fbd5a4e143fec1dde41dbec4045ec7f4db715f0dd129bef7cf616ad80c284228

Sharing

Copy URL Twitter E-mail

General

Target
steam_mitm_deploy.zip
Size 116KB
Sample261102-pklhmav18m
SHA256 fbd5a4e143fec1dde41dbec4045ec7f4db715f0dd129bef7cf616ad80c284228
MD5 4ff26e87a3beef523ebdf8ba90d620b7
SHA1 af4a3b828f8f0e5f19d2a450b662d9913dfaa472
SHA512 d9f59e4f394d42cc045abc01ce1aa0f857fda38fae69b787a7bb0c7270ad9b7710dc9cf331095b2a6d6eda8da9ca2027966899764686893eccd6c1031ccce247
SSDEEP 3072:ZJHiDeqlJHJgMID4gb4mFajweF66ZSUYhXEBzvjc:ZUeqtgNDdNyF66ZzYZ87c
TLSH
T1A3C3E1F4CF9A6562FA4E8030D46DDF06B0DE90615133FD8B1D229AE0D94A543EB35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://harikrishnaharirama.com

Targets

- Target
  DEPLOY.md
- Size 9KB
- SHA256 2aa2cf1e88a59e931b145f0aa688803b387f9c8aab487c73b5e3a30a93a861f1
- MD5 89c1663910b642b5ebfb9aa921b294a1
- SHA1 e72d3644c065b81a3283bef7d7952983356dcf36
- SHA512 9eea8f6db2288bb076b118db2aaba7b4c65d7ad844e75c1c9a464bbffb09f715fd58a5ab71a3e46fbe8a219f26c9308c1f01505a723bb4ffc049712f90b41f16
- SSDEEP 192:dgrrXX1vwH4niWbrxAgUSqSUSFUSf7U1HScneEeko:urXXIm5NISqSUSFUSQdSCeEc
- TLSH
  T1DD222F301AD969CD3369E51FD8043F0AB98634BE396B465934AC3D2C67EE539C12C27E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  START-DEDIK.md
- Size 2KB
- SHA256 fb9e9ed48ee49a159e5bef78ee9668d86c3ef62fe2f1cbea259ed2ba107c536e
- MD5 e91407636ecacfb3fbd8123ef2f148a6
- SHA1 f53f60b102ba3a64affa44e39fd81d983f23aeec
- SHA512 5d991ccc3f67731a25159dd612f3ea70b0c8f61ac92c0398ab1d5f1bb0c4e81b85287b21a0b9a6d0e85c3654409014ba857acb5affb4929ce28541a7ce7d01f2
- TLSH
  T1D851402655CE25EE07241147F5002F0EACD660FEB697176934EC2F7D2BE9238869E24A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral3 behavioral4
- Target
  START-DEDIK.ps1
- Size 437B
- SHA256 5306de2e5f48c0f8e545f86738acfa57aa427024c8106948b23970cabecf712c
- MD5 1317c7d336607d37a5be424cd3674b91
- SHA1 cf5defa5b22f05be3b13f2f78d7efec550b21d65
- SHA512 c383f386355f9fdd690849c16c0c8fa5014f024bf0ccd52c0642202b81a8a2168e183ecbc221febd380a6e38d67cbb39bf6b626ea729a76d5f2d02aa70bd1422
- TLSH
  T1D7E05C215BC16534FCD9415EA9A59B86924E8C3E80053B1512BC30005E23FA94E7BAB1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral5 behavioral6
- Target
  install-silent.ps1
- Size 76B
- SHA256 3cc805047423656d158e6b4669942c9369b114b9a40df2b3fbd5c3217bd45223
- MD5 8fcbfea9c150158c3572b46347e3a3fd
- SHA1 5d54e03b6be3aa1e8c5a1d2e87f3669aba34fc9f
- SHA512 d0b10b200dd339c3a51739dd2c3bbebc6ce8b274a9278de135c1b9b098e2412630e8062d0fb01bc5e5fa4d27c14dbcb722b65720d0b56f034f01e12025080bb3
- TLSH
  T1C3A024405FC4F3503CC4C030F4110D4D30D4151110311C30F041FD100157413CF71031
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral7 behavioral8
- Target
  install.ps1
- Size 164B
- SHA256 6eeb34f971da06eb1d696924e9e40bc720207d230cc4217ac3903d33a28f3af6
- MD5 3ef3f1e5f95bfd83a49e4d91ec52f80f
- SHA1 fa1fecd440fcceeb12426e46210f85d24f3be958
- SHA512 7f346e26a560ae1fc3fe0c304b0479301dfa55252c2a584dcaae904ef40a008ce25faf4942bac38de45065607cfa655c9d92579dc9bb2491a98126003733f89a
- TLSH
  T1BEC012605684354DF6C48161A862274475580416341C246072A605389FBBA9C8F314F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral10 behavioral9
- Target
  launch-chrome.ps1
- Size 245B
- SHA256 ad054fea59e7c21432396863aa685a3ae13be4b5662e558adec8c87080ff4cdd
- MD5 7d4da621e761f34dc1f0194f1fc2296c
- SHA1 771d92851dab9a3d679c553642f5711aed89a4bd
- SHA512 a89b34c10a0047a7c4ee59306f1bcaf427efab22ee1b9a8c3733d2a4aa7631ea11fb50ed04488e94521be2398cd51d76b8b765889f5bc7d4db2daf38c4505c41
- TLSH
  T175D0A749168E5E4E65D49492B86225213F4C2413282F6875F7FA462C4F7FA8E9FF00FE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  mitm_lab/._chrome_lab.cmd
- Size 707B
- SHA256 1c8e7a27a198753f6b34730691bf1d0946fe3350a6e4f6056e92dda707ba4808
- MD5 680b372338b62acdf3633c741f6ac3ab
- SHA1 0cd8eb3367559a3a2e62f6497c588d34511c129a
- SHA512 13161ccae8b98d5432d62e6cd5acafd2bf869a7934aa6a350b545dd20f309ca413995e90be8d347c7b04ee500ad5007967ee329b85b20701975e837aac467a06
- TLSH
  T18E01CBA3C45856FE1B2BD674B04231EBF71BC6AB30CA8BC43C05036455D3681052ED4E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral13 behavioral14
- Target
  mitm_lab/_lab_service.ps1
- Size 7KB
- SHA256 c630add978450ab339edb615bc0ff9888dc4e7dbc9bd1a383348c76f7036e719
- MD5 c355d169283c90243bd4a81aa693fe5f
- SHA1 9c38babd00ab577bacfadad3a358a20f2ee46a75
- SHA512 26c87f13623a254e1fd1b79e4cad5f42751456b2fa6ff15a5776434988acc2fc3c4030504158044d16c30adf727aa68bfb9c3da4d6d18b7de6ff623231c27189
- SSDEEP 192:CXQlAiDivQwM1Q6iQJ0cQblnbg7NScRBfa4HIJSZG35kOB4I9gnhLjbla:CMa8lqxAhLs
- TLSH
  T14DF1851DB9D0945BD2DF1A3EC8DA55487C26849B611C2F00B97C62E4BF5013ECBB939B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  mitm_lab/assets/inventory_hide.js
- Size 19KB
- SHA256 1ae55427feb5795a59fa8758e90ee16a3108b99f563d735a489904d655b8aac4
- MD5 79d8376d6e5312f5a521b5815dd1c441
- SHA1 76aa915d5ed1f8262cc40450f20d799df23b1cfd
- SHA512 48b8e5bd36c1363d17e12684e14875fa59ea1c433bdbd1bf8e084e54e456acc4b28ce5be1c3afa928db23b9fd3c1fdcbaf06da35f6ae294a64edadeb2d6c77c3
- SSDEEP 384:pJSy27NMgk4rQe9FlkwB55vIROdKnpkcFrC4+AasuDBS5Td:zA7agk4rQe9FmQ5GR1/rC44sudSNd
- TLSH
  T1DA9296496DE721BA2923313D8FAF9405762685C3004DDC107E5CE664BF90A3A1BFAFE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  mitm_lab/assets/inventory_inject.js
- Size 61KB
- SHA256 0b8928784ea80c8436a69d87861e56274528c9a2530418f6bddec8e6682e8a54
- MD5 e21b9a6dc8c23f38d2c08822bb1c4c5a
- SHA1 ddd758bc311bc7ec992bcaf7fa2d0a0b655b9f61
- SHA512 a5bd2d750f8bd2528710365679a022335ba394bf4165d2fe4ebed4200fe221bc30142468c2b422c17b0df8dc18eaca79ad507da91930439598360298d6fc4144
- SSDEEP 1536:WHYMrAYUq1X8MpEiNm1SyjmatJf4l9jPb9Q2eaMzx/P:WHY/QPEiNm1Bjm0Jf4LjPtYx/P
- TLSH
  T10E53834CA8E721B92A63703D8FFF6444B2B485534658CA107C5CE22CBF9097257FABD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  mitm_lab/assets/profile_appearance_reset.js
- Size 22KB
- SHA256 360ad13990112a610d9d7d63b318b78c4a9e5e001a8680bdafdf2d2a68433af2
- MD5 3a8442e23f4bb3bc593c7b342c94155a
- SHA1 9e355ae2d4052ffd7d8a6ab4ada5aff2e77c00a9
- SHA512 d55f0d44421638515cfc92f4ce1badb4831384eedc34f14029f03239762968816155c64e9f173676aab214dd9de65ae552001cd531449f14d6499fdb312bd58a
- SSDEEP 384:byqPBs+JSS4lgiFH9wTQ7sjhnJrBnpaziE4YcBh6x3mKV65iztY+mNQL2RqbxcOD:bvJSS4HFHSTDxJrBnpaWE4Ycux3mKV6A
- TLSH
  T11BA2754BE4EB20731433B8BDDADFA54570648047A208EE00BDAD452D6FC9AF917F16E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  mitm_lab/assets/support_redirect.js
- Size 44KB
- SHA256 a36359df3800b52878586b4880c075c69a1be1773b8e926369654e4c2e6d3805
- MD5 ebf713d5b1213733e5736251eb6d7177
- SHA1 bb5cd060fb8b0b3f5e5f8ea18f7850400fe0b9e9
- SHA512 d94bb731951262c707babf8c8cdb72857f41fd1442a877878d30a86389186f610ffe5bc47b91041b654e631d18a292bc7923ddfcaf9294a60d5c2a72bc5080fc
- SSDEEP 768:QMe7I+R55D9m3Y2ri6ujTbvbnMe79xtjcF5NBXN:Qd7I+R55DQ3Y2r0vbvbnd79xtjc3r9
- TLSH
  T1F72372EA99F3113C5063A0ABE7BB6E1E30918823D106CB29BC5C5647DFC0B1257A5BE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  mitm_lab/assets/ws_shim.js
- Size 9KB
- SHA256 822edadd7aed44e76eb5d458f7c6888a907adf8bca9e3c3cdc0b1f885af52a5c
- MD5 09cec4f17cd72aca0d9458751aa917e4
- SHA1 af480320a346de18ce52d2be7fc4d5d557454114
- SHA512 043a1eac1d783371d7aa8623a075a61efba26a563d7638e93f8655c17db3de0e08c6f74c2ff811dc9b7f7f41b52dd8dedc68859b8ff6470fe7dfa3a00fd35c8f
- SSDEEP 192:9X0NLqFXWCKHr0jryK7l+m9gQ8UywPFQBujFBh8SC3u76F3vjUPGiYOe0gqmFXvW:x0hqFXWCQryeb9e/si1
- TLSH
  T1BC22EB8E64DB207949A3713C5BAF6705727B9403050ECF21BE8C536A7F6113792A9FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  mitm_lab/browser_policies.py
- Size 9KB
- SHA256 82ac60d670d1fce7e95553f1cb16d105f0746e8122ccc68c64c61e7e55f7b435
- MD5 ab9c8385020984d8838600af878d307d
- SHA1 3f685b6bbb36f12d7d75423edc746a1aa6023008
- SHA512 8690e17a22c318ef4ae097bd5689874c3454bce8c00bbcbe7c03ea9180ba1594f18b57e3cbb7d48908ec56b806680463227500c5e29595c47fe5644dd847f103
- SSDEEP 192:r4U14tSgzxcLk0asuVmgRgSiZvn0GF+3QA:sU2hWDa9QE
- TLSH
  T138128605C5411453D697DA9CAD15C846533EBD336D8028387FEC92180F8E6BE81FEABC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  mitm_lab/browser_setup.py
- Size 6KB
- SHA256 4821016785538f376047946ad01b401d448fefda056ebfdb713c57314009b484
- MD5 821d89c3f156b9ef5d50223514762f63
- SHA1 c787ab76b3879861b958f0ad112b0c211e9253dd
- SHA512 a63111265a7816c350bc0884ea2e6b94a98428cc119994671d7f90fc5ad603da1d0cd1b8aba13c2346439ad5e7e6207c43c338b54d7acf5655bd9d285d3274e5
- SSDEEP 192:IHU6LQnQ3nVSy65FRg00K5Azp2A9BJMqFL9:uU6L/nwC0h5Az8Y
- TLSH
  T11EE19405C8261C67CB93C43CCD41D922633E9EA34E217B3ABBAD51EC1F4D97A92B414D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  mitm_lab/cert_manager.py
- Size 5KB
- SHA256 8114722d3c0bea2aa24d384009fa89bd544122bf75b95e58302ea55403795f9c
- MD5 f363c83e39c5bf16acb20a807d034b54
- SHA1 a6efc11be3b5ae809c1643c3f3620d79e14691c4
- SHA512 1d5a04a6707dd8b9cd2b88a322431f5543e7bda05048324c85ae25d8f963991272f447ca05489c202b86b90b7b946b55bfb4baab04bf64c08cdc7b71fd2f35dc
- SSDEEP 96:shp5vxQPcqqIn7G8uRCXN89UqNEIHvUyz04iJOZEqy2bkS:sX5T547Vyz04DZdaS
- TLSH
  T1A2C19607C51908A29F93A7BD6D33808196379403BD0434BC79DF81E46F5F8ACA162AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32