4510ada2208d9b8b0579c9fc6530369bd9f6769416e4f3adae6ecb16984651fa

General

Target
Imageprocessor.zip
Size 16.1MB
Sample261104-3yrtfset3t
SHA256 4510ada2208d9b8b0579c9fc6530369bd9f6769416e4f3adae6ecb16984651fa
MD5 e9f90c99ef89921bb8ffb93d560dddf8
SHA1 6dba987f9af118d6e53292d8c459884bb83e4cf2
SHA512 be53029eb361f86eaa8cfb223ea92acd001bca4e0056df3e8b374f055ceaf8e5f7e4c5502cdeae2f49e81f48a1f98c46335cc3752c06c0ec0dd3a8d3622a1075
SSDEEP 393216:OpUN4TzcBDc6eA+Rs/FxVjh4NVpFd2CXV:+UWTzce69cs/FxVjh4tFd2+V
TLSH
T167073345B638B9D36746BD3BF71DBC3D840D5AEB19E9C9282C921731093909E14ACFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  Imageprocessor/BuildStudio.bat
- Size 1KB
- SHA256 c24889946003338e4eea7d1a04c3799fbe1afa0b2c937a25d77ebd5e4325dccd
- MD5 3ce1a06ceda4f9ff5d1f494a20d2dd09
- SHA1 709300e57a7f4b871a8629d2d3bfc50442a03d1e
- SHA512 a1a0d4dcb37bc7fb497110306ec1a80b568fc301067019c82930693a5c52d33489df1dd922e86dc18d190e6e9e471ea38eefee66b9e62c08bd516a1f834256d5
- TLSH
  T176211F9C521E9960D0BD50D17520625BFA8B80972A138F2C7001F41AEFB0B80C9FAB95
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution
- Executes dropped EXE
behavioral1
- Target
  Imageprocessor/ImageProcessor.dll
- Size 16.1MB
- SHA256 8290cb6ae1da9198fe44aa65440e1b9911c5b6703754207715cba1872c964381
- MD5 5e04f7165d362e21a9883e0d55b956ed
- SHA1 91338e4b2a0b6f030a1fddb1764894f4e2b1ba82
- SHA512 e6c8580f8afc9121fbcfe7672597c944d5b9e047829b39e6b893801238cfcd451aefceb0a90d6ce90dda9fec9733534b7891af41bdf247e539ffd37e52026087
- SSDEEP 393216:jlALaDlsT1qoCCEFMPFhXbrY5Dp5vmC/C:xAGDlsMo1EMPFhXbrYb5vmqC
- TLSH
  T17F073346B77860E7E366BE3AE71B6C2D8609796606E5CB2F289106310E370DD1C7CF85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
behavioral2
- Target
  Imageprocessor/ImageProcessor.exe
- Size 8KB
- SHA256 68464161a4d280c7a292dd872999d9875dba1932d3ede694e724cb0779abb87b
- MD5 529d90e9d0e36855b0a8d5d0c7bb483c
- SHA1 3ecd3b023a2dbfe9bf2c75f7c88159564e8559ba
- SHA512 739fd48d3ece3dcba8174103dfe807272c4d13e085bc5446811f21e28d780c29a5ff81bc484ab864cbf71be071ae9e7b7f45ce8cb5636171ad02e9f758b09c82
- SSDEEP 192:Nv2bfR/49fQ3QhZXd2WeBLt5EU8kwb62OIc:NSg9fisZXdg5EU8Du2OI
- TLSH
  T11502A502A3F8CA1BE8FE577529F3531153B5B29246A3DB8F2D8921DE9F2271485123D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3