9803cc354e5ad418d95f609a5a840354ebdfea3a942fc3f8e83ff2af961bceb9

Sharing

Copy URL Twitter E-mail

General

Target
Ligma-Executor-main.zip
Size 719KB
Sample261017-mrtfpsdx9p
SHA256 9803cc354e5ad418d95f609a5a840354ebdfea3a942fc3f8e83ff2af961bceb9
MD5 a8875f60669ab1c8548f296558b834c6
SHA1 71f02187988b562955e80c7c318659925d961212
SHA512 bdf91ff2493d60e76674e7aa941967b4cbf45540816049e0a78ecdc98aa5cf1c1e16e6d15fd2dacdac3e51b07a1ec82d38ab0c1c46c4481137c72cc898d6da16
SSDEEP 12288:LimO3JfVo3vow+x0ID6Srbk9nNJFR7jzdjhF4gJbdGy/SZW+NhlkT4rwEJW4vJiO:mmO59ogJxp62k9nNd7jbmgJbcy/SZW/s
TLSH
T1B0F4330209CC1ED6ED43EEFA458E490231A5231EC11E1AB1FC2F9A0AC77D9DB6B5ED54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  Ligma Executor/FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH
  T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Ligma Executor/Ligma Executor.exe
- Size 16KB
- SHA256 bbd138def8f8ae935831f2680df71e59fa3f3d78ca9398e0fafa8f2198f4c7c5
- MD5 fc29487c73b1fab958c5452674b17d6f
- SHA1 1ec44ef2b5dca17b7279475be3f0582406775e09
- SHA512 69112a7bf29d08893b33b69e8bb5e5edd25877af429a00cfaf35a343fb1caa40b842503fd327a3fc41a4c1d41c4772eee7ec569584145d17e11343cd92090f82
- SSDEEP 384:GUToxTln8CJJjUX5HZf2wxUFwgCCCCCu+b:NToxqCJJjMb22/
- TLSH
  T16F72095037F88B2BD57A4BF209A3508013B2BA536452EA6F2DC560CF2B6BF414711BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery defense_evasion
behavioral3 behavioral4
- Target
  Ligma Executor/WeAreDevs_API.dll
- Size 607KB
- SHA256 7ba0ffa49d4b1ab59b9b1293faf5bd021ab1a2172c2172e22042ab70b3489eb4
- MD5 0025193fb8ac07ab3bac031604fa4c2f
- SHA1 1ca60ea4d0f3b8dab2cac98052d95752f62a61ef
- SHA512 0ebd381ba822fe5ac4f9dbaecec3469ddda83e1463a14cb73350072450c1cbe45c6eabede44258a51c4e888c5a46da81fa3a11f2cffd6e12528ca3eb0ea7b6aa
- SSDEEP 12288:OURkGrbk/x95DR7XZdfrXg+JwuKt/S/60pR5kjo5Bda7EptO:OIkyk/x9L7Xfw+Jwz/S/69k5BkApt
- TLSH
  T1BED423401AE91214FABBBF7858BA00466576B33BCC97DB9C554A241C4B393CFC962F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  microsoft.bcl.asyncinterfaces.dll
- Size 21KB
- SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
- MD5 48efe61d6ca3054309907b532d576d2a
- SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
- SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
- SSDEEP 384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
- TLSH
  T189A26B11D7AC4317EEAB3FB19679D1062E34E7D6A821E32E108CE2652CD73859731739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  microsoft.extensions.configuration.abstractions.dll
- Size 24KB
- SHA256 4891b08c0157568e97b003936391841fb08684e96339c9ab6e9b060c0b2cc46c
- MD5 700a883d56bb05b55ae1a7e80f4187a5
- SHA1 4957c67dcddc2a143d5fc9717516594d0d71d7c8
- SHA512 b61e0287c56b976a0cb0e1b354bded2dec15de05fdde89a63105ac59c04327d6f31403858e519a83014cd451b03cd6f1504a714c9f69f25c6b591cb362f395c6
- SSDEEP 384:sm++Js0AtZ7WuzF/R9iaTG/0wEzRjz6qMvJsOhAWM86WsrNW0/uPHRN7LmG24rlK:LlsFfypvi8yZML7CL
- TLSH
  T1F0B25B1A97AC4733D8BB1F71E9F5C8052E3AD7A66821D71A5C9DB1090CB77C08722739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  microsoft.extensions.configuration.dll
- Size 35KB
- SHA256 28c12f7523feae61f93b9a799bd9b1b6e7c0a41dacbad658e13b08098440c762
- MD5 20bcb7b7ff500617f7d6f83e24da4bf1
- SHA1 e0ebeef17de306248258f36b7c9c5ebc9039c47a
- SHA512 be63dd374c96181170d083321d9606eb34bd3c15677d8bdaa9fbf1a199f39487478a4a3f9cebf36a67332903c845940f97822bfc24194936b2b3057a11a59c12
- SSDEEP 768:Ai4PV4pQ7qVsvfUyRcLQim2/KMHGPUoMz1IL:AapQOVsvfUy2tjH8UoMm
- TLSH
  T1E2F24B5792784733C66E0AB2A1E0A65B1F3AA7937402FB1D9C6DB0951CB73C04B62727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  microsoft.extensions.configuration.fileextensions.dll
- Size 25KB
- SHA256 f8c75555c27ea00ab4e5827f8e5266031e5ac541df5a66f5e154ded253a5c000
- MD5 b8ddf2be0d46bef2ff86b5ce53e60e3e
- SHA1 d418af94ee80ac1615152d83d282582ffa86ba15
- SHA512 d946e04cb989ccc8ba5544d4bae0370e36d2b1fce0186cc1f35ecdbb1934e48d8e19d1091e950e3fc2b2324870405aa19e198fadd2e7c99fff84b1a9c52adbb6
- SSDEEP 384:7Y5Jf3BygaIVCLF04mbPA/XAB1azWqr6Wv/uPHRN7AospG24rlrDW:0PQg0Pw1azLMAo5i
- TLSH
  T1E9C25C178BBC8313C87B4B71A9B5E9435E3AA7873411A71A484DE0491DF77C08A93F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  microsoft.extensions.fileproviders.abstractions.dll
- Size 20KB
- SHA256 090b71568672cc7a268618d5150cb237962a45a258d34e18088e0f7984317cca
- MD5 69881b0560e8413fc8bbce8a1c3d2139
- SHA1 a7869818d674286d0edc59ed3badbec3ffa9fde0
- SHA512 fdc3e0fd52c19d2edd96fa3745c70c348e792f0ff17be05872aff4c89484e36de387d726eda6b4ee726bc21d6b8ab8bd653b0928016fd81e885bdea156204416
- SSDEEP 384:J+26hcMBiZspo+MJLuuPuMzUWsbhWw/uPHRN7ds9l8Qx6:J+zcUicGBzotMdmI
- TLSH
  T118927D668BE88352DDF71E306965C9463E3DD3EB9811A22E048DF1161DF3BC08A71B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  microsoft.extensions.fileproviders.physical.dll
- Size 41KB
- SHA256 b00b024aed951ae739d0a32bdcc9fbb0a2c00063a21b74ea7cf8037db713ebd3
- MD5 336c05a49cd80d9b84f6279d50cb36c5
- SHA1 97fc65b3320cd2f85042e8b680a76fd02b3dacb3
- SHA512 4f2edce62c926c951d72fc3ce970c949c7ea122edb37da6ccfd156b107551dc9fe198bf690e19b3e53df0e8b05b2bb5cba26a56dcbc0bc58cc977e3a93a68a93
- SSDEEP 768:GwwEaRbIEFoITWWX5WWhWWlkesupdUHcxMsv4MQ0W+P:GYEFoIxkexpdURsv4Mh
- TLSH
  T1E1135B2193AC8323CAEE4AB179B0F0424F3AE3D7A912F75D5D5DB08E28A37C05651776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  microsoft.extensions.filesystemglobbing.dll
- Size 43KB
- SHA256 fc4c05b3c4fee5346fd1826b29ebba8518c665f49b228085d2a70e143e68bf8b
- MD5 c3bb956e83de2074ccf247c653a5ebbc
- SHA1 58b121d43aec1135512f639ce1d27ecc42d2c093
- SHA512 2f3a7a75dbcce3b25a941704fbbb0d395de3486e6b699ee99af0d9730f712abcc0530308bcabd79e0408170c12755a378a645a152a747b37dfd8711eb257aefe
- SSDEEP 768:lNQ9IsrQMKsdZHleWJWlgdiOK/ABf1kmTCgHgUqY6J3McOk:la9IrMKsdZHvJf4YB9cgHgUMJ3McOk
- TLSH
  T1AB135C9263AC1323DABE1778B8B4E0114B39D676A422F35A4E8CF5895C63BC03761777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  microsoft.extensions.primitives.dll
- Size 42KB
- SHA256 60df37bef5b47e822c02cf8547de3b2a836973e517efbaf090f14086d5155c9b
- MD5 4360e5ddde76b62461762f72f85b1d79
- SHA1 26f641b14e70ed7fc51e32590b65623ed2cdef6f
- SHA512 5b2b345f1468094f050d8ace375a13ef1c44f3c3e5a1644c7395a9518bed9e965b4b511d650299b1ff844d9062e342998245c7de308b5252b5c875b3ea4e97be
- SSDEEP 768:xKOg6fZr3r15Cpw4iI+OPGWcf9CRui0zbf1JPM2:Hg6txCLiI+OPGbf8Rui0zbrPM2
- TLSH
  T133133A4467DC4333DBEE8A7460A1D1524B3DD3AA7422FB5F548CA16809A3BD09B713BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  newtonsoft.json.dll
- Size 685KB
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- TLSH
  T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  system.buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  system.diagnostics.diagnosticsource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32