7543dacd68239db85ad01f7a1598dc63ac9164e34bf44847a643c96a2393e950

Sharing

Copy URL Twitter E-mail

General

Target
@fatsweatyballs on tele.zip
Size 56.9MB
Sample261113-mx91msax4m
SHA256 7543dacd68239db85ad01f7a1598dc63ac9164e34bf44847a643c96a2393e950
MD5 bb27cb529d93ac273012099da8ebdef7
SHA1 e4a9b09478e2ff75541a2ac3e09f4c2dcc158c9a
SHA512 a531d52b822dddc3da2cf111ca8cb8e66af1a336cf28e06a91ec167a8c34d88b6888012f4125ff8eaa9b58e679eb82c6b418a6c3eab14a4a8b9a8f69ccba692b
SSDEEP 1572864:1AQurQbQjSmHbEFjn8hVcGjObkd8EKWq9PRhiAFAQLP3kHIFBF8gEDk:1SrvvHAeyZibVwRXP3nHq4
TLSH
T1E7D733C145863CA0D86B7A31A5BA3D7BFAE47F2846D7B333385A43B207118F32725596
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  @fatsweatyballs on tele.zip
- Size 56.9MB
- SHA256 7543dacd68239db85ad01f7a1598dc63ac9164e34bf44847a643c96a2393e950
- MD5 bb27cb529d93ac273012099da8ebdef7
- SHA1 e4a9b09478e2ff75541a2ac3e09f4c2dcc158c9a
- SHA512 a531d52b822dddc3da2cf111ca8cb8e66af1a336cf28e06a91ec167a8c34d88b6888012f4125ff8eaa9b58e679eb82c6b418a6c3eab14a4a8b9a8f69ccba692b
- SSDEEP 1572864:1AQurQbQjSmHbEFjn8hVcGjObkd8EKWq9PRhiAFAQLP3kHIFBF8gEDk:1SrvvHAeyZibVwRXP3nHq4
- TLSH
  T1E7D733C145863CA0D86B7A31A5BA3D7BFAE47F2846D7B333385A43B207118F32725596
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Potassium-Portable/README.txt
- Size 2KB
- SHA256 f43654ea305412a594607182d3389240d958b8ef8866bb47e2c5c3bd4b3182a5
- MD5 bb78ac5fd53deeed89d7450c80c48205
- SHA1 f419b4b91acb920c56ea25d3a4723fffe02b3c08
- SHA512 ae70ff3c35ddcbc1d2d94075c38dddf9246376cb4c182489d8481ffde96a12fab76dcdaa6e270cd5428bd3dcc8cf13c9dc44700c04655a14eb6ab120b19854f8
- TLSH
  T15851827B4F8A93B2A4E0C650E14C57E6D30DC4B1220B129631BDD02E6B42ABE67BC1D4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Potassium-Portable/SHA256SUMS.txt
- Size 1KB
- SHA256 f60c4b3da2d694ffe894fc79f3837da760e030a99450ed56ac0bbdf72836ac1e
- MD5 83a96caec6aebbf5c098597098c941b4
- SHA1 2650420d67e808934b249305efaf7810499f1b43
- SHA512 ae0c2a1c4e8eb3ec04e8354c9f59f1424b1c0264632215a8623f1641ea8a45285a67efe26ba9943688e4cc54b0278e1de26cc26113171001ef1dd3f62306fa60
- TLSH
  T15821754ED48CA1069898949BA1192CC296CB43B1001BC4A2413FE5A68AD2C36D73A927
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Potassium-Portable/Start.bat
- Size 7KB
- SHA256 f4da69df1e93b28faeb02007cd089d873bc1b6244ecb343ed20b60a735b833ba
- MD5 cf5bdfae491b0188185ef20da66acd04
- SHA1 2a8d47fc04f07a06231ebaac434f098903864db8
- SHA512 6ec69f1dd5139275fa949c8536baa4a434a38b808db4d58d80960de5a71759adcce81eec33e437734df1f97b0a3bb5efdd5d1ce66ddc46715a94581ba7773be0
- SSDEEP 192:g4fCZYIeaI9gPuzNO4mESiebLTw1y0TzsWfPiyZeOM6:s3tIGPuzwDiiMBTzsWPZep6
- TLSH
  T164F1C5161E88433A82F9CB76918C1296E31DC0AF23157ACD307EE15A3F6919E87FD1D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral7 behavioral8
- Target
  Potassium-Portable/Uninstall.bat
- Size 1KB
- SHA256 56363b12090977fce292580707963b427ecdad8df8e30a034cdbaa9d06cb4882
- MD5 737091735ecbc6943cea7d3441fa04a4
- SHA1 a18b8f11137ea6e6299cf97c80f4a21759269d08
- SHA512 4e1158e6db8adafd1881ce27e6ebfb231420ad3f6eeb92e6bea5805fbe46a222fb1f7bef5b973a0fcf7e3dcd98a518cbe5e574b407294fc5b2607f5b3f36a080
- TLSH
  T13231303A248597B6E2F0DB8295AD4268B64881866A062BC531F79138361219CAFFC0F5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution
- Drops file in Drivers directory
behavioral10 behavioral9
- Target
  Potassium-Portable/app/Potassium.exe
- Size 27.1MB
- SHA256 437eaaf3dcd64b8ca2eb80a8d90a573364b6d12e8d913a632bde88b6cd931960
- MD5 a276fdb529df1f1b09a81d6c9621453f
- SHA1 f1e0f75b7054a1f29eba79b6fd701cbf476d0717
- SHA512 cf57507eaf10593a6392ffec6e355021f72c27282e3d1c62999190ea54c914c739d1495dc34c2ab1c6f18b78e6ff751b8b8ca25f993988368a9769b61ab446fb
- SSDEEP 393216:27qQ/kdQbtx5fqTNsPo6wDwdAdfIKfTVTDwTZ9TCp:27f/kQDoTTx0d8/bKT
- TLSH
  T1B1574A257A5A996CC09BC474838B4A734A7130CB0B35B9FF449492792F7EAF42F38758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral11 behavioral12
- Target
  Potassium-Portable/app/bin/Decompiler.exe
- Size 2.7MB
- SHA256 eb9cdc2394b3a807de2edb19d7dc1b8115227e4bc5686a93cd9f712de5b4952f
- MD5 e476312539e698d78c5b0fa9713f8381
- SHA1 675182e23693b055e82fd0205f0013ea543fbc1f
- SHA512 b3faef488521668c3ceec0f7f8e113cfa9a7cb19529370c37d1d6811d1e3f6185d65f5ac8aca55dfaaf347c1e3d9ce14e235df3a0478c05aced0fe287ee130ec
- SSDEEP 49152:/XbEjh1OsKMKLNWAs7TRcVtHdlxaad5FV2U7x56:2haMQxV1
- TLSH
  T125D519657B5A98BCC59AC43083068A735A3534DB1B75BDFF048982392F6EEF45F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Potassium-Portable/app/bin/Potassium.dll
- Size 9.7MB
- SHA256 f6a741268c398529758f68e8aebd5671bc2646f62fcb293c8a0a273575a042b2
- MD5 c3162b9339b44183865f63beabe82084
- SHA1 040ba52c8ea587b7b5d50883b6668d876b48308d
- SHA512 0758acd97e5b0e23a2dc7cc37fa8d979568b8128895c1eb78a944d2ccb1bbaf8272269d4e8c6898c0a58d88184adc9f3eadf88a59adfedbb9d9c8d2973b5f027
- SSDEEP 49152:vpi9olwtOJUZrHJEWu1JOLSimiVPsWpB9ntU7KpfdjZo4e9iQMtoMLe98KwfemwX:OrHWWl/H23dDaQqP0OKbROpeal
- TLSH
  T158A68E6651F405E8C3BFC079E64A9E13FA71780D4320B6EB8DA54B521BA3BE0677E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Potassium-Portable/app/bin/Potassium.exe
- Size 16.0MB
- SHA256 79b428b2dc2695b47aaa4b5f1fbdb30d609e36d726e4a0a99310aa2f29267559
- MD5 7ae6b8e1cc5f9e0388c1e022e388d2c3
- SHA1 914b4932ead19db65975851660de2978de7ddcb6
- SHA512 7218271eedb9d61b88af0fce014ddf8608053f38363a5d465c5d03d39be144aa32c9e8e8f2fb177317654a648128214c0238b9d292b03b4b63722ebe32909c88
- SSDEEP 393216:S6mRLJTqG/MyT4AgVQpVmfebtlxweJj8:S6mRLJTqsMg4Agc/pwa8
- TLSH
  T18D0723C27EC5A2E8C0E74F1467CA178E60F1B7DA88FA5A1E3AC55C035E70F971D09692
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral17 behavioral18
- Target
  Potassium-Portable/app/msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
- MD5 bc88b387cafa556068b5c5d6ff3ccc8f
- SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
- SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
- SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
- TLSH
  T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Potassium-Portable/app/vcruntime140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH
  T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Potassium-Portable/app/vcruntime140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- TLSH
  T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Potassium-Portable/auth/authsrv.exe
- Size 12.8MB
- SHA256 610080fd70da2f1cca2983676cee2311c100dfc58fede501c66a345be4d1d587
- MD5 33ce68abebfc37e3c403e92d382c44b0
- SHA1 c0e36a3c5f44efb8661a8992a965fc6510c68a78
- SHA512 782e4a9978074db68636aadbca415bd840fa754589826d6db86caecfa67a2288c291bc8a3900a681f93da84b48df3d0fc9188ad69538126feb644a9f05972d6f
- SSDEEP 393216:Id6IDqShsWLo23m4Js9yjPZE34J0YnDZxOKWPktoREX:s4S3Lo23mMd+OnNIzfGX
- TLSH
  T169D633C0E3D159D7E89AD53D85CA989BE2B2791A57A4C2CF136083663F739D11F38B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral25 behavioral26
- Target
  authsrv.pyc
- Size 14KB
- SHA256 306bad59c41495d7dde22aee33c6eed88c07f76c92357618e0974fc69ddb7d71
- MD5 2b12f2eb6b1f9f746cd7d72ab9016540
- SHA1 64b1b562e3e1645075abe0a386163cb0e7a4c7eb
- SHA512 8cf93237d8085861c6809ab7ee74586c688937e47786e6db07d0e8cf5b0f8ceaf00736282b1c1007e9a82d9b6ded828aa113176e0608f1f537539a43231c9873
- SSDEEP 192:Bs8GalBhJVeGoieoHv0QzxQ8KXQPhpBJuCQ1zbHqP5vJJEQ+G89MyNeovkvBWUh:lVhJVQrQFWUpB7Q1HKdUG845B
- TLSH
  T1AF62E7FE594130E7FD18F0BEA4979F14BB728281E508E35BFE9816BD1D962803DA421D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Potassium-Portable/auth/ca.crt
- Size 1KB
- SHA256 4a77e95a9b89b52eb1a21179dfd83653db0f6ddfe98dbd36a0c76b40079fedec
- MD5 b4ab44fe1f4fd0ba6d82ba1c9ca295b0
- SHA1 152bab706452da470b20c1a74f787396f1feede8
- SHA512 0e0ca136cbf767294e0422744129e6ff0a9a1f8d011cae059dc26a2b5f343ef446793d3bd5e008f8d6d59b421428d80d6693eec2683bdcccfad6b4cf5525af9d
- TLSH
  T17D2184D14F243C6D0857C0D2E6FD224E8B76863ED5B9A2D500123D02D356C5A99FC6B8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral29 behavioral30
- Target
  Potassium-Portable/backup/Potassium.exe.orig
- Size 27.1MB
- SHA256 78f75e896b4b5ad719bc3c79182c5d5ba2dff071dce91cc160dcdf1308b5f6ea
- MD5 87cfd6ab9e26a5d11a9985734555f476
- SHA1 ef75e6d76ca15cccb40f7a70f528aeebd23cfd1a
- SHA512 fb904ffdb2e62121a6fda7e0407a9406e6b223bfffb1519de61237a0e184ff7c349e37de0fe6928189ffb5452a66712acec5b00ec8bd797a8fb70533edcc9b82
- SSDEEP 393216:27hQ/kdQbtx5fqTNsko6wDwdAdfIKfTj5TZ9TCp:27a/kQDoTkx0d8/bj5T
- TLSH
  T1B9574A257A5A996CC09BC474838B4A734A7130CB0B35B9FF449492792F7EAF42F38758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Network Share Discovery

Obfuscated Files or Information: Command Obfuscation

Discovers running processes

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Network Share Discovery

Discovers running processes

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

Badlisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Network Share Discovery

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32