1ba5aa0164d786e1cb1c7f37ed6d85b2ce9a663a05ec19932c58cd7e0b91fa93

Sharing

Copy URL Twitter E-mail

General

Target
FOLIO-Setup.exe
Size 715KB
Sample261102-bm22haes9y
SHA256 1ba5aa0164d786e1cb1c7f37ed6d85b2ce9a663a05ec19932c58cd7e0b91fa93
MD5 f9d95b12d227b29df163bde9dd347f39
SHA1 3006b2d9f856a7674f004bf8b21ac5b9a8702892
SHA512 b8ff682b336e9600b92dbd2eb2a9a56b0407cbe218110418d6f06ad476bffc79c03df9850404ab8c677c5708d461f238ca9452d01b9b8fc6868c6cc0fd763300
SSDEEP 12288:tfR8os9nqkvq3vdt+2NIr0EdJYZLWT1szRZZ8M4EvfgFs8i4sM1yKsCp6XgZlx:t5/s9qkvq33wtd3Tw4EWs8ilM1OXgZf
TLSH
T1F8F4126CAB568CF3E47244355A83F97F0A216D71CF27BB4BEB510A329C37662A117306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FOLIO-Setup.exe
- Size 715KB
- SHA256 1ba5aa0164d786e1cb1c7f37ed6d85b2ce9a663a05ec19932c58cd7e0b91fa93
- MD5 f9d95b12d227b29df163bde9dd347f39
- SHA1 3006b2d9f856a7674f004bf8b21ac5b9a8702892
- SHA512 b8ff682b336e9600b92dbd2eb2a9a56b0407cbe218110418d6f06ad476bffc79c03df9850404ab8c677c5708d461f238ca9452d01b9b8fc6868c6cc0fd763300
- SSDEEP 12288:tfR8os9nqkvq3vdt+2NIr0EdJYZLWT1szRZZ8M4EvfgFs8i4sM1yKsCp6XgZlx:t5/s9qkvq33wtd3Tw4EWs8ilM1OXgZf
- TLSH
  T1F8F4126CAB568CF3E47244355A83F97F0A216D71CF27BB4BEB510A329C37662A117306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Uninstall.exe
- Size 101KB
- SHA256 9523439c6c1489babbd5a3cd17ef89863a4a6e811934e24cf150738e2c96f1a0
- MD5 5e4d04d69eb210ae4da5046fa34068e8
- SHA1 f37d654425240607c1170d32b23b27d54b29c068
- SHA512 b50ebc0e0ed48ac73cf50e266ea3c90d69792d1259e920ce1da37f67d559488337090da276195bf1276e6c587804459c552831c75375e47e805179187792b429
- SSDEEP 1536:aTnvHeLrwe71iakGFHmpaoOTb9abxQT+5U3SuxF+itDnpRZT:arv+LsMjvFsOTb98xQT+5U5qwvZT
- TLSH
  T187A39E1CBF268CF7D43244705993F9AF8A256D718A6A960BDB111B73DC379A1E60F302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Deletes itself
  defense_evasion
- Executes dropped EXE
behavioral7 behavioral8
- Target
  folio.exe
- Size 2.8MB
- SHA256 552d6e6363ed679e9ad566f445c8c7ad41297d67ca883a69bb625e59cf608e59
- MD5 936b05d533b15a487b383ae99cf7ef1d
- SHA1 4b559a0b0cbe2f9df45f627fb0219562f9e384e2
- SHA512 aeee5d599a83b99cd0e67311ae6f55d7dd3f54e0166930277114fbcec576533d995106bbfb4f582ce5835a1ac199ee48218fe6ed94795374a68e9da0831c81e1
- SSDEEP 49152:2Sci/WJb3caGPI5YgvkMeXcV/MhZsCqkPXWfI7d3MXB35O8+i:VeJTQI5YgvkMw1PXWfy3MXB35O8+i
- TLSH
  T115D5094369DB0DE9CDD6B7B8A1931335A734FD758A295E3EAA08C2311D53AC4AD1FB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery execution
behavioral10 behavioral9
- Target
  web/index.html
- Size 42KB
- SHA256 220604d9fc7a64d66314470cdff680cbc67185aa186889f58218632922a2e3e0
- MD5 5e65dc46e5763f49c6cf4216f9ab6627
- SHA1 860a8fb046f589d1484036205c7a39bc25aac350
- SHA512 f66aa557af121374cf0121ab237f4137593796a8976bd000846b20bd86a7a01a691d9e207f5d63ec3da7c0206bec1e7da6a021ffbcdfa95e3eb69bf8d7842745
- SSDEEP 768:NimekaHfso3uRxqE2j2vibYlRkFRi9aBbUVpNkfd8H2v54Po4udkTQh:gfvs8ryvibYLqRbUVpnH25Ph
- TLSH
  T1221309A0A5B0A0365877C4A2E58E676FF180E50BCC4B4054BBDC454B8FCBEF27E5DA49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12