4d2b6bc68df942ac6c1a6cdac71c4046ffe0a451206475c0f74ae85fdfd53619

Sharing

Copy URL Twitter E-mail

General

Target
netfly_windows.exe
Size 101.8MB
Sample261102-md33zsswcs
SHA256 4d2b6bc68df942ac6c1a6cdac71c4046ffe0a451206475c0f74ae85fdfd53619
MD5 690c7184cee3d4fb38308229a349fded
SHA1 aa04b4de11b2abb0d573021cf41bcc6225ac70b9
SHA512 5455871ff8cd6313630a251ed98906ce3f18d0fe70e43c85cbe4c73ed52dfce14c1a6b22163b420459dec1488a9da86e1e606d92943389f32f5e47cfceee33f1
SSDEEP 1572864:wTQ8Xi/8dwIyiNqXD0FarEiL4hzCDoMLhQMcNJgmsMuvtE+Is28rK+xeIZhia:wTQiMqc2eD4arH2m0UhQ7Jd86T82+I9a
TLSH
T12E3833AA1D48F46AF389C6F0345FAD65813E3D6C30BC1593666047E50C7B985CBACE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  netfly_windows.exe
- Size 101.8MB
- SHA256 4d2b6bc68df942ac6c1a6cdac71c4046ffe0a451206475c0f74ae85fdfd53619
- MD5 690c7184cee3d4fb38308229a349fded
- SHA1 aa04b4de11b2abb0d573021cf41bcc6225ac70b9
- SHA512 5455871ff8cd6313630a251ed98906ce3f18d0fe70e43c85cbe4c73ed52dfce14c1a6b22163b420459dec1488a9da86e1e606d92943389f32f5e47cfceee33f1
- SSDEEP 1572864:wTQ8Xi/8dwIyiNqXD0FarEiL4hzCDoMLhQMcNJgmsMuvtE+Is28rK+xeIZhia:wTQiMqc2eD4arH2m0UhQ7Jd86T82+I9a
- TLSH
  T12E3833AA1D48F46AF389C6F0345FAD65813E3D6C30BC1593666047E50C7B985CBACE2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  app.new/System.Collections.Concurrent.dll
- Size 225KB
- SHA256 7f2ac0ec3bb9425017006cc750dc94a3c37ed175ba2f4eaa3f8f8e5cf35472e0
- MD5 57b88c188923a87a9075fa464fe9a3c1
- SHA1 7ca4ccea16def2d635bd110184d17f0d8a705883
- SHA512 a31aeda9fb2f9326336b6acbc04111a86cf8a3080c2766ef4cddea51bc1b2739a6ede147ed27c39e486e7dd7a26f672e3835dbee48928345e96d387eaf0e8bac
- SSDEEP 3072:pOLq9jhK86tVDNKTs4Vzof/HQLvB76qSa2ymYQraEN7Azg902igtJsPxNnUnZGAI:Eq9jr6LUTs4eQV76qOc212NnUnZGAI
- TLSH
  T102344A16638C0B93E5AF463DA5A3C502D633A55B1312D3EF13E8A5841EA7BC17EBB112
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  app.new/System.Collections.Immutable.dll
- Size 953KB
- SHA256 ce2385891f525991c59d99a86cfaf8d5a81c56f24b01a433f42eb85071832121
- MD5 1e2c0959c6d0103031fca7ecab040a01
- SHA1 58add44b176e113dd4824ada00cf646ac3c0437a
- SHA512 087e035af8a9e7fddab5b4a018f951f90bc909c151c0425448019a7fba02c1dd51cec1ddbd361d66605b97d7688c126ae5a5614145922934dc9a142c23881586
- SSDEEP 24576:rpQa3o0Us2h0c1yL3kopWkmy5OHwDriEI97HbP8L2lqzqF/mg49uPsjdHGpGyhpB:rcHz8L2lqF2n
- TLSH
  T1CC255A15A3CC2F11DE3F86BEE5B3819BD7A184121325D1CF149AF6863FA37C1AA7A411
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  app.new/System.Collections.NonGeneric.dll
- Size 101KB
- SHA256 82ab716ab740669598d8cda36a92690bcc4b01ebba8b21c0c4f0a7a8ee1d9248
- MD5 f6f0ec89c6afc4a10ccfd6e51e4f59ed
- SHA1 e14ec0050825e8bcd76a2e9cb774fb5d19867067
- SHA512 495451a02078eacab680b22a8f1de387887f8e2726d33a3419013c1a41e5ce588ea24844673dfbd6f3474c868c828eaadc4be28143887af84d8f6f02c41768a6
- SSDEEP 1536:bIOMdIo/uGLTwigm/gF79JjI1RHPFybFDySMzYz:bUdIo/uKTZgm/0QRHPFyBlMsz
- TLSH
  T10CA3272D739C4722CABAA2BC91578906E270F5A32717D6EF1008548E5FA7BC1C6F3167
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  app.new/System.Collections.Specialized.dll
- Size 101KB
- SHA256 d9ed158ef29df6146151d13260ddbb2310da7150eb98c2637ce91d057f7786cb
- MD5 40e13c646a37eb8111b683ba632294ad
- SHA1 89200481319a03d7e6c8fcac20e0dccf6921257a
- SHA512 a0240af3427da154b754c00ac43fa7242bd3855cd62c14d27a57e19b97525883ec296cd17ca5dd54c505adee75e507cc3ce9da3bc34dc42d69936565584255de
- SSDEEP 1536:E7ZHyipoBPR72GUFFDE3A0giv9EywNwjNYYD3rBXzs4z0G:E7TpopR9U3MM4jNYYD3rBXI4V
- TLSH
  T12FA35A28738C8B20CB7A82FC95938A42E774F2D31752E6CF5D4894496E577C0867B26F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  app.new/System.Collections.dll
- Size 289KB
- SHA256 78d429a901a73a09cda6037befaa56b79bfa557000b2a69ba1c1210253c0b21d
- MD5 4b125db7c61dfb2c6d1f9223f3a6ac4c
- SHA1 9fd11a08547d73c546283850c13a89b86fe09172
- SHA512 685c89dec7a3fb3dc79074003669fc4a029d48f644126a41d3f61816e267e791247e43bd99de834b4e269816d40a822346c20ee067fe6f7040d6bed86ba28957
- SSDEEP 3072:OVUwvuGeTbhnDHdY81uFqzK4s2QMsf0r3p9dJ2SAmnp8SFK0gwsDiBMOLI6mFLa:W0G49Dj1Fe4eL8ph2wC0auL++
- TLSH
  T177544A1873888725FDBF41BAE593C112E1B990938350A2CB47BDF6509FDFBD12ABA015
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  app.new/System.ComponentModel.Annotations.dll
- Size 193KB
- SHA256 f2c3fda351505065effbb42e175e50b4c9bcb4c4f560ebacc868d50d29252eab
- MD5 ceac09b8541557e0a68717d4de7fa172
- SHA1 3f27dd199f4c8f414fe8d2fcf534932e07a429b5
- SHA512 0a029a99485bfbb9f4c3ead4fc5e9b687188f65e4d060cab84795158736a9555b5496656b04f175eb5f269e00c5fd5a97576a64b6f2342b6ac5db9926beb09cb
- SSDEEP 3072:0fH/ppZlUBvswr6DTa2mMlcyrD5/oE5bF622hhNdYQw34n5vPa:upfldwG/a2zlcyr2hNaQTE
- TLSH
  T17A14492663D8461BFBFB86B889365560C3B3B8866720C6CF0544D94D1F637C0BE36766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  app.new/System.ComponentModel.DataAnnotations.dll
- Size 16KB
- SHA256 f7675a194e2f444670b94d3d3866dd3dd16b48b332cc5811268ff903e6c17a65
- MD5 99b478f8b0130e80319ab1a53502f79b
- SHA1 f31086536d593eeaba0d586cd0a5d815ab8f9bdd
- SHA512 953ddc81367fe72f2ffdf8392852d4f2b5edc076f9453cd277fa10a87e02a557ba8db655a4d0cabeb8516f0acf37aaff715e9e1adfdeb286c61bb43ac81b391f
- SSDEEP 384:+HhmblJeIeGXxXG9B0TWqXWxZZlNioMR9zPk9g:+HTVq79zc9g
- TLSH
  T141723B92872C4623EDAB5F70DBA5EC823EB8E3D14C628B760599E5480C177C4DB39729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  app.new/System.ComponentModel.EventBasedAsync.dll
- Size 45KB
- SHA256 d060e7f58feb609db4f47e2a6da25c4a9b406b97589004d4022d31d673aacc52
- MD5 1c864921a6af9268a289d0ce77500f63
- SHA1 86f3f21b4accdf6cca23b4d122ce5f42585d3d0c
- SHA512 f46ed78d414ac4c05d86874fb9819c90e74aa6d44d7aceabeb0bb4fd0ecf4a1a69d05677f1b6bfb5e202dd279bd3b7be214d8fbabc914f789b26b12cfef54cd5
- SSDEEP 384:WWqwWx7B/3VRYdWBFEWpsZiZHlRq1bVMyQmXDX6O88+aEZ4j5wVyNFBK8Efc1sZQ:izDjF41F8IVrY8EEzPO59zO
- TLSH
  T17F235B71439C4231FB771A7DC2A29E22AAB8FB899742E7CF1454D20D1EA37D1873216D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  app.new/System.ComponentModel.Primitives.dll
- Size 77KB
- SHA256 953db884b5edfc396ed4036413240e538cdbb858c06354d976d7b2e6ccce7167
- MD5 651926623f9778d9efa5e1d977cbc083
- SHA1 54bdf2654ef92f045281370f5b5c34b6639cde18
- SHA512 c7f815aa11c6512ff64f219912010e274aa8af9b5eb743f00c13fd844d08e853571cf028b50dd38fd90952793888fbcd0d6f9f2dcfd869435c8fa6e26d82e90b
- SSDEEP 1536:cHpdlp7xFkIkSyypSM2VLIGOYu2nC6l8tHlzVwivB:cblZxFJVy+hgLVO52C6lqaivB
- TLSH
  T160734A1813E80319EBAD167C96B399109574F5871323D9CF8690D95E2F8BBC2F271A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  app.new/System.ComponentModel.TypeConverter.dll
- Size 749KB
- SHA256 8faabcf0ea88a11425d247b19d9cc8a64a78a7c07ff977854cf4a9166e0415b7
- MD5 65e195381dcf84338c863e5548495427
- SHA1 65cbc0297814149f86e45753f64c7461765c7550
- SHA512 69cbaa33e825ceda0731e30f6a0959d4d336d431e5465ff4bfedd58ec6893250e5f208378ba9a2fe8f8abcd30580386cf7bd9e4e948a2c6256a89bf916b6b90a
- SSDEEP 12288:acYuiFO9v8RRlkR9Vf6g+/9e+/iP9WD4Tq0Wbt2WSRmGWe4rBvq+IyYmXilgG1V:1R+l8dr+/9e+/o+mq0Wb7M4rBvNYHO6
- TLSH
  T129F47C19ABD86931D7BF82BEC6230912D171D893A375C6CB2695DD852FC37C0A2B1372
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  app.new/System.ComponentModel.dll
- Size 29KB
- SHA256 72b3608363e47f2cf3cf3fc9fe2fcefb760e5292ebb9d650fa4ced3896dab5f9
- MD5 2c652221e291600c1044beaf546c981b
- SHA1 0850542a974e1003b5bdf2eefdedbf9b4668d86c
- SHA512 6362f9a93679fe794e12edd4e8239f1e736d471fdb32a1cd283cc35c2cd4189768dff439adea0c1cf654696fb4b1de6c64a09ff1baf9d07a6943d0add31b6932
- SSDEEP 192:LqWq1WxRB0uBB1SY7+Axx4gYNIKWCWKie1BzBWseaoWM1qKIxYPVCX01k9z3AnCt:GWq1WxRB0uBSk+O4gYRZlNarER9z9gq
- TLSH
  T1B3D24CE69B688213EC9B5E702AA8DE833D7DB3C68E0296970295F5494D537C4FB3053C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  app.new/System.Configuration.dll
- Size 18KB
- SHA256 c53f9278c6889d8562d616106413bf50198f452316b4c5002100c568d541428c
- MD5 6327a68e7c7ba5b2a66ab3ea67e44dbf
- SHA1 6deb5a712e32185a864bb5794104c0ba4202414b
- SHA512 8b314f3e2eafba71093469d20a3c37f5ca9a37b9c4a92045d82bb8d22ddd1a74934142b881b943bf74cd54500fa815df6804bb333c370c5231c4cfcb323feddd
- SSDEEP 384:zMXTSv/fUNRvGZYdf3zyP/weUm8BCW+WxNWx/ZlNw/pU9xDE3R9zxNY:KQUTvbhULi9z7Y
- TLSH
  T18D82F7A3D3584A17DD9B1BB294C3C9D22FF86B85D875875AD1BEE004481B7C88B2232D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  app.new/System.Console.dll
- Size 165KB
- SHA256 8be68e4cb2f0b64b5f37f7a7aa82db2ae1648115a9b7b9381a3cfac7cdb4aeb5
- MD5 3d769ee8743f62bf87b814f39a4293a9
- SHA1 c43c0b196603dcd58ec4a6463be1c91bd83a8054
- SHA512 a65c4de098a94407bfeecb7b3c4434a8c7d3148b561beae80c4aed4262b23b9c6b45b026ba950ee00aadef33712bb444e4ca21e71210080aa16e059ea205128b
- SSDEEP 3072:G/W8LvmirfHk4xuvfg7v93MtglaVRc47x3:kOirfDxuHORNkl
- TLSH
  T1E1F37C2A97DD6527D77F86B885934301D333B8A60307E6EB418588881F53BC2FB716A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  app.new/System.Core.dll
- Size 22KB
- SHA256 f1dcf1577c6a675f1c85ee9f13d103495ce123ed232001646f4132d76c1480cb
- MD5 c9f2f34f4c73a5c79defc3f5c804d888
- SHA1 7cf6d18437b90a82ae6ac91491a4f904cf9ba3f6
- SHA512 cdd03fe9cc56763b5e1dfc17995d1a136e8b5a45ddab72e736107bf17aa14bba595e8cd3404fc711aec1ba85f978804d30e0322038bee51813dee669e5f04097
- SSDEEP 384:sT5wIGUpx1zHnOXrxIg+smWf2ucK7XGk9lxkrW1rU1ZXtsjvBDPWQ2Wx9lNRki+p:sT5wIGUpx1zHOXrxIg+shf2ucK72k9NG
- TLSH
  T170A24B615ACC41B3DC9E5FB19A7BCD8A39F1A3C3A431986E218ED5091C933E09F2139D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  app.new/System.Data.Common.dll
- Size 2.6MB
- SHA256 e6be5f74d117b7300523041ec239d2c7b64fc495ef954f48f81ca71507e510c6
- MD5 ea677dda30907078c1684c8c07cca468
- SHA1 db9e3ad0face088ff40c9c2919f63e4067600859
- SHA512 52682da90441ca19ebe2d25876bf8678f514bf78dff186f290ba1d87872769994398731f46153d94992a92eb4f30197a0ac3a33a9b9cd5baac22879ba68330da
- SSDEEP 49152:TF5y4nlrO6Gne21dFFgPUtAZ3VNjUsFWYi5TBip6:TLycCxFyUsFf+
- TLSH
  T190D58D06A3DC0607D23E86BD93668711D6B1B4631311E5CF0458EEDA2FD3FC25ABA5A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32