd57c8002515eaccca62d7dbc5cd739514e19
- SHA512 25faf07bf63dcae2cb6133888ab0e07782dc72f93d2e488aa210ac4c47dab6a9883ef8bbb1bb6e7708a91602459fe6a3a5196ea5e951ab4b4de581027f825249
- SSDEEP 384:J+1IDH1syB8wdQY9WtZlM2IrZb9BDsSrFZBuv5u92TMB2kZzFsBk16MJ/6U3:J+1aSyBHaYIEUozQv5E2TWLdd/6u
- TLSH
  T17B8208A9A54145DBFC13F7FD42590B60B228D2B613599823761DE1871F4C7D88EA3ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  renpy/warp.py
- Size 5KB
- SHA256 d4e4f2486d10f4cf243d2356535b745f812c1fc374cef4e1be619bf147f9aac8
- MD5 dbdbc6311e0f58f3c34c6f0eb624f1e2
- SHA1 06723bc833c809af4cfecb7fb80ca1f47e20fb6e
- SHA512 1ade12cea9e0f5dc677a70f22d08ccbaacfe9adf3cd8f22c3cc1622f0fc57890c6be768d27897fd2fe96d86066dc4c8c7d8d9f632c9d023452a79e1df0473d20
- SSDEEP 96:w1zPjdwQHj1/Z2EUga1hWLH9nmbNgKyB00ggTMqFDh0yl4Vf/Veyurh:w1dwQHjJZmxWD9mbN0NmpVf/Vxu9
- TLSH
  T107C1B52B69251365A31714080DEBA19DB31BB86F1AC115E4BDDCC3146F92720A7FA7CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  renpy/webloader.py
- Size 9KB
- SHA256 3b51404342abec20ad616e5e448dcfec71b54570552d0083d30792988bb27001
- MD5 c9260040c2057f8f909f0f299af595f8
- SHA1 ead87e9734e78c785c2dae2280029d5410e12e7f
- SHA512 379a0548eeea084899c8ee91889cd51cdb25a470f8d459e2c0b1274b1b6cde9ff4b10a7774ad3ba6faf04c789b29a41ccfe700de57dd21412347fe8561386a84
- SSDEEP 96:w1zPjdwQHj1+y3vZqGk4apLgCG9WTtX2u2OETxouJzxBb7chClqQ9iL2HoYLNoaF:w1dwQHj3Acap0CGYXGXBOW9oI7EJWv
- TLSH
  T1FA12190FAD679092C303A254EA1BE086B71918D7230CD97574BCE1A06F92570C4F7EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  setup.py
- Size 8KB
- SHA256 5a2d8e648e3f4cbdcd32cbd2bb0ba48d10de32fe14042e201a8bb7088cefad79
- MD5 f82bfb01fa17b87134b14fc21ddacb74
- SHA1 7b2c9342a390253dd012d278a2b9ea83e1759827
- SHA512 ff3d5de26bf951e00cac2c8bc13fb015235de569c6edf95e8b2800ab3a4126c974d817dfbf475b4a9b57ff0b0306deb0e389411f43162fc7aeb8e970b50d8aa0
- SSDEEP 192:7X1dwQHjiJqdt2RqEq1ShhKBqMJx45KB/H/osX3qzbFsqLdx+aHv8UTri:7wKiwdtzvMhhVMJ2KNf9XatLn+A0H
- TLSH
  T10E029696B5D536918313AB58D8D6A0C82217E9E73EEF11783ADC33647F6091043F36AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20 behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Indirect Command Execution

T1202

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22