pykspa | b94861189472ae6c979758ed363bbab834fa2932b387943c67d82373ebd22371

General

Target
cihuy.rar
Size 478KB
Sample260930-npvrestgkf
SHA256 b94861189472ae6c979758ed363bbab834fa2932b387943c67d82373ebd22371
MD5 7293a7167fc0a3fc3d877f50d338fcef
SHA1 19f2177b096411247a5ec9dc9d60c7c119a4332f
SHA512 076a38a3b6eda662f5254d0739b02eebc1c5727eaed2c5fb5b97e845a4b32c82ab96acd8e67987e0370bedd7863370b559cd4977b29c7b1d04302a7c501129bd
SSDEEP 12288:/pDJkeudIrFQTNr8GrZnU4gxbf5FEUshsLb1:/1JbuyZQhrNZnr4zfsSl
TLSH
T13CA4238308AC4F9420AD589BBE7296236ED1464449F71717B1F61E4D3F8B2DF193A43B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cihuy/Book1.xls
- Size 20KB
- SHA256 4bd9be184d90d1fdfa8dd6ed067d3b7912d9cb19f1f5066f2900fda33d1fe6b3
- MD5 398d57893ade157448837ccf93c28a1e
- SHA1 190e8bb6501a8700feec3f661a3c2cd4c2c397cc
- SHA512 571a17df63ac7934f8d06ce02fd394200565177700571fa39007759792d20bc04ad67aa939b7454c03a28cb2b1231a464f9fe682b8077cec4385110834b30137
- SSDEEP 384:tuI2ErjWZ+RwPONXLkRyoDhIcp0fDlaGGxTqcLrK6zrApsUlUmrUlfldG:tuqvWZ+RwPONXoRjDhIcp0fDlaGGx+c1
- TLSH
  T10C92EEE3B6E59C45CE55033A49A783A06723FC515BA7838B3388F7262FB1ED09943617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  cihuy/Copy of Rundown Pengundian BRI Sidoarjo FIX 2.xlsx
- Size 29KB
- SHA256 1e5f4a52330a6ae3b53e57695296244af4a1deb8ea5db602e2df5bf8dea5ff33
- MD5 bf5edc0a21bcc7492ebe4c41a1576b3d
- SHA1 2add319e1d669bf40269e64c6df1a34c6e907413
- SHA512 54c5ed5616c06db3c0bd6d6d9d8aa586c84f0cd888f2964fcc86c6e0aff1f2effaffc615eb499688be090c777e1246676dfeb0c71453d6f2520d0f09d14e56d9
- SSDEEP 768:C1k14X1Cb1+1U10o+05SKyfK+IUEW6OOOOOOOOSN1mj1Y+RFrCGPdM3OOOOOOOO1:C1k1K1Cb1+1U10o+05SKyi1W6OOOOOOA
- TLSH
  T157D2CF97E0AC599FFBBCD838C040474453B967664336D91B8B15BA4F2CF6AF92E0150A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  cihuy/DAFTAR IWABRI.docx
- Size 9KB
- SHA256 a508bbc738eb7b74756fe7ea2a7f020eaa0dc3ca8a38e0c45b86dfd23f0e7871
- MD5 72fc667832e9dc018923a7003aef362e
- SHA1 168b185c1d4d837a348d1819c0c9662b737f867a
- SHA512 f53e3ae3bc7d8498a479684874c19dea80b2b223bf6796457b8d4baef24ac795474290b073640e30f752fa14b565569cb1b8c61ba7c127570c68ef536495fb04
- SSDEEP 192:a56NQP8OdfJYqCnTrNScnuLS61iDXzkJJ:aANQEOdfJYqMTXnuuwi/kJJ
- TLSH
  T118124AF7C261147CC72A55F1948A2949D737B94B9F3A3E0B3B61C90984FA4CE6E11249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  cihuy/Getting Started with OneNote.exe
- Size 588KB
- SHA256 ca06b143ef906fd71901cfa9b798e0bff22d530dbe265b2ac1bf54d06e511545
- MD5 65f0c8aa051a729c12e3dd9d9a324199
- SHA1 52ce17f0369920e554d7a526321c2adc43724ef0
- SHA512 13ddfd5c5f525a4ae7d5c8aa40d01f1b929f28fdd75f4d7d28040046d04db39fed4717407461d3a7759063d98f0ebf14228d38277597b53be640c8c876de1319
- SSDEEP 12288:BpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqs2Etr6C++GY:BpUNr6YkVRFkgbeqeo68Fhqotr6X+P
- TLSH
  T1DAD4C002A74EC964DD2A11F4D85FC3E59C6B2F62CDD6C1DB26B1FEC778706A0B00981A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery pykspa persistence privilege_escalation trojan worm
- Detect Pykspa worm
  worm
- Family: Pykspa
  Pykspa is a worm spreads via Skype uses DGA and it's written in C++.
  worm pykspa
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  defense_evasion trojan
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Hijack Execution Flow: Executable Installer File Permissions Weakness
  Possible Turn off User Account Control's privilege elevation for standard users.
  defense_evasion persistence privilege_escalation
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral4