4cfb4544a23b67f6779a583b787acb99a26d8d43bb992b632844d82cd3aafb9a

Sharing

Copy URL Twitter E-mail

General

Target
Masterstrap.v3.3.6.zip
Size 23.9MB
Sample261024-tkwe2szy7k
SHA256 4cfb4544a23b67f6779a583b787acb99a26d8d43bb992b632844d82cd3aafb9a
MD5 f47851101a97d14c49ae9845c5855af9
SHA1 ed041f3554ca63aaf8c5df9f451a191392923dc7
SHA512 a21fa7a7d4e14f8a3b62cd7ec13c8f08645132c0e0d4b525c6aa56fdea75b0dbdc275355cd44586891ee4725f0b555ebb14ee8e5eb5720be5f1aa346fc448fc4
SSDEEP 393216:TXDF6/4CzywX3VwNyN/pWvnXATZTP+L5DDHSrcCZLsHQxbikah8HcN65+/UYIZAT:TX8/zHwNyNpInuT2L9H3mswdiJl++/Z/
TLSH
T19647334EF9E63204D775219A82F13D4464BF3EF5605868B637E302E01D583C2AAEDE79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  Masterstrap.dll
- Size 37.9MB
- SHA256 1d73a30ff162ea6598234c67eb4d86251908bddfaa4cb94bec2578acaae576af
- MD5 c0d32631169fbd27c7d24c4f595c5187
- SHA1 d217985145107b864e19f08a078d69e19d3287c9
- SHA512 28b6376bf4a52ed43fddf160f2c9eba7749786f81e71faf865d36755bb2d673174b6fcfb3f27d73b6dc36ffb256db6290b95831c1c616c88636f2180a56e6b38
- SSDEEP 393216:Z8lTAdwp6kxEVmww3cYs6EpS0/3RLUa2n8GKszEgiJe5mHWFWPI6qLkGJ5/3:SlYVmwwNclCB8GvEDNCWPNPGJ9
- TLSH
  T1FB97D09EEBD5AA15F479367DC870404236B16A09B334F2A7FBFBED19250E1C41D40B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Masterstrap.exe
- Size 213KB
- SHA256 3e01371b1b14c810037d23628669491864ffa51a0bf766c4c33b92d1e7f7a40e
- MD5 f6fda441ef1b709ca0a69f90ef8743be
- SHA1 e9d3e53898afbb5d5efe618979cf510d2516c2b9
- SHA512 8bf7147d2315eb8aa8ccb20291e36c251ab061c1992421fd27ce023ccfbfedcab29c9cd84cd707392bbff939b59ba7cf99faf5489ffc636a9bb58e53d0d048e8
- SSDEEP 3072:RqvmgiYSo4k8uIPzlSRwa/5B26m9Ig4k+F45ZVKygjGSqcRqA8EH5pW:R6ok83LlMvvqIgS456yY1HT
- TLSH
  T1E3248D07E2AC51BEE1B7C679C9924C41FB7278158B71A7CF07504AB61E77AD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  Microsoft.Web.WebView2.Core.dll
- Size 635KB
- SHA256 bb397d03342c76bd308ade82f5b7e8ced00df59459799ffc93a38c3a882b3398
- MD5 9863c48be4ca788c639e8b4f3995b678
- SHA1 4ab58d780f34d67413c4068eb5b1edf8d29316ce
- SHA512 442bd01c786e3f7352c65082749e4aabc8b02270054620a38e3adbbfb414df95aa61b2b6d2c484b49315aae23f17b8d0674d8ab46632e18ed07bdd0ef587af23
- SSDEEP 12288:nmU2OGETIkTLf4wv5t4xhtVusvnTVcyL9j2oYJjvYGvAE6h0vo+Nl5cNYvXurP3Z:+h0g+NlI
- TLSH
  T1C0D43F1223F9461AF5F27FB55A7917608BFABC96B939D34E8598102D0D72F809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 c3062ac43c9bca7260c77a630bdb2834f38e529226796dac6d77b30f010e5bbd
- MD5 9ebc3684b84c1c9ac009af6fb1c103c9
- SHA1 fe76e014d28620d005d255a7f60832822562ec93
- SHA512 4b933b1df385d938f009e9bcbc731dd1eb7f6aff660f61e7518f4eefb83d97a3fc32075a03431ea19ce2a0c3affa9a3644c6335abc8999a5e7bf66a783f92300
- SSDEEP 768:OcaNb2/itGt3JrbYb6QzZDgcEST3p4Jjrjh2je+SG2au8vxJKia5/Zi/wGQSxKFH:cb2/D8uQzZDgcEST3p4Jjrjae+SG2auT
- TLSH
  T153033B4083ECC527E6EB6E74A9B496620BBABEC37D61D79D0C84F0990C733D055113AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Microsoft.Web.WebView2.Wpf.dll
- Size 81KB
- SHA256 1e9ff65c05cdcf7bd56fe617e9b1fcc7b4a51503604ac80de14bcc9fbf54c509
- MD5 e54e1489214159356254546ca6fe4501
- SHA1 784c8d51f81442a06829c6be5a98dde6209e3b1f
- SHA512 94aa06b3e3075a397e8d6b92e3686bb5fded049a9bc205cbee650f2b8c4ed240e33456ba51b51781334ecd838299862b1ee09c1e2f16fa91cc4b3b958e5a0026
- SSDEEP 1536:/h/Ha+etdl9Qk3DcLoSJVgChhp8dYNUDHfF7yEW30bpc4Jjr4YeUq7HhvU0sdndP:/h/6+etdlvDGo/Ep8yUDHfFy30bpc4Jp
- TLSH
  T1A4837CA123BC8D23C6FF4EB8786140545F7AEB837E12D74F6585B1E80CA738161123AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  WebView2Loader.dll
- Size 155KB
- SHA256 1ac87267e52ccdf5621678697f948030307a650ca56f38f69e74c7cfaf9605c6
- MD5 9235a2ae9fbb00d0fe57b0f107eeafa0
- SHA1 d99d568ea4c1182da7de0160965e812bed049a40
- SHA512 0773609ef3bc844a1dea0bbeecbb08ef61cb76d50313b4e9a205c526f7ee551b188fb8d8acf08350bef9620707d7b988e7f57bb6009aee0db0615cbd44d283d1
- SSDEEP 3072:k7+r33Gx3Xe/uy0A4BBnkDC49KMNU9eATmuEtJjvv8WD+a:kwnGV4p4BnkDCEKtEtJwm
- TLSH
  T17BF35C57B3E9006BE07BC278C5A34A55E772B8115B509AEF03A4477A1F237D0AE3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ZstdSharp.dll
- Size 386KB
- SHA256 6844a1af1027745ee68118e9e23ad46335a2aa8755826f568e364a48bc784930
- MD5 c85de98bfc2f93e572b61baeebbddc12
- SHA1 1d648fa4fbd89b28fb2fbf89e5e500821a586b07
- SHA512 877a91fbade6bf4ab229d6c52284e35f7f36c2a19afebf4bc135bd8f3aea3c980da2b6740379d0905274e9703ef3e1f0b20af09d34e8048928f040f42d614019
- SSDEEP 6144:C7MWsUzin+t2/9lxnMc8o6B7C7R3OnXHQjsuVUkOo88xZDc9NDaxKZdZ35IV:ysznZnt6VA88x9uax
- TLSH
  T1F7844C7A73C98BA6F64F87708465045A85BAA026F89BF39F7CBC84E469057D4DC04BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  runtimes\win-x64\native\WebView2Loader.dll
- Size 155KB
- SHA256 1ac87267e52ccdf5621678697f948030307a650ca56f38f69e74c7cfaf9605c6
- MD5 9235a2ae9fbb00d0fe57b0f107eeafa0
- SHA1 d99d568ea4c1182da7de0160965e812bed049a40
- SHA512 0773609ef3bc844a1dea0bbeecbb08ef61cb76d50313b4e9a205c526f7ee551b188fb8d8acf08350bef9620707d7b988e7f57bb6009aee0db0615cbd44d283d1
- SSDEEP 3072:k7+r33Gx3Xe/uy0A4BBnkDC49KMNU9eATmuEtJjvv8WD+a:kwnGV4p4BnkDCEKtEtJwm
- TLSH
  T17BF35C57B3E9006BE07BC278C5A34A55E772B8115B509AEF03A4477A1F237D0AE3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14