72b1e465a8ea4c509e4cd9e6dc11e1bb4d013b625e35363d8ad5f1c9a936e901

Sharing

Copy URL Twitter E-mail

General

Target
SakoraSetup.exe
Size 114KB
Sample261030-l58bcabs9v
SHA256 72b1e465a8ea4c509e4cd9e6dc11e1bb4d013b625e35363d8ad5f1c9a936e901
MD5 90fef75901f3cf37f21ef9c859294667
SHA1 e9382837e4db99cbb7e22cec4dc49add4f0af6a7
SHA512 1aba8205ccc00eab2391661c45290509bfdead9539e92bcf07de51f4a062fd91d4e91a71b3487b8223ff642568ed1e9b21a837585a92c74ae5199f6b89502ba5
SSDEEP 3072:1rv+LsMjvFsOTb98xQT+5U5qwBpEAjSF9P:9WLsKB0Irzjs
TLSH
T1E4B39E1CBB268CF7D83245309997FAAF4A256D718D6A960FDB111B73DC335A1E60B302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SakoraSetup.exe
- Size 114KB
- SHA256 72b1e465a8ea4c509e4cd9e6dc11e1bb4d013b625e35363d8ad5f1c9a936e901
- MD5 90fef75901f3cf37f21ef9c859294667
- SHA1 e9382837e4db99cbb7e22cec4dc49add4f0af6a7
- SHA512 1aba8205ccc00eab2391661c45290509bfdead9539e92bcf07de51f4a062fd91d4e91a71b3487b8223ff642568ed1e9b21a837585a92c74ae5199f6b89502ba5
- SSDEEP 3072:1rv+LsMjvFsOTb98xQT+5U5qwBpEAjSF9P:9WLsKB0Irzjs
- TLSH
  T1E4B39E1CBB268CF7D83245309997FAAF4A256D718D6A960FDB111B73DC335A1E60B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
- MD5 e78bcd3208bff839e612041895bb8d42
- SHA1 4b21b475b21d8f8bb2655d8e8e7d47548825831f
- SHA512 eb38959a877d1af4ae53f25407ede3172f990f8c824624f5a2f385cddbd71a437b9033d45042a0e40f7fb611ff48836be166d97d42f3c169babb063ef48e8e35
- SSDEEP 192:MItx8GSBYnUMu3Oad973Ykv/RGwC7ocJ4D4:bx8GOYnBu3Oad973YkvMwC7ocJ
- TLSH
  T12A22B8C9BA1579F5E0239838B18AF12F4D5D7C31DA2B840EE89A1E35B81F5E4571DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Uninstall.exe
- Size 103KB
- SHA256 e30f689cb2821201cde59bf0920f885f9e3cbce2caba106cab8612a27ab238d9
- MD5 451aab828c38d144e367b84df850164e
- SHA1 12e1dc0e387cb8ff34f10e369082f59ee7e1c947
- SHA512 6262e90645e7b4474d12faf1b54de3e754d51c1137807a5508178b0b3c88a471f305d736dbb923ecf7325a2b35a027250bed974670288a9bbe084970b6dfea7e
- SSDEEP 1536:1TnvHeLrwe71iakGFHmpaoOTb9abxQT+5U3SuxF+itD2pjUp:1rv+LsMjvFsOTb98xQT+5U5qwCpAp
- TLSH
  T128A37D1CBF268CF7D83245315997FAAF4A25AD71895A960BEB111B33DC335A1E60F302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion execution persistence privilege_escalation
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
- MD5 e78bcd3208bff839e612041895bb8d42
- SHA1 4b21b475b21d8f8bb2655d8e8e7d47548825831f
- SHA512 eb38959a877d1af4ae53f25407ede3172f990f8c824624f5a2f385cddbd71a437b9033d45042a0e40f7fb611ff48836be166d97d42f3c169babb063ef48e8e35
- SSDEEP 192:MItx8GSBYnUMu3Oad973Ykv/RGwC7ocJ4D4:bx8GOYnBu3Oad973YkvMwC7ocJ
- TLSH
  T12A22B8C9BA1579F5E0239838B18AF12F4D5D7C31DA2B840EE89A1E35B81F5E4571DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  download.ps1
- Size 815B
- SHA256 0c8c6ad43304caa8c3386f242764147d97d9ec9db55c44a0f94fa6ead80127cb
- MD5 cc6d1253f0bcfbaafd38ea44582818df
- SHA1 7520c3009693c3bcf67a39da3a547aef1881dc19
- SHA512 4e7ac8adbf1a4b70d8e8e2668dd7f34728742f7674070c07c8cf7fa7c67e58ad144e143f1833773fd4c3656781088e7f90c5a673da13244a013f69734d544333
- TLSH
  T15E014105BC57C45C931AA0AD588CF248E5F07236414D3C14F6B8D9C49BCEDACD6E401F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  launcher.ps1
- Size 8KB
- SHA256 27457f06dd60b0d6693123d5cba7eb8ddc04f20a9479e9b5ee7505e792a7ec02
- MD5 a37568f4998373164f92a2ce580166f2
- SHA1 04459083a9dd67997ae9430d3518eafbfdf7bf22
- SHA512 a9eeceefd2ede1d13ceb0f88512cf63c531cc58603fdb31ba2182c0a2ed43f9731a8b916f37a269e3b4196aa747dff31e075da2026cbdea9dee97a4a5399947d
- SSDEEP 192:cczuu7ck+DWunRbdA9lzwHDewFWfPIvhRqEPZM8ZpX1EGEEoyWGiHIuW9iY5yNSq:3Vz4RglzbUYPIZRqQHJEGEEowB9/sLzP
- TLSH
  T1CC020A357210402792D263296ECED1A43FBF416AC00E3B29F5DC9A81BFE567D67AC690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  launcher.vbs
- Size 583B
- SHA256 eda636e79a04b11b0d91314783f1ea5e818ae6cdb21750651914e40a017075fe
- MD5 a93707b29d2a11cbcadd2f67e14531f7
- SHA1 bc30f05a7f11e078bd27a4ce3a8137fc296e3d97
- SHA512 6b4164e4f8c676b113c2c3097a73012e631eab0f1896579dc6e940128aa39f637b29460365b0f37581a4fcfd726e2420d9094edce236bdcc261e84f833ce53b2
- TLSH
  T1D6F02B0CAC1EE27AC693C193B2BFDD1DDB61A86A5019F4FD8C94C898341927C6D65183
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  network.ps1
- Size 2KB
- SHA256 8e9c181306df90e6385a1e89c60a3fdcca740b0769144429b359c5856cb1e9f5
- MD5 cd657aaf851aa40531e8318bf9def208
- SHA1 719f656ce90c42638076cab1554af021c0b146e6
- SHA512 777d312046ebec182f883c8bac258a08e4acdffef370a3dcd41dae25ec6bfb06a9e7b3440aff28c965bf128a53d2ab6944e7be1e676e4fdcd451da981eb559cb
- TLSH
  T114417621B6A5B4DE54C3C322DACBB3D8B7D680A9010D1E48E5DCC1C6B7E38394B29CD5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution persistence privilege_escalation
- Drops file in Drivers directory
behavioral15 behavioral16