d650676c4d12c0a4e72d4e1025194ed13bce60c33b1db036d85226fe781918bc

Sharing

Copy URL Twitter E-mail

General

Target
CyberLauncher.zip
Size 6.6MB
Sample261020-2yctvsys4p
SHA256 d650676c4d12c0a4e72d4e1025194ed13bce60c33b1db036d85226fe781918bc
MD5 f3df0aa423da431324a31c81eabf16bb
SHA1 c36c9dc0d822ed36c2fe2aac5a8f540756c7ec50
SHA512 1740762de9ec99cf25fba02b37337326cc2213f721f9fee44ed931ccad80620e43e86673e6f4fda85053237622ad84ffb96b8b068386d56ae1036037195f3f75
SSDEEP 196608:bC62kmI301dcnkEy5pKsZENwd/woI6PLqD3OApDnd/cRaz:bChIkqkKsZbOrDeApDnhcRi
TLSH
T13E6633EB31EAD1F0CB0D223A5FDCF545EC264E88AA14A98B1719E01F4729573C35626F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ! SETUP.bat
- Size 3KB
- SHA256 066d5d62e1ed8bcea4de4394ebe4b050fbb705e21e15b15e849c2705eade7f72
- MD5 9a41445e799e55b272c82f43fa520a2c
- SHA1 c4a6a57a9771822197edb24afe2f3c14b7185eda
- SHA512 5f8d92c0b3cb0f500a90c134ca4a34e3a13b1f070d540b059128bd8d058e34d7b23df64e0d2305437a1e38429e4c2ab50840522037007183d7e5217d73a47172
- TLSH
  T1936134327C18A73106B8CE104976FD19F35961DB82354950F1EE92E0AF707C9AEBD9C5
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution persistence trojan upx
- Windows security bypass
  defense_evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  Cyber.exe
- Size 60KB
- SHA256 664d53faa67e3ba57d947b3bdcdc71e6afb8f2fb25d61c9835f838a77b070788
- MD5 dd8f170bfe488af907eba2194cb9d883
- SHA1 6e6981b5eda3ec002d36811db05c002906bcc615
- SHA512 df38512b64735207c9e7ea234360d6ddce4b53d84d17cca8fb45c5e62e9437cc04f5f0c16c53142719f11a6c69dab6ef464a5833fb25f4d08d2b595a610ec3aa
- SSDEEP 768:454G/80pAYJ1vS6Dc8cXTKv9qeTYs18lvshSjohlRhzKNoHN3gXQSxJTXHZeKeqW:eNbfWTKv9qeTYs1
- TLSH
  T10C530C4CB1B79605DEBF0DB0493B091A8730A129CB71EA660FC454FB4F693904B95BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  sslconf.exe
- Size 29KB
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
- MD5 71fdd6fb7f0acd3e9a6206851452e11b
- SHA1 82011a9ff3692236df69427eb200ba05799205b0
- SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
- SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
- TLSH
  T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence trojan upx
- Windows security bypass
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  tempdir.dll
- Size 10.5MB
- SHA256 ddd6e694ebfec6022ee6312ada1aca7d75f33d1d44fa6a788f0cefbf9767b585
- MD5 b58125e3f39c7a5de88ba48c9ca5f452
- SHA1 80eb5314a7fc807b49a5f82769456f7297737ebe
- SHA512 bdbc4fc524a0092fceed4e6de5f5824d1ceaa87a08edf48bbecf5e877d55f9efbf71084dce2ef91e5542fd35b35043a8f1c6176e7a7d40a0c101b65440199846
- SSDEEP 196608:DAOqMQKTuV/iveYmJFKsXItEdtw6Iu5Zq3vwk9RPFvG:DA/KyEaKsXTk/3Yk9RPpG
- TLSH
  T116B633E720E6D1F0CB092E3A4E5CA945DD310B48E9A4654B1F19E01FC729663C3F6A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

upx
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  vcruntime140.dll
- Size 130KB
- SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
- MD5 6a969b545789b0be2178d2d79ca603fc
- SHA1 ecc0dcea5f747007eed5621c54f6d03564cde9fd
- SHA512 8c4a40e7e3ebe7ecfa7b92686428779f99fd7cabafb1bd3f331bbda67edfb36654ce03324f38975a8713ef5ad9d4ad474f1fdd8f06b8bef8cbc5a0306b6a6b1a
- SSDEEP 1536:Z9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lngAezG/yLzt7nD:9yA+3EOfmpcGSdOecbeQ6NxnQ+sBn
- TLSH
  T104D38B4272B801FBC56BD1708292EE27FBB6F50687609BDB07AA86650F537D06D3C385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9