f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8

Sharing

Copy URL Twitter E-mail

General

Target
f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8
Size 4.0MB
Sample261024-qqwffsh191
SHA256 f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8
MD5 365e46b03aaba56846b85c702039c5d3
SHA1 d16e763130096c0ec50dc81f58eede7819431308
SHA512 8556622f74b2e02a75fca3cda2d0cf0f5c85669d99e888424b9e8add2e619e904e92995b5fec04284c7ada4beec250ebaa0bfae481bb3b7402d0b5175c312a71
SSDEEP 98304:1/3KkNnqLmWtM0gWuQh6x5v8RBawI9CsX1Mt:d37pAwWuQhLIIsX1Y
TLSH
T12D1602466D0251A6C1B3F3B99E57808EFB26C2638335526835AEC444BF36309A1FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  OUninstall.exe
- Size 2.9MB
- SHA256 ca9522744e96899df991c073c66a65a86b753c12bba71a83a28cd73f4f330b1c
- MD5 dcd30da513a3348c4a34c70121dab8ab
- SHA1 6ecd365e1a65e3f04a14264cf9acf96d8e0eec60
- SHA512 16588aa24e47cf22f123f755955daa410e68417330cebd4d9cae2c61b956846ba8f1a98283dc7e370680e09293a2e3dd3ca76a43a177a35ec883e08582c631f6
- SSDEEP 24576:TO+rnnOxyCZisUZw85zkI3nugEGcarV7CqViXtxAadq/WEtO8O/en9uRuu:TOkOxJAzzNccMkItxNs+Ebuen9c
- TLSH
  T138E5B8106FFA0114F1B2EA74D9B64025CB27B9565A36C94E718C09CE1FB7580C9FBB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  OUninstall_x64.exe
- Size 3.1MB
- SHA256 17aa3a2e186c1a625a9e337defea3b65c820dc1dfeb0eb289702e0cc95bb3578
- MD5 e896a7c8d331c1e2e317f9a3cd0bb227
- SHA1 aee3ae0b7acffc57694009a0ff1880ac3015dad3
- SHA512 b48a9ab553b5a3ced79908ca2cb02163275694c14ab3530ebe53d00b2b20491ef9b89ad8a29d7ede7fefccb91b5f5c36cf7b7ad8ed2e8de4e7a7e65fb604aed6
- SSDEEP 24576:ZOFzXVDZq6FJ3/rWganJ/sJpORXy0BoJ0CpYo0NBbeGaD+wcvDpYbgEGcarV7CqJ:ur4Uxe456cRQiaccMkItxNs+Ebuen9c
- TLSH
  T17AE5B7106BF90118F2B3EA74D9764125CA3779565A35CA4E218C0ACE1F77980C9FFB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
- Size 744KB
- SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
- MD5 8e0a0b48ad0289d647e55d802170d795
- SHA1 6adced8154ebaa02e06efcb85715d2663c731bd0
- SHA512 58edc773d275dec130cc5ede3c55edc5680f52e1b7ca4d78b349323f6d64b565ba052366b59ff4a94640fb49d14c2ec490dc69946bac9f921cb82bb62bffe563
- SSDEEP 6144:g3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Auj:g3IuuhcEvTGGOEmcAXz0ykw7x
- TLSH
  T192F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

execution
behavioral5 behavioral6
- Target
  윈도우설치 루퍼스 4.15/rufus-4.15p.exe
- Size 1.9MB
- SHA256 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
- MD5 9ec58202a786e33506e852dc9ddd03f7
- SHA1 f42ac0f91d72116e329d19cdb270187181e317db
- SHA512 6194cda6ade733ba097f45a1cff9d32392eabb9e44669abc18d81158d763e7a07bbda1c0392a7fd02fae412d74f3fd12dc6cbc36a19cc9c064787b9e3b3a14ef
- SSDEEP 49152:oWuJkGtsXh6x5hd8KDUBB8wI9CKjX1PUDfBd/:oWuQh6x5v8RBawI9CsX1MT
- TLSH
  T1029533B3CFE89525D9E714F2BF5C49539B91384FA5294B9B30E72E0CAC6434CA0A1E5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery trojan upx
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8