57eed34bd2d5de4d4efedd1bf4487ca21987775130c0aefba1fc9cba04c8f780

Sharing

Copy URL Twitter E-mail

General

Target
57eed34bd2d5de4d4efedd1bf4487ca21987775130c0aefba1fc9cba04c8f780.bin.zip
Size 1.3MB
Sample260930-m9b95ssdlf
SHA256 57eed34bd2d5de4d4efedd1bf4487ca21987775130c0aefba1fc9cba04c8f780
MD5 12cbeb22e2e30f0f68a28fc774911694
SHA1 21f0b7dc1e411983f6f448dcee146f93f03c7908
SHA512 0cb220a731b387beaf62d966eed7104c958041c9222cdcc75de5c84bf858f4a5948a37812316c2410fff5a10818683829ade44d1b189244c8c4380960125c7f1
SSDEEP 24576:PHFClq7jEajcoUdNbGLSGQJtdGX0LqXM0yg79PHwGiSO5sHPVz+DnS:klqXEzNaLZ4tYXw+hHiS8SzQnS
TLSH
T1655533CFED0CD9823AB7936F07DD7FA18DA8A634088637877914229257E6051B349CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  [email protected]
- Size 1.3MB
- SHA256 9d45ae1d8d3749efbe72b24bc20142e8c55b88a0733a45e5fe8579cf24981f33
- MD5 e979fb2eb504972ed87ad3c825ec6c2c
- SHA1 7a927cfa6d413f66da1ae05f668ce85b3547aaf2
- SHA512 df1b55bff5fdee03cd77d59befe5ccfef555100605f7e9782e0a90e21ad6f67c92bdf925e2844d042c9da48e1c05eb4970460683aebbec2bf5a3f9cf6341bee6
- SSDEEP 24576:oFClUXZEi1emUdr7GL6UDG5t1IXQNqXMgmm793HUwiSoD4HN5zg5nv:RlUpENr6LfotWX6+h9iSK8zKnv
- TLSH
  T12D55338FBD48DC93F653533A17EABFB2CAB8E530095227833B1411A666A6041F709CF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 12KB
- SHA256 2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4
- MD5 57db62366ef11fdc47922a02031f0492
- SHA1 6d30db5285b653025f94e74b9b045870dc0aeb7a
- SHA512 d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5
- SSDEEP 192:gzixixDOHhG9db9rd+oSVPECMlh3I8tqDynq7hwbbHF1QuCb:gOx0DOHqrdwTY6+nq72bbMum
- TLSH
  T105422A622384DCF3E789423AB45237136B96962679516ED1C7330FC66A2304D7EF6353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/KillSelf.dll
- Size 5KB
- SHA256 c25cbc60ff1ccca811239655636717c9ff4decb9190a557489389504b248d037
- MD5 8b49e96b0bd0fe3822bd4f516ad543ab
- SHA1 3d04d3a4377e2e1888cc2be333b129daa8d2894d
- SHA512 46826285f213137cedefe379ece413730a36dcde016e5ac114743cb011e587fde503df1d70ea0e6c4213993749ac4d246e4c3c980b02e01239b392d0f5892e26
- SSDEEP 48:qAQ89r6cqqL+U7fUQ3sd953WUPgC7TllKEpz4W7ShtC:BrNqqL+U7fZ3i5+C7Lz4W7Oc
- TLSH
  T1D8B1817BF79008B6C4854B381F1964325BAF783243D86001DD831EEA1DE8DE9E1366C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  $PLUGINSDIR/MachineKey.dll
- Size 52KB
- SHA256 dd2f2d8c0a7d767be40b0f83ac6339ec86068e4ba0f4cd0e3e5b99050dd84fcf
- MD5 819265cb9b45d837914f428373b06318
- SHA1 0725f84eba20acdbd702b688ea61dee84e370b0c
- SHA512 ae4dd3f773568072e86e694c72a08d06b9206cb704a22ced1a922bc04a61a504aee67fc32ffb4d39f9e75f74c533d409756d4d953eaf9ab89cc9fe11f702b30c
- SSDEEP 384:CagOX/gmuxWO+g1riti1O1LuSrmt+yAG69KNx+JbRe3Mqq3TpXRKpHzTIhuuDyGk:C2vgz8OlMit+fZAx+13Dpan+p5aBLa
- TLSH
  T16A33F71839438473F0454939D3C596C15FFE6C0336E7B06FEFA6068D5AE129C61BAAB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/Mutex.dll
- Size 3KB
- SHA256 d02a2c0c9917a5ff728400357aa231473cd20da01b538a0e19bc0c0b885ea212
- MD5 6899249ce2f6ede73e6fcc40fb31338a
- SHA1 385e408274c8d250ccafed3fe7b329b2f3a0df13
- SHA512 0db15d8050a3d39a14ebe6b58ebd68f0241d3ee688988e1e2217e2c43a834dff0959ba050d7e458ab6dfb466c91a3109ead350fe58fb3daa0753f6ca1ed9d60d
- TLSH
  T1895122B393E049E5E0054739038B5EABAB57623033A645CB4553D491B9102E7ED39B07
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/pin.vbs
- Size 287B
- SHA256 22804ed36ad186b3ab18605719c83e70b6244f60aba00e16ca8f97d80b5cc0e4
- MD5 3f764ed6ee61afced5405a2e3f62738b
- SHA1 ce56c02f451bdbf20a1003df87fc2692ca06d0ed
- SHA512 6ed1d6327b67b3c863f71ede1d8be2f24c51454aab25b104d474024bfafcd732ba84a63ea60b218ce0e97a740c2717f87f4a38fcf211e780d027d36f4bc1d859
- TLSH
  T1D0D02B490402C7465BF3828100E1EE3967A04700F537844D090ACC0015C69C80B36890
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  $_7_.exe
- Size 9.0MB
- SHA256 d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9
- MD5 04b88c7067b53a9bdf844cd1cb4b9c30
- SHA1 7d081a1053cd9ef3d593f5ef9a27303824b779f5
- SHA512 566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42
- SSDEEP 98304:/Otj27sBeLQztuYrwCiHyvD04zARp4hm5dQrm1:/OFwCVi
- TLSH
  T17C96619165E89191D1230638FE4DD8AD21C8FCCA5F4156EF71823B5B7E3B7C03A89A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  MFC71.dll
- Size 1.0MB
- SHA256 4da5efdc46d126b45daeee8bc69c0ba2aa243589046b7dfd12a7e21b9bee6a32
- MD5 f35a584e947a5b401feb0fe01db4a0d7
- SHA1 664dc99e78261a43d876311931694b6ef87cc8b9
- SHA512 b1ced222c3b7e63e22d093c8aa3467f5ea20312fe76a112baed7c63d238bbe8dee94dfe8f42474f7b1de7aa7acb8ba8e2b36fdd0a3cda83ee85ac9a34f859fa4
- SSDEEP 24576:Tnc0xa+xDaWhzSenZncQfT0ExftQqDEu:Tn7VxWWhzSenZncQLVxft5DEu
- TLSH
  T127358D1272F1C132C6A315385E2EB77DB2EFEB7098319A0772441F4D6E76A4A871A317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  MFC71ENU.DLL
- Size 56KB
- SHA256 177b0bac987e7882449bd7c5900406f61a997f97ea1797614c8d86f40f03648b
- MD5 baf751e7061ff626aa60f56d1d5d1fdc
- SHA1 b0382c3ac0c0dad7d793c9a3335316b5fcae2690
- SHA512 f7333b481f1498b5eab2688856a5b86fec96b6bf7b781564dfcc018882ded4d7ee5a1fc0c2498607195a66d42a74034f9649a8b61fa548d3d6029f25c5a9648d
- SSDEEP 384:IxLbS+nSkl7c/tAGqyVaKOvtWQWJnBrx1+hV9RLNq/HRK/+nnWT59Dl:IZS+TeAGDjOvCnp4V9RLNqfRKGnWHB
- TLSH
  T1B6436152A3F88604F1F73B385EB68A600E3ABCA1F939C71E1650754E6D71B50AD61B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Uninstall.exe
- Size 75KB
- SHA256 8536a124573aee7b65d87e6d7d7bbc480a3084bef0ea75c1e82816a64817a451
- MD5 373ab9f3666e444d538dab8e35d56730
- SHA1 e5498ad390b38983a887e850e48c6235b4be3249
- SHA512 f18112b60ac9ad4b563fec2b895e82be08d776d99a613855c646e1160923c16ca377cc66f7190ce603b2e32b21832d5eb0335daa4f6057ee47cb79110db9bc07
- SSDEEP 1536:CUeHiWRgkkjH8nyWmJF6WvwKOhfb87gd0keenh09d1hM/TYzftq:Cd/vyWmJF7wKOxYenyVxzw
- TLSH
  T16273E118B6C188BBD84706711EA7D77AE3FAE3060751038B5B640F6FB96618BD50B387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 12KB
- SHA256 2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4
- MD5 57db62366ef11fdc47922a02031f0492
- SHA1 6d30db5285b653025f94e74b9b045870dc0aeb7a
- SHA512 d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5
- SSDEEP 192:gzixixDOHhG9db9rd+oSVPECMlh3I8tqDynq7hwbbHF1QuCb:gOx0DOHqrdwTY6+nq72bbMum
- TLSH
  T105422A622384DCF3E789423AB45237136B96962679516ED1C7330FC66A2304D7EF6353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 32KB
- SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
- MD5 83142eac84475f4ca889c73f10d9c179
- SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
- SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
- SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
- TLSH
  T126E26B21789406F3E69D553275D56F27562F6A5116F18883CF3399EA2C322F8B83B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/MachineKey.dll
- Size 52KB
- SHA256 dd2f2d8c0a7d767be40b0f83ac6339ec86068e4ba0f4cd0e3e5b99050dd84fcf
- MD5 819265cb9b45d837914f428373b06318
- SHA1 0725f84eba20acdbd702b688ea61dee84e370b0c
- SHA512 ae4dd3f773568072e86e694c72a08d06b9206cb704a22ced1a922bc04a61a504aee67fc32ffb4d39f9e75f74c533d409756d4d953eaf9ab89cc9fe11f702b30c
- SSDEEP 384:CagOX/gmuxWO+g1riti1O1LuSrmt+yAG69KNx+JbRe3Mqq3TpXRKpHzTIhuuDyGk:C2vgz8OlMit+fZAx+13Dpan+p5aBLa
- TLSH
  T16A33F71839438473F0454939D3C596C15FFE6C0336E7B06FEFA6068D5AE129C61BAAB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  msvcp71.dll
- Size 488KB
- SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
- MD5 561fa2abb31dfa8fab762145f81667c2
- SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
- SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
- SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
- TLSH
  T17BB4D71377434AF2E086B3F576C6032297F6FC654A25B31392DFE4642F9A38951B3A90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- TLSH
  T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30