203b12b14160f19259d2297af9b42a27aaf696f6a9c9019e6a130075b07280c1

Sharing

Copy URL Twitter E-mail

General

Target
Real-Executor-for-Win-Official-Site-79025.zip
Size 17.9MB
Sample261014-w1zhrazvbz
SHA256 203b12b14160f19259d2297af9b42a27aaf696f6a9c9019e6a130075b07280c1
MD5 2ad6a39211bef80ee1dbe7646cbbbc6c
SHA1 4a5752e3cd70e0c0042a1bb7a8fa2ac14c27dd94
SHA512 886fee2ce0839f900d1d85bf9a8affcb1ef6ddfd80a65dfa50f9ae5f70a02e4d0e45c1e39d4ae413d7d8cbe3e07bcd41b7d1b6be25c3d118a78fbc6c6c3338fa
SSDEEP 393216:/DmqBFonM6AKPfJrIsCFK+rJELiP+pdoEKDRon3YGo5s20COt:77BOMsfJrIsC0LiP+dhEdG20COt
TLSH
T1C11733400993D6EC29FE0738F739809656969EBF3B3C30505A6A8DA0998BF4C93CD55F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  WizardPackage_755864.exe
- Size 125.9MB
- SHA256 d76bc68115e015a9eabbdb8678a8da0ddcb9659a5972eb13ee13785448d4b4f6
- MD5 f49888ff68c3bf3a8c148d0dc4e12d1a
- SHA1 5c33e2b43ec98e75fc786b4e06142b4ef0b91821
- SHA512 9397dd12d282398cbd28aec0c1373dc80e5f1ad74b489580f73da67140a2790c094f591c063fc46c6d7412fd44af16558efd5b024e749d1abe881dd412854838
- SSDEEP 393216:rM6EI/RK9IYUuZx556oKz4qJdCzibm1fwY5Rbmeq:rdZ/UIYx556oKizib2ftXi
- TLSH
  T19158E3B13DC121E0E6AECF17D6FEDB29D36667762A113C0A047767940F22782F64681B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 140KB
- SHA256 276cb301f9d140553d21016970a8d46f48f2d3532b767433c9ac369ecb86a314
- MD5 21f61047b89f3be40f2a89625c55b93f
- SHA1 82882c3fb5937a8f6f7e2b7e01428617d3659b2c
- SHA512 e87f900f82e8fafeddf49c7f34f0042abd3058ec96a2feb21f40576a51df34b98318b5bfba3e46bb4f0bc2a2b258edebd5ab1b56fa94d6304dc6d46d6685b413
- SSDEEP 3072:Pj6KCd8JRVpzIKKjLhHzte/ET0n1/r/R3d1rDCMmhmpdC:Pj48JRVp8tpz78l3dhCg
- TLSH
  T123E3F150EBE8C4F7FA694A34B5B22E73057E7E682D208543D233459E9927381F82D772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 133KB
- SHA256 0284e9af04b5422029bc67c5193ff88e8e1b2232aae558ef9db746a6be664b63
- MD5 8dcd3fbdeaf798b69109e9943f1a4e57
- SHA1 01ca56f1c159038ebd4e2743a6fe89dd0cbf1638
- SHA512 ad815b611f51df51b5ce9b63af7562a0103345968d38e327de9fa690cf7e21f8111b498d9ca8b953b3e3b398d065e19336bd8ea497516784b67a8a0d94a081e8
- SSDEEP 3072:yTiO8oOREL1DIK5sylbhZalWnI/NLLAqw8gKT5vM:yTiO8teRbhZIGkdRa
- TLSH
  T1CBD37D0275E5C171D9BE153828709B645F7F7860CF60ADEB636409BB8E702C09F31BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Zippex.exe
- Size 7.2MB
- SHA256 879e995719d9b7b9ce08f56799b0a71e0b29ce560986e7a9cdebdcf9c1d7750f
- MD5 2c3d2a6abdf462eede420fb83f28019c
- SHA1 79cc4020261f6421d2cba3dc80d3700be5efb7d9
- SHA512 e4d0c666290e7d34363164ca9550633f93b2e368d262667d35b3ab45787b0060d745db52c3d4afd5076cd1dad94f152544f1164735028188fab952f42e83fd8f
- SSDEEP 49152:N6Nvy2QHz64ITcYKRdtkqzGEKmImuA07ya2lUruRhnHk3ACJZmmzMhsbqp7uPLVK:NSvoSKRzh9Rhn3p+bqpGcshVHzMHbz
- TLSH
  T1E4764CBBB2318768C0D6C67014538BF28FB07E65057A27422185372E6F75D906FEB98E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  dragdropfilesdll.dll
- Size 2.7MB
- SHA256 e4acd142d36a3a16532c85c9a7ccd50f9abc25721fa35706b16f6ceec565b44c
- MD5 6f73e8b6c3e4bfca9732100db6367ab7
- SHA1 f59bca521053e1593b2a7fca2bb36bfa14281f4e
- SHA512 a30cce7a3e6a8326abc4e5c4d6e7861bfe35cc2e5a7e50a56fa57d77f14da9eca4ca22037673b41e16e93bb4a17278c897fa6cea71dbf9987c3ec1b6a970aaf1
- SSDEEP 49152:HvdUSfVPXpdbqjgnODT9mz/QM9wQcD2oj+6ByvRtI8/:HVUSf1bqjNP9+e+cSd
- TLSH
  T106D51ABFB132CB58C0CFC6B46097D9E25F207D6404A5034672CA172F9FB6E406D99A9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  pea.exe
- Size 4.2MB
- SHA256 8cce1360e7a4ef635d6d2fcc0a130615d8ff5e9339c095e5e7626a95ade42055
- MD5 5e78a604eba3d5f83bf1ee15af719aad
- SHA1 22fe8799946661c505721a813cfa15527c274361
- SHA512 60ec6728e84927c337cdd85eca7ead31b787e71bdc215d78a696da66a082c2eb5c4cd41e1960ecbc7d0ca88e69fd235b5c2d60ab2ba582c89faf78a1910c556b
- SSDEEP 49152:eEAYqqHqq6eqf9aS71vzy4ZbqRqB+nThHH/uL2N/hVmYUomWabw6BPOvygQ8:z/p6eqsSVbqRVTh2uh4h1gl
- TLSH
  T19A262BFB76228B98C0CED9742093C7E25F30BD1804B5138662CA375F6FB6D502D9999E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  res/bin/7z/7z.dll
- Size 1.8MB
- SHA256 bbd705e3b58ca7677c1e9e67473f166a6712da034dcb567d571fbb67507a443f
- MD5 cc5120e106ee9bd1842db09e145f9727
- SHA1 6b505a53b6ba8415e4ca8257f0937ab2372fc3c5
- SHA512 6d3e62a17a2e3001eccec23899198b5d77a1a2ad0d7ef25fb4151faecf63a0b50d7d1fd94139b48baf30d81fbc57ef5fe8f7605be44b07d223969afc7ad6efcb
- SSDEEP 24576:HqLqRmdUXLP/at+X0n0FXVspRMRiaA2zDbeL9yJ4:HquROU+wX+YMuYx9y
- TLSH
  T1F6954B6AF6748270D0B7C075C5E2AB9AEE7134868730A6C712859B3D2F17BF6C539321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  res/bin/7z/7z.exe
- Size 562KB
- SHA256 4a41aa37786c7eae7451e81c2c97458d5d1ae5a3a8154637a0d5f77adc05e619
- MD5 d11c6cb9b06d009efcf470a668b9f9ca
- SHA1 56475b921e5576e1dd93ade2035aacea012b1a6f
- SHA512 ae93719e6b5c5d8b83d408d606e31b1e8cdc9eaac7cf18c7fdfc959326b515a10845ecacf6d154d2cc73b64b533c6b03ec11b8c992dca3b668d1d98ae3fa92a3
- SSDEEP 12288:d3+ncNWPWcUwYJokbsyIpMAf8Wvlr0wz28:OFPhUhKbJ68
- TLSH
  T1B3C4E725F6748331D073C0B9C5D2A69AED7230865B308ACB5286C77C7F676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  res/bin/7z/7z.sfx
- Size 424KB
- SHA256 353a3f6d7cbd06c6f25589df00b40f363e9f597c4edc4ad782f6d6b21f297f09
- MD5 cd076ef23ef776a8212aa42f28beb6ed
- SHA1 ad230c2c18852a1dae5abb68fbe5d630bc951d66
- SHA512 a8dc29bb9454a82fa62f4dda4b5deb1631cbde108a4060605320eb88bbc45a4b6f2046c0a7ea01daa203c7d11c94c819d1792c1fa135d79bd3f148ba9531d802
- SSDEEP 6144:9n8/VEOuUg4ziefIZSn08IPOXlFP7ZmrBBWQkPUrbFEkNXI5iixcJhXZtu6:9n8/6OxgZeIrLclFzWrkPALNrTJ06
- TLSH
  T130946C6BF27840F8E0B7D178C5629A07F775785A0370EB8F02A8867A2F136E55D2D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  res/bin/7z/7zCon.sfx
- Size 415KB
- SHA256 5f5a7f958c8a9cdbf43a8135670a8e389050b5aeb0c0325300f6c08e640aa24b
- MD5 91504a2c2d6a44787959bce544f6072b
- SHA1 3b11b27e7b1a236cfb54413c972a99263b17b65f
- SHA512 ad347bed26f124e170ec5208ace90013245864d6edc98edb97cbcb0a169a4b3d2a2c2abc60c610e4d0b8439e3fa893bcd5d67882e097d03443b77d23893656cb
- SSDEEP 6144:pC9jKj19cJ7ljZjMFFzTNI4xYHrOrmiojJVJVIrWaVLEQNubwe0nb0KxvfJP:pkmjfggHpY6mrVVviVLEgub+bD
- TLSH
  T14D947D5BF76440F9E0B7D038C6525A07F775B89A0360EB8F02A887762F236A55D3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  res/bin/7z/Codecs/brotli.dll
- Size 904KB
- SHA256 eff4866a407d876f722068b2bbf77dfa271ad828b090bc7ec735237ab6bb33f4
- MD5 290036396e7893c993dc1b7ccae5c7c0
- SHA1 fb2b57efc32cbe1e05062f01bd8684f524869997
- SHA512 67447f8af1908c79aa9a3f7dd049e66dc2c040419d62e90b7c7c0f61c7d53b16c04e5342529a39d60cf303452fc2030093468db3bd79a6d448272ec8f7786dd0
- SSDEEP 12288:6Ign83GfyvmRdxeUFFBpiH8Q6i5O+EQSygQPKYAHhly78ZXTw05nmZfRO:6IgIvmRPrpiXs+0yjiYA9iAmZfR
- TLSH
  T154159E07F5A24775C83BC0398D631239E7317DA85710C9AB6298F5353F93B2016BA7AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  res/bin/7z/Codecs/flzma2.dll
- Size 282KB
- SHA256 41b3042c2ad45a6645e34b1ea587e024a0b8721980676ec5fb7cb4763e25004d
- MD5 0b16e107ee26bf86560cd500554e56be
- SHA1 bdda8697fffb41f6eb2e11ca50dd8257addbd29a
- SHA512 1d064cbf7ec5532f5f7444b2d212afbae71ddacf52a1b9d66d2a83dbc7c13aa1651ff248a2bfab5223f338a56b079b0f7e433a155c97036e2a3bd0fe5aaadd33
- SSDEEP 6144:r92D+YNmHgL9P49t4dnHWjzyhZDltVswXmPn8bDz:u7mALp49tunszyz
- TLSH
  T19B546C81B254E4F4FA778C36A9531B1EA7B23C914710D69F03D9B22E5E3F7A04929732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  res/bin/7z/Codecs/lizard.dll
- Size 358KB
- SHA256 22365eb170af99ee72881d099eff996f2dfaaa5fa6642aea58c5094cc7cd8e97
- MD5 a7d679c6552a9c381db9a926ed0f84bf
- SHA1 c9144539f3d2a07386479100bed8bcc24d5790ac
- SHA512 41bef846ce932351bed7c562e3270d51ff0805e644061b050630502921bf00663a8be17cf21e13acc5883e14fd0e6eeb6c65cf7fcf48eb2a468ff78bebae37a6
- SSDEEP 6144:FoqtNJBINtIITXCCnZO4qR6jOBToltVsw/mFx8bDd:f5BrRCnA4Z
- TLSH
  T188746C47B69144F8F0778536A693468FB7A27C986710976F23E1B5262F33F20493A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32