70ddc6cbecc52d4341903b53cc6b24741f25d959fe2a0d1c6951df62ecd3da23

Sharing

Copy URL Twitter E-mail

General

Target
LosPollos.exe
Size 59.4MB
Sample261102-n29fcaht7x
SHA256 70ddc6cbecc52d4341903b53cc6b24741f25d959fe2a0d1c6951df62ecd3da23
MD5 b39bc2d2854779556aa44b437b8147ff
SHA1 31aaa3181b0dda101c2c379788ce9053d9c57abc
SHA512 96d118ff093063006772a0ad1b41534b39bef49856ac48b88c84916825fc75072e0d13b8cf8cffe47aee1120889fcf8ff75cb85d1b6b73443e537ccb7165759a
SSDEEP 1572864:Ahty2M+IKxh6ZQxdU1SGOKwybBJ0N4DNwOMNRNi7:Ahc2zLh6ZQ3UMdoAqCOuRI7
TLSH
T13AD733CA8654BF4FFF75B734D7983606DAA1ADD923105032220D242FB14F0B2DA5E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  LosPollos.exe
- Size 59.4MB
- SHA256 70ddc6cbecc52d4341903b53cc6b24741f25d959fe2a0d1c6951df62ecd3da23
- MD5 b39bc2d2854779556aa44b437b8147ff
- SHA1 31aaa3181b0dda101c2c379788ce9053d9c57abc
- SHA512 96d118ff093063006772a0ad1b41534b39bef49856ac48b88c84916825fc75072e0d13b8cf8cffe47aee1120889fcf8ff75cb85d1b6b73443e537ccb7165759a
- SSDEEP 1572864:Ahty2M+IKxh6ZQxdU1SGOKwybBJ0N4DNwOMNRNi7:Ahc2zLh6ZQ3UMdoAqCOuRI7
- TLSH
  T13AD733CA8654BF4FFF75B734D7983606DAA1ADD923105032220D242FB14F0B2DA5E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 59.0MB
- SHA256 709baa36ed98ccea917a21d977f520428e165ec02cda1a35a40cad58b304e7f5
- MD5 7327a640189cd2c8e0d803aee7fce904
- SHA1 9a2cb05332778f4225bbae756b64711b5ebe1283
- SHA512 cf1de2a97bf14be2234ecbc86aa823e7278a05fcfce6ab9f1e55ba66bcd13068cdcbc7df500d2dbbe3c0226b9ede5e4b15bff48dd4fc69f499767c3a6d434bfb
- SSDEEP 1572864:jhty2M+IKxh6ZQxdU1SGOKwybBJ0N4DNwOMNRNk:jhc2zLh6ZQ3UMdoAqCOuRO
- TLSH
  T157D733DA8614BF5FFF79B730D7983606DAA1ADD923105032310D242BB14F0B2DA5A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH
  T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  VaxonSync.exe
- Size 168.2MB
- SHA256 171f0cae0268b186c910d804d7f6956345e007444939148695060b00c4d32d8f
- MD5 e57d0cbb1244d2ad7667bde98c088050
- SHA1 9cd5d76d8dcbec275d33d2bba26516deaf157bbe
- SHA512 b3f74cd8e177415c3d31d5d95e30f72fa8e9383f5716177591e8c56bf46ff33d0214504863e51436b6b19a1f1b6d12adbf05269e5f3b7c19231940b3a5e44a59
- SSDEEP 1572864:9gRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:Fg/geeFXzGa9Fz
- TLSH
  T1D4887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
- MD5 b1bccf31fa5710207026d373edd96161
- SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
- SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
- SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
- TLSH
  T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
- MD5 8f3d89744ae11b0925faf4b64890d0d7
- SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
- SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
- SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
- TLSH
  T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
- MD5 74bded81ce10a426df54da39cfa132ff
- SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
- SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
- SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
- TLSH
  T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
- MD5 f1fe23058e7eece1de389a0c882bc1ad
- SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
- SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
- SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
- TLSH
  T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
- MD5 76141455cd2705897d38e9785117e405
- SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
- SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
- SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
- TLSH
  T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  locales/tr.pak
- Size 523KB
- SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
- MD5 04d37b8e9db287042e86d0623063f9ca
- SHA1 c6c3c32350737efbc938f59a12d1d4a1c2aca736
- SHA512 38756868fdd0045aa3e10d26e89f923759aff7fb4c984cae2fc46091d737e6c9b5edd924948671abe4b9991e150dcb0068143618911595f021332a5dba7ad912
- SSDEEP 6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
- TLSH
  T15EB4E98178EF381C8BB9278FD7E90666F89F0766B331E4469A16863A774535303E760C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources.pak
- Size 5.0MB
- SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
- MD5 54790975c932460ffa375cd0f0f8fff0
- SHA1 05b72ff82abb8ddac1a92471f765b87b7ff1e9fd
- SHA512 d74627207caa35602e68ad6c08a0ebf55fe062e191a1885eb38226755d382dd3407dea883e4337c5cff23c1f724d64e5598edf7a5ce93d4cc1ea6ea10c41aa0e
- SSDEEP 98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
- TLSH
  T1103633C77AB4443EE905633B401D4B752F29F2C61B612036705CB59DBF3A6ACAE9407E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar
- Size 4KB
- SHA256 5197b573d45d16ff2a21e4234cd4dc1ee93dd128c81c437df110277150543cf8
- MD5 df59d9723bede07667e279afc5efe6b5
- SHA1 7ebac46b367d4550472f52d4562bbf1a1ed806a8
- SHA512 7dbdf12b293c4bd70def2239e8e90cf46bdf7cbf332d90e7a2718e958fe4614ee002f2f756f920c55e324d69d9757eb8c4962f991fcc1b1110408d560fc1f50f
- SSDEEP 96:0kYEf/OCb/mAPY8HZpjMXJzNQWjoT2c5csytX:0k3OCqAw8HZpjaJzS2c5Z0X
- TLSH
  T10F812A960BA443B9A130729F6583403F022279473221FACEF52CDA845F972B9A0FB35D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VMWare Tools registry key

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Discovers running processes

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VMWare Tools registry key

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32