60c974f0749369dd17ffa8ffbc62835c0d5622407bd29f25b54724f71128b0c4

General

Target
60c974f0749369dd17ffa8ffbc62835c0d5622407bd29f25b54724f71128b0c4
Size 2.2MB
Sample261110-wpfaqszy6k
SHA256 60c974f0749369dd17ffa8ffbc62835c0d5622407bd29f25b54724f71128b0c4
MD5 33e4ed879ccea924ccf84e9d64d22653
SHA1 b5f10fb85af3f5177b80ed2f0cf38c38b06808c0
SHA512 52bcff90d1fc3460436398786aad65aa8a4b7d4601286bb8136be0892ef8d36484ed06fb239e0fc90031395cd1fd140653def7807e9b7261ab46ac9b7d97e68b
SSDEEP 49152:clKdKfD4GzRXPeAqmKTMQs1UxI+MorQPADAFa6Iaax0T3O+:3KLDBP7pqdbGArQPA8g6baW3p
TLSH
T1A8B533DD08157A0A499802BE16E1340D0252F92BA9DC17CB37B47BC4E1F7EDE6A17FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  图文安装教程.url
- Size 170B
- SHA256 55659756853fad925764f3d76ebd2bbb3f8206834e72a5381aada4a4db7987d0
- MD5 c4642a38fe27980358006976dfd18cc9
- SHA1 8489933c130842289a8d7632f746ac3b100bce2d
- SHA512 7fb85693745113419b6f4369b696a6ef3dbb48b4b90a640079ae86a18715f2c3c562e9fcad9c9a93cc6c6f58fe00e831b02c6dcaddc6df723fcda96f60cc2814
- TLSH
  T1FFC08CE90202C0C6F300900A6170F90E9D0FB2E40EC3DAEA2A8ADF8D3C9D0D2E848665
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion
- Uses Rundll32 to proxy-execute a payload
  Rundll32 is a signed Windows utility that executes code inside DLLs. It can load specific system libraries to run malicious executables or scripts.
  defense_evasion
behavioral1 behavioral2
- Target
  多多软件站-提供绿色软件和热门单机游戏下载.url
- Size 151B
- SHA256 8ce5067162b095958f82aae58b375228d6f0e987ee643729f6c860c74a2be055
- MD5 45c18450ef1bb6b023956b704797f7b3
- SHA1 41dc152a5cb6e6fd8c8fb6e0203221c8fe0de3bb
- SHA512 e6844e78a5ab4e323b2d8fd2960a1da326d333dc3096fda1c1e030a76f25e22858754623176add769e6a86c54de6cd7d877b5005891dfff689662acf176bca7a
- TLSH
  T140C08CA80101C0C6D300800A20B0F909990F716009C2C2A92A45DF492C8D0C2E048665
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion
- Uses Rundll32 to proxy-execute a payload
  Rundll32 is a signed Windows utility that executes code inside DLLs. It can load specific system libraries to run malicious executables or scripts.
  defense_evasion
behavioral3 behavioral4
- Target
  暗黑破坏神不朽电脑版战网版Battle.net-Setup-CN.exe
- Size 4.7MB
- SHA256 dca359dfa8266695fc8911c5b182146a5e63fb55f2edb66af63845e2e87ee0c1
- MD5 da058003eafb3a83a9597777cebe9d26
- SHA1 62941bfe4ace62fd4e267cc82988e0dea9bab91c
- SHA512 a59cbc1f7f956ee710a8131dfa5cd58f6192f9f139f55712e0a62a3728d82a153f8275942ca78b5cb1cca991920bb432932ee3a4c0b6049032ce0b6fe9bf3558
- SSDEEP 98304:ca4Xp6swNwda6YCeOqtg7Ur1ZqsaS6lucxhPz:pdbOe5OUrLqZlucn
- TLSH
  T1B536BE927A40C0B1E14203746979BB7D49BDFEB01B21C5C35F882A6EC9B35D1AA37793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6