d99228fb52087fe4225024765ee1c2a8cc5a5b61246efb0e9fc3618fe1cf1527

Sharing

Copy URL Twitter E-mail

General

Target
Spotify-Discord-Lyrics-Windows.zip
Size 18.2MB
Sample261027-eex95a1vcw
SHA256 d99228fb52087fe4225024765ee1c2a8cc5a5b61246efb0e9fc3618fe1cf1527
MD5 b2f06da63d132e391ab2f225bce099f2
SHA1 510ff356ad3e15e5bc94c55284a920af138995ed
SHA512 fc10275fb51e36e39168b6b66108b3411cc16c97699d2ea57f5019bdc718f50e0e14d268074934e2ec074dfa773126181052c76461f0bdc139ffd6ddf64660e6
SSDEEP 393216:Qn5vfq45rfZW+LgC5iMiGP8rHi71a336fJvf3S9zOEQuqfOKeXmdiAdAhydqyFU2:KvigrflgCCGP8rHi71hJv/mzjQlOpdAN
TLSH
T1F21733F2C2731D7DC6C4D98A21F583A8A31546EEB19E309BDAC00BC29F1E76B8935D51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Baslat.bat
- Size 386B
- SHA256 1323a754893537162d0938774335604f79cd7c3035e85835cc0008ec3118b528
- MD5 6ddfa294de76d7a9ad94835381912070
- SHA1 d6b80c03c18124661b9880e51ab8cf33483134cd
- SHA512 bcd1d545edfecf053c8d07b79cb7f0d5ce4d5e239c63de858ac256e8ba6ba94c83aea1f185d7d5b6d49a4fe0f0d2c7f33f979bb2bc546ff28828203a46c02a1b
- TLSH
  T1AAE0C242B011CD00C7B413AD55743649F60F14A7CA4B9805392701A90FAA3EDAE8E862
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Otomatik-Baslat-Kaldir.bat
- Size 870B
- SHA256 d5c98b142e4d1460bb7fc8b9ea33d5f6410b4b606f9df7f32345d56acace62eb
- MD5 6eea0bd6b4c0e982f30bfe190e0d2383
- SHA1 3e8af89a2d67f5b9e57b58c7926221d2b79c6737
- SHA512 5e885087431ab62f61937923e5f8608fef24162c17cf068f83a52024be4e45e8e317bc81cd2e63c39b0b0fd8514a5fd7d77392ca5ab1b0f480a7d24a5f428c79
- TLSH
  T19D11FD22782A0500C9BA73C488552249EB09C8CF0AE2BE9DB54B10394F447E3D2BA1DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Otomatik-Baslat-Kur.bat
- Size 1KB
- SHA256 910dd39737603e6312beaf174de439c86e7b867bfac2bbdef9bc9421f5d9d58d
- MD5 4ca017efd4d948a2661c5b5a7a3e4fc9
- SHA1 b52b68f4433ba2c32eb36ae159ffe09f94b4698d
- SHA512 5d1a2ffb5c7addd906fd3e0a9777b1f0e9ad4805b0116c2c9e680c71a64d0869bdc572f5b65f3aaaf3ffa015535bb5a4e56af4018fc28ea3d20058b662c2e536
- TLSH
  T189211022B1698B2049BAA354CD1D2495F70380EF127AEC4E7A0F842A0F943D3C5F89C2
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  SpotifyDiscordLyrics.exe
- Size 9.3MB
- SHA256 080104c9d1286059423bd8fde7a7057eb55d851b0afd197d0857b580ad6cf011
- MD5 22e2e3a5c6aa1aa4873be3118f0b1a05
- SHA1 7dcd01d59e9b83f48e59b0f83366c533e76ad2a3
- SHA512 bbc504ed01a7d1a875ac79e0ad10bd6666754d4cfd8b0c26fec6b1b1bda99328c3ba15f3b6a25180f10f9931233ba12553f8681dbef0e6bdd0656ae4950cefac
- SSDEEP 196608:UYlNTwhLFvf2A1HeT39IigwK9auDXURuAEk0ax8Z8E/9SNz:HSLFvfv1+TtIiFFuARuAUax68E/9Y
- TLSH
  T116A6339593E208F9E9F6813D81B6C16DD222789B531A93CF63D00A933F177F24A39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral7 behavioral8
- Target
  SpotifyDiscordWatcher.exe
- Size 9.3MB
- SHA256 16ef937ae36455ee5d3cc7669043b69760142bffce6c22a9b9d11ac740dc075b
- MD5 377bb057303e0f97fff5694fe75536a9
- SHA1 7332a1aa8de8977f542c2c3ae8e0bc23362b6ef8
- SHA512 d8c89e5d3f7837f2a7afb1d77299ebf476e4e64a72e5bf86229971e8cb0468fd0825c914803d1442d7043861e621cf348540ab9159ae094964a33e3928e314ae
- SSDEEP 196608:xlNTwhLfUvf2A1HeT39IigwK9auDXURuAEk0ax8ZyE/ySDz:xSLcvfv1+TtIiFFuARuAUax6yE/yi
- TLSH
  T187A6339193B208F9E9F6923E82B2815CD272789B4369D2CF17D007926F277F14A39F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Creates a file in the Startup directory

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10