e588e928f5bec5a9dcd7232ad1a4b6ad4e5b4e7e18e9a49d7bfc0a811eefcd6c

General

Target
sre-archivos.zip
Size 954KB
Sample261028-fa9m2aat7l
SHA256 e588e928f5bec5a9dcd7232ad1a4b6ad4e5b4e7e18e9a49d7bfc0a811eefcd6c
MD5 ede1801b763314ca88ddc48d69dc5fa9
SHA1 2ba199af8b441835f459559d6ccf1800bb486c47
SHA512 63e19f832bc9f0b809e4f0099a7be2179dd3ccbb99aee84d1eab06db849509b053623c2d0d791da1d88e4ec398894ac51ba348fb198c217e9df1780035ba1533
SSDEEP 24576:k1CRA6UYCP5g/vVv+lHV6F8FDB6DkkziR42o+88bL:k1FHZhg/v4jxBBkzq42BD
TLSH
T1A925239687CE0E16942DDA2450EE60C1BA617176345DE4E3B14A1CB2B01A32DFB473FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  sre-archivos.zip
- Size 954KB
- SHA256 e588e928f5bec5a9dcd7232ad1a4b6ad4e5b4e7e18e9a49d7bfc0a811eefcd6c
- MD5 ede1801b763314ca88ddc48d69dc5fa9
- SHA1 2ba199af8b441835f459559d6ccf1800bb486c47
- SHA512 63e19f832bc9f0b809e4f0099a7be2179dd3ccbb99aee84d1eab06db849509b053623c2d0d791da1d88e4ec398894ac51ba348fb198c217e9df1780035ba1533
- SSDEEP 24576:k1CRA6UYCP5g/vVv+lHV6F8FDB6DkkziR42o+88bL:k1FHZhg/v4jxBBkzq42BD
- TLSH
  T1A925239687CE0E16942DDA2450EE60C1BA617176345DE4E3B14A1CB2B01A32DFB473FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  graphics-hook-filter64.dll
- Size 94KB
- SHA256 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4
- MD5 bd0a6c382bd1fc44ef2669b6b0534d84
- SHA1 6b3751efa10e5042f0e1f07620a69ea306f7800e
- SHA512 98557a03b48c28db975c3b9082c31fa12ddc9ef99caf9ed13edd283f790584990960b3517eb607662014a2189337aa02eaf0b3a131fb2eb9761dc47a5b22d995
- SSDEEP 1536:0NLr0Fr/HlG3eEaFILK3mTRYBfO+RFGHCfvgLZqfQ9uDEBSHYlWBsWBIdc9dlnHt:MLoruxaFwK3aYBO+RcwvgLZqfQ9uDEBP
- TLSH
  T1FA93294673E401B7E1368638C8A32E45D7B6F85607219F6F07A4466D2F637828D3AF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  graphics-hook_config.bin
- Size 829KB
- SHA256 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab
- MD5 71067a6f7a396d3e6e51216abff279fb
- SHA1 392173d6c8068265ca14519374ab0f0687c4ac1d
- SHA512 ab6e9aca215d7f33de3df6767d23b9faa1aef8ed3a19edfb81b12b018611b7bf74f936a496239fd18ffec802b027170ea811b05a5fea7460a0edab61d82664ce
- SSDEEP 24576:u129A0UYy3z8r7VzaH9V6t8FDvoDwO/8R82d+K:u1TZPD8r7YdxvRO/M828K
- TLSH
  T13205239247CF4E06956CD75550EE6481BAA12135345ED4E3B18B5C72B02E22CEB873FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  svchost.exe
- Size 156KB
- SHA256 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068
- MD5 6d80677af9096febf88e52a9e1c485f8
- SHA1 541f02c11bc7a96a443bc09a8bb70991fcd07857
- SHA512 52a5b51221ed90cce2729cdbf456ea4dfd4610ae509a6140282a603bffcb0b881449ee7b61c274715d807edda722c2955545d08ca1c6fccc9354530d8750b3e7
- SSDEEP 3072:VL2yBdlqFBK16TrhR8VFk20zfgIwrZJ3JXDwZB/e/Fz:3BdlCcurqFz0zSZNdDwnmNz
- TLSH
  T171F38D53B3E434F9E6778635D490460AEB7278760621CBAF03A482565F633C0AE7EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution persistence
- Creates new service(s)
  persistence execution
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Deletes itself
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral4