7799d0eb63c0250b8108e95d087f82b4b117b08d67392b084140d253bb9303d5

General

Target
pandora's litterbox 1 (1).zip
Size 16.6MB
Sample261023-ep7asacb78
SHA256 7799d0eb63c0250b8108e95d087f82b4b117b08d67392b084140d253bb9303d5
MD5 0dda97d3a7b135c7b975d66aaed979f5
SHA1 726b3b6610d301b4f52975ab6e5b6acb3472017b
SHA512 70c3339ab734cebb3615ac1cb899b2181ef3ea4ea9457ab595efe6c852c9d5919da748170c2fb0b096b6ac5b7e6dba388ad6af537d905746e7621685d4ea10d9
SSDEEP 196608:pT9Tu8l28pODhZRdg0YWfk0kX+SuKtTO+OUxdNBHygfp9FTdU45GwFJuatHoSDcw:h9ThcF60EX+StkzUBFRSQJuatH2+H
TLSH
T19F0733E936B2A24CBF99EA17374C22D022C34720596389E99C5D87CC359FABB5DF504C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  READ ME PLS!!!!!.txt
- Size 48B
- SHA256 6b9c1d7dc3ba26c50cdcfd33c6d3740eb27d8d8f6f0270b81df8f4e7f52f44c3
- MD5 aaade2d9f99e6b05a9a4eab22e14f743
- SHA1 361fb82fbd0f2469890ec5be10b5296b8f35ca60
- SHA512 610b562cf392fe815a4647590d8abf5d406d89a93d1b4c95d0870ad2e1b2d0ba29b92b5722a812d25ac78c7ec9ce8dc301c88f1ffe8926ada124f178bef9e286
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral1
- Target
  satans_piss.exe
- Size 87KB
- SHA256 af257a35f5bcc5a7e0e35803641f13cb5996352abce85db89124614f103f0d6a
- MD5 00c11ffddd2a648f1667a3e40dc1bf72
- SHA1 c5eebfe7b568c7b96d39c1019b66f766dd07b14b
- SHA512 6515b857df6187458df9b2dc5bada8ded503e4d1fd1e95c419c64c74bccc962d3069f2c59c483f75f6ede554c1204025240006dfeb61efbe675d63b2ea2b80cf
- SSDEEP 1536:77fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfwxBOU:Xq6+ouCpk2mpcWJ0r+QNTBfwX
- TLSH
  T1C1936C45F3E241F7E9F10A3100A6712FA73A66249724E8DBC34C3D829953AD59A7C3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral2
- Target
  tempest.exe
- Size 88KB
- SHA256 72820f4e95f4ad650252c5beee9a98fd54f95c6481fe039e5971bbe2d326dfb7
- MD5 cdf97987c94264f55655e4f9a0b75382
- SHA1 90afcb02d588202044f8cf2b728cc0e2ad55cf0d
- SHA512 9737b83ee680b35b48b731f60fdd770a2ae9d5520afd4f9cb20b811d1a73354c8536aebd2ffe09e067bf1ab6bfe8629393272ebca974bb118e518b54dcd6248e
- SSDEEP 1536:z7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfdxYRNO8:vq6+ouCpk2mpcWJ0r+QNTBfdGR9
- TLSH
  T179937C45F3E242F7EAF10A3100A6712FA73566249724E8DBC34C3D829953AD59A3D3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware
- Loads dropped DLL
behavioral3
- Target
  tempest1.0.1.exe
- Size 8.0MB
- SHA256 76b5d38acb5c4cb14ec0787a0a1187470844da460e83587ff476996038369b97
- MD5 39902d6f70e07193c21940175da428be
- SHA1 f96f9cf3cfdf64af7bdafbe3740dfec91821de29
- SHA512 20c715671f1c4bdf1164fb9e8219d782d9c698a22f655b167ce68e83b1183609fcab50a9ea231438c4c7714f3d06ca79a738906367c3af37bd24d9f5e89a35b9
- SSDEEP 196608:qhoGzmtbW897GJr1LDsBTG9Wd6WQGa/R6:uZzm1S3sB1QWQhA
- TLSH
  T1B086335872B005D9F9A7A13F5A655082A3F3B4224761CADF1B78829D3F0B7B25D3DB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral4
- Target
  tempest1.0.2.exe
- Size 8.8MB
- SHA256 a12973b9480b9bafe1d123d9b600a8374931c698bb9a7dac2fb488307b605d88
- MD5 dcacc01cf59f9ff1c2ee6cc8948c9f7f
- SHA1 87fb3d03cabc228f253445562dafc5e1f6244558
- SHA512 3211fcb043f5515f647b2095c6759f91ffa9c191b0c8827b3040255fa5b9a4fb7a2eb680c282515fd0dca4d4993672824076987b64543d35839ce1d5e9c7429a
- SSDEEP 196608:MfRJctbW897GIr1LDsBTG9WdkWQrH4Ila/R6n:wM1r3sB1mWQrHgA
- TLSH
  T13A96331473B401EEF8A7A63FAAA5905153F3B4255771CADF1BA842983F1B2E54C3DB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5
- Target
  tempest1.0.5.exe
- Size 88KB
- SHA256 8c69853c28cf73096a20bc45443c7523ffcb6b64adb9d77a817fafd484d47f51
- MD5 021fd9b920e9f1816595ee3ac72911ca
- SHA1 0c7a303f2e22cbf84886f8947b66623a12385fb2
- SHA512 daca106c82a808765b21a306d35b80eaa8f33882e124c98fb8c36952793d772615bbb8b618b2e0ed1fcb9ef150a4736f47fd834538859d20444d79842db806c7
- SSDEEP 1536:j7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfpx2T2:/q6+ouCpk2mpcWJ0r+QNTBfp5
- TLSH
  T17D937C45F3D242F7EAF10A7100A6712FA73666249724E8DBC34C3D829953AD59A3C3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral6