5b1c290c678d3352f0f54805c7264088cee2464830e8cc07f42bd4f87540bd9b

General

Target
windows_64bit.zip
Size 18.2MB
Sample261027-j422tsda69
SHA256 5b1c290c678d3352f0f54805c7264088cee2464830e8cc07f42bd4f87540bd9b
MD5 aad36bb520c72cd15b9d0aaf48ff4f7d
SHA1 99cbecd0cf1f8717afbae2f04e9c05111618a7b0
SHA512 63c01d8922ff99ff4e268c396b1da8a24be4d563afc057a8c05bacade8be81290cfcbf4a920818ec00210685b701c11aa3b16f99dd5f3efd0d62eaf62052a9d6
SSDEEP 393216:fqbGwgLKglBUTsrrv7r3CXr5xd0WInUxSrTC/O4qnjcUIRvYKsNl48ANxu:fqiweKglBUIrrTTCXr5xd0WInYSr74qb
TLSH
T1E517335D82031F4A416FD2557DBE2F2CF5C8A2D2CA82C905B82BCF06C54BBD59AE12F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  windows_64bit.zip
- Size 18.2MB
- SHA256 5b1c290c678d3352f0f54805c7264088cee2464830e8cc07f42bd4f87540bd9b
- MD5 aad36bb520c72cd15b9d0aaf48ff4f7d
- SHA1 99cbecd0cf1f8717afbae2f04e9c05111618a7b0
- SHA512 63c01d8922ff99ff4e268c396b1da8a24be4d563afc057a8c05bacade8be81290cfcbf4a920818ec00210685b701c11aa3b16f99dd5f3efd0d62eaf62052a9d6
- SSDEEP 393216:fqbGwgLKglBUTsrrv7r3CXr5xd0WInUxSrTC/O4qnjcUIRvYKsNl48ANxu:fqiweKglBUIrrTTCXr5xd0WInYSr74qb
- TLSH
  T1E517335D82031F4A416FD2557DBE2F2CF5C8A2D2CA82C905B82BCF06C54BBD59AE12F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  server_win.exe
- Size 50.5MB
- SHA256 2e6490ec4f2e995d6076a3758fea7470e24fbda923fa12fe2efc14b798cdab70
- MD5 d7d2f51c1fb7e4bc3ffd53f1b9c77afe
- SHA1 28c67518ec5c1cdb5068527543891c6d22cdcc0a
- SHA512 63d4172f3f10ea7c36b364ce0e8d03151a29d9f0d7c59f0450edf0fe5e1a03114f4d8c3bc9d38a807f66652cc8276c04484c6a374ba4f4c55f1f1771f8aa7a8c
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:sMguj8Q4Vfv/qFTrYp0g
- TLSH
  T111C78C1372E600A6E5B79235879B5103EB72B45B57309BCB318C03251FABFE4AA7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral2
- Target
  startup_windows.bat
- Size 955B
- SHA256 146fcdc18d191eb2f3874eca7eca89f4e9b866d9393bd530dfd0a7ae63a0dac6
- MD5 ef7db694609efe167fed7be732e54ad5
- SHA1 83dfc0c4fee2c370931219cd78d75508affd9f69
- SHA512 1b6314df8e3a3dc6626a0c9df95602a0eb73a6c64016c6b2bbc94c90de42d67eba09cc2ba0bc7bfd7a274816d4fe8a40285a432c741ec86cdd0db230d51a3927
- TLSH
  T1DF11672F3C458645E9FCD162CE8215C13729A24F985CC48D31A73114884BBCED1B5BE7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3