db9f026770a0ee3a5e442235c4ba3051b009ad9886f06342d910a3beb5919468

Sharing

Copy URL Twitter E-mail

General

Target
fluorine bridge.rar
Size 18.3MB
Sample261011-2772csba44
SHA256 db9f026770a0ee3a5e442235c4ba3051b009ad9886f06342d910a3beb5919468
MD5 56171fa758757adac556097e0a3083a0
SHA1 d20bfd273802abe452fca6ed8f275a14790bcf55
SHA512 b93ed28a874e895bf37f00653ab9ad2acf17a80d177b892cf0334c801dece99f288dc504df6d276927e733ecb512b52d92178b565cb8887d2e5111ef2ea67e64
SSDEEP 393216:YzmVWFks8svCJ3afXzlRnd4jtMhjX0ZVNuree:hsXfzllejORkVDe
TLSH
T1D917335373F15DE521BA34AD660F62538F5527B4C3BC346ADC47ABD9288A683B40CB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  fluorine bridge.rar
- Size 18.3MB
- SHA256 db9f026770a0ee3a5e442235c4ba3051b009ad9886f06342d910a3beb5919468
- MD5 56171fa758757adac556097e0a3083a0
- SHA1 d20bfd273802abe452fca6ed8f275a14790bcf55
- SHA512 b93ed28a874e895bf37f00653ab9ad2acf17a80d177b892cf0334c801dece99f288dc504df6d276927e733ecb512b52d92178b565cb8887d2e5111ef2ea67e64
- SSDEEP 393216:YzmVWFks8svCJ3afXzlRnd4jtMhjX0ZVNuree:hsXfzllejORkVDe
- TLSH
  T1D917335373F15DE521BA34AD660F62538F5527B4C3BC346ADC47ABD9288A683B40CB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  fluorine bridge/FOR-YOUR-AI.md
- Size 4KB
- SHA256 253a584ccb109cf1a8c6c0b020e5223ddbaecd8c05f4c03fca523920f6a207e6
- MD5 d209f65834721aa7e95907ac41303693
- SHA1 79b9092a9914d032cda892c25b91d61978f3f8ab
- SHA512 b1782e861560ca32045c96668244b20fed37a76a2d7ba0a8f7eb92e417e530f7ca9c6ed44b03542b656716253c6a58f61d13a3e61e8cbc181c8996d542b0bd42
- SSDEEP 96:eaCknozLkI7CvdFMFf7cAyT6+AvNylgk6AEWjJxmkb7eWTxNVS/KUP0HtCR4yhW:eMIrj1xdvcNEWjP9LhO0HtkbU
- TLSH
  T1A8A1F8BEB354277908E814A17F6E64E2DF29C216D2582D79909C80ECAD0C76D133F7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  fluorine bridge/README.md
- Size 4KB
- SHA256 ec2077af2230094b4b6e6496d6d295ce6722d86cabd2897b851ea9dfb1517a9a
- MD5 7ea6215d03d3547a8f7579952a7ab7d2
- SHA1 46fd76861b2ac3eda6f4a9b89be51bfffe3a1660
- SHA512 6558a0bb43f0c7be8affc636782fcad354128af4538c54f351f041dffe62282f5d81dd58e0ced2c919f8f5be5fb9737261c7e8c46d96e91382c14d078f2a2162
- SSDEEP 96:t4j6iiKI8ruym/UzrI70X9MIrBVhrk5Tu1ALoNGQnEe9JlDP8VUpe6FRTivCjAl+:wr6/UzrIYfJuSALiGQLh8VYTJ1
- TLSH
  T113A1D67FE6442A750EB40D703F5ABAB59F2DC4299306247CB4ADD0EC2F0DA3E0576691
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  fluorine bridge/ZAI_TOKEN.txt
- Size 157B
- SHA256 f271354ccb44865b58cf4e5cef647bb4100fb3d5a801f14dab32302bb16c0918
- MD5 791dea5d77d8fc817cc47b67f418992a
- SHA1 955089260e141d466609184d7eaa6f402ad19532
- SHA512 0aefc91d8ab0adba35a6687c2c14ca53fa611e7b96016b5afe8bd80039b53fb0a7c09d016d6fb4d15b1834f2cd394a73f6da29f9495f9aa42a6884ab003a1318
- TLSH
  T161C08C132E010E07025A9C646611899069AC8A5EA662C676A13D16B042B89B022C17A8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  fluorine bridge/start.bat
- Size 3KB
- SHA256 aae01b9fa9c0e9f8b8d5e9965b0c899f53caebbd9ea4b2fb38afb06cbaa85571
- MD5 0392716baf435c421deb8fffcf256fcc
- SHA1 9bf2a77103387696826056411ea8ffc5a8699ee1
- SHA512 877ceb4a461af5f4c3fb42542e54d84a67542aab69d542580b850f837b55880e6ccee93edd7effbb140349111808e2b33734ea8ae209278438a69f221015477f
- TLSH
  T1E48173373E98522604D7CD469C9801F3F20B80FB4A0569AC755B8278AF1D3DC25BE7C5
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  fluorine bridge/start.ps1
- Size 4KB
- SHA256 d3fcec51811f553bfcc86afcb8217eada0c9edcefe309df044c99e957bba369d
- MD5 35db76f6684fbb0c60efcfa076817ec9
- SHA1 976f29711f1982c9b39e2986c3b83d27b30ef88d
- SHA512 05c1061ffcf342b17f41f16b755e4fb847524bab6cd9416fdf410544912ed5df647d91cfcad49dd060fc41b5c68d66392eaa93931a9197459acbf5b54b593207
- SSDEEP 96:duaQgx5LN11EJFsnBtU8t8bYzWn3WV8qQE2wdN/AZIyR:du2CJqnEA8bYam85EhN/iIm
- TLSH
  T1FE81B82DE7A5133815F9445B5CADA1BEFA99903E45093A60B49DC0C87F9E0AC43E72F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  fluorine bridge/token-collector.exe
- Size 17.6MB
- SHA256 c8f34871a651a68f7881f07f2d37164389846d81ee04af6c180c355ce4c0e154
- MD5 16af579d90255cee589677aa8e734410
- SHA1 7ba0e87ee9f136c243941d39652eb67665508303
- SHA512 09e5ba0aadd227068f75562623dbea499939b7f73365039565a9cc5b9636f5429e43c204d43a2e1ae3eba58afc3a1c473f102f1aed5bd6340cf26f563f6f92bb
- SSDEEP 196608:tkbJgt/TjT+smbgs2mMsxco0typgtp/jIBQK7KxuJ:tLtbj6zg9sxuHp/jIBdbJ
- TLSH
  T1DF178C47EC7515D5C4AA8276C66786237B713C884B3163D36BA0F6392F36BD0AEB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  fluorine bridge/zai-api.exe
- Size 19.0MB
- SHA256 0f5d46b4d2a015e59dd1a895e04015d686de768f7d1a4ab58452ab514d1b9e56
- MD5 3f3e638a77539fefcb1fe3d67fbd2203
- SHA1 69378b1d9804acc6764e53cb78ea00f50423a3ff
- SHA512 b12569da54dddbd7c6d108dec1fad1d0fc59298bd5f4834521a99d345dfb0322f49ef259a6f23d408949397b77cdc97c6e0b25208f7c433e15169b2f8dfe5679
- SSDEEP 196608:upU6Sv6ub+3USup/9I43IviLovtoWUwy4nI+qNXY0vI:uS5SZ3UScIaC+2IjFv
- TLSH
  T158177B47E87905E9C1ADD276CA779A537A703C894B3163C36B50B6342F32BD0AEB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16