a24750cebafd7fcfee943991effa00126bbf136c9190629b301c881b1df27043

General

Target
DahliaControlV2.0.exe
Size 254.9MB
Sample260928-rt99fswene
SHA256 a24750cebafd7fcfee943991effa00126bbf136c9190629b301c881b1df27043
MD5 05003ad28aaa9b33b8135dcc7bc26c1e
SHA1 a1aefc218087f84884ea14ee4937eda4a9c0ad0a
SHA512 129107ba1d80f22ed1ddcfbf49449c602aab85e405396453b8029147ede4b39ad8f11dd7f684c07b0091dfd532abc7403d0d80445b2197620fdcbd32efae30c9
SSDEEP 1572864:ngyOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJr:ngMgmeNxNNZxqVknoJhrO
TLSH
T100D8AE03F2D691E9E099D1B18B8A9237EA72BC555725A3CF361807252F77FE01B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DahliaControlV2.0.exe
- Size 254.9MB
- SHA256 a24750cebafd7fcfee943991effa00126bbf136c9190629b301c881b1df27043
- MD5 05003ad28aaa9b33b8135dcc7bc26c1e
- SHA1 a1aefc218087f84884ea14ee4937eda4a9c0ad0a
- SHA512 129107ba1d80f22ed1ddcfbf49449c602aab85e405396453b8029147ede4b39ad8f11dd7f684c07b0091dfd532abc7403d0d80445b2197620fdcbd32efae30c9
- SSDEEP 1572864:ngyOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJr:ngMgmeNxNNZxqVknoJhrO
- TLSH
  T100D8AE03F2D691E9E099D1B18B8A9237EA72BC555725A3CF361807252F77FE01B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  DahliaControlV3.exe
- Size 168.6MB
- SHA256 bb726349d996c1b8e056fbb0abc8b2641324cc2e910708dc33a49b3e45f58eec
- MD5 e3e10f77220300932208994ecb27bd05
- SHA1 aa5ad61d31e1114d39d59df5af510c9f959d637d
- SHA512 a32245d42955a4078ea189ed14b834d3929bf4ef494c375724556c4308c2bc4a34253db14cb5c3f2bfd033d62ec2971e22aedf6c422060078549a9f75908ffb6
- SSDEEP 1572864:HOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:7gmeNxNNZxqV
- TLSH
  T1A2887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4