72e8bda5d26312b48f6c58d7d4277d3b10cd47d7edcd53c939acd8920a6e2ca2

Sharing

Copy URL Twitter E-mail

General

Target
seenapse v3 not mine.zip
Size 69.2MB
Sample241102-bqdhbawkax
SHA256 72e8bda5d26312b48f6c58d7d4277d3b10cd47d7edcd53c939acd8920a6e2ca2
MD5 b8145ff286679e51491c58b539c4e56c
SHA1 244605d6fe2287159d4e24996e54040bf7832840
SHA512 d3d9f3b40871a39a5390c4b7e1b7ea9dfeb8c9b8b87c7f4c32078b4e867fdb64b2936fa9dcfe91daabe666ed14fa60557ea6953e91aac92326a0458afeb4efba
SSDEEP 1572864:Cyx+D24210xGnR158dTQX09SH+QaB8WrppOEgAuDK4fCC7gzzFe4MItCK:CygD2n6gRn8ds09SjaB8m/O0sK0CCMzT
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  seenapse v3 not mine.zip
- Size 69.2MB
- SHA256 72e8bda5d26312b48f6c58d7d4277d3b10cd47d7edcd53c939acd8920a6e2ca2
- MD5 b8145ff286679e51491c58b539c4e56c
- SHA1 244605d6fe2287159d4e24996e54040bf7832840
- SHA512 d3d9f3b40871a39a5390c4b7e1b7ea9dfeb8c9b8b87c7f4c32078b4e867fdb64b2936fa9dcfe91daabe666ed14fa60557ea6953e91aac92326a0458afeb4efba
- SSDEEP 1572864:Cyx+D24210xGnR158dTQX09SH+QaB8WrppOEgAuDK4fCC7gzzFe4MItCK:CygD2n6gRn8ds09SjaB8m/O0sK0CCMzT
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Synapse Bootstrapper.exe
- Size 74.6MB
- SHA256 8a9b4b1135066c43c14f36cb807899548c555a3dda54165c738ccea3e8396859
- MD5 583e41e48e9a4ff3698d940dc56dcfc0
- SHA1 a89ffdbf265eadf15e6f1facc0ac9cc2c5f89924
- SHA512 ec08bf0b6ed00227eb41500351b4a289be2df5204710d8a4260931bbb23a2829a896cfbc03e663a629a85f38148ccc7f7464c126186d7bac78004004e2555c29
- SSDEEP 1572864:dc4UuJm6moETzcWuJlGriAdXBjrxbE3EpGUeNZ0+jgh:dcj42RTzcZlaiKB/xQ3EpGtTjgh
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  config/_prebuilt-coolkid.css
- Size 11KB
- SHA256 4cb55acec93ff3f4e7e1e202993ee4088ad1ddcc3dda56e1b59cce0fdc7103da
- MD5 2a94798c886b1a73e5772d415f27145e
- SHA1 c68d4e79533101bf7ffaa11e810a1f5512eddec1
- SHA512 dbb098ad124ba6a5533497191e5e5070cb59af5c2e8c93bdb4868a82ff25dacf44559fccf6b760302b5c242c7eb1c767e0c51aa8dcd4faf8d3c69f304a0b5dc4
- SSDEEP 192:X9p9xWrIiH3f7RZm/kOQ9wjH2Jag6KfwrPPa9K5sbHW8BAQnZ:DW3tWJqePPa9K5szWqAMZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  config/_prebuilt-elysian-fields.css
- Size 10KB
- SHA256 a3ffb451720a048ee515b9e023e4b6a44ce900ab169190040429c43b727faaf4
- MD5 9991804b713016256bdc60c8bdfe5080
- SHA1 eb76a17c1afec7a2da7fafe31128fb94fb5fb5d2
- SHA512 b8fa04176996278d9365ae387ffa181fa893c869e5bcbd1d187f155e246c705a6379b1c2b29177ba95ba42cb1d00fa858bc685ccb2d105e58cb7aa2dca3d2210
- SSDEEP 192:X9p9xWriiyciQZNd9cRCtUxMw7jPo+1HoBt8H0ig1DPgh7kVhtsbMW8BAQh:DWJWxAb4RYDPgh7kVhts4WqAA
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral4
- Target
  config/_prebuilt-freeman.css
- Size 12KB
- SHA256 d36aa365d72a42bb971189b38331e6a74d0b7358ee0b5fe6213b2fd42d879dee
- MD5 6e42efbe7a8494851fcd96bb8af23de6
- SHA1 0b3311d79be954d3905850f21f224c31f03e5f0b
- SHA512 f9ef6caaf6f6f696d6aa304f75f32543ee7eedbdd54e3fd69fe4ae04b5ac81d87a892eec1dfd57bbcf4eb48a033beb27c93d91c33a5af6a01ef58565f4ec9458
- SSDEEP 192:XC8WrBiHUf7RqaXniI4P9sN6BHS75+b4vqBPaPGZWW8BAQ4KXE/Fa:xWwCPi6qBPaPGMWqAS
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5
- Target
  config/_prebuilt-hollywood-classic.css
- Size 10KB
- SHA256 9975675f891353e2e4613be208a7969ee2e9e06c050ea5b771cfe4bf8733753b
- MD5 b430171e1a766ac58387348b083fb3bf
- SHA1 8136bc4095e02c8a738fc272ead55d15c969b219
- SHA512 a26938f4661814969a3602f86928f88e904968bce984f4006a9756e6a35e700a512a4b9e8d51222c1620ec8041db7efaa9478b3679536482abc9678434099151
- SSDEEP 192:X9p9xWr6iHZa2wnhH5WEBQSrYbHMAHgxZYs9EPDRyRsbVW8BAQQ:DW8numyYEPDRyRsJWqAX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral6
- Target
  config/_prebuilt-hollywood-light.css
- Size 10KB
- SHA256 2cd332184160f34f6730158c7d5a05fe1a8d4654811caed5f67b327b7a755bec
- MD5 735740287b12e8817ec2f1c98f74cd32
- SHA1 a305e44eb720c9e27110278e3c6440607c9f2bff
- SHA512 f1eb16bde702d805b55cc4b49fac4a4f604dabc50c2f3311a9966104149f50b373d4401b6f429a971c676fc0493e7184fe8363204951c4be5e785fd8e004a10f
- SSDEEP 192:X9p9xWrCiHqZNTLIQxnKKBYftGHq18DUntkOPg6Esb8W8BAQO:DWgGogtkOPg6EswWqAZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7
- Target
  config/_prebuilt-hollywood-novo.css
- Size 11KB
- SHA256 9f4f5798dfce981b9b941958e112d64c542a27d13707e27050bab03260daa789
- MD5 a48a2db9b21e2fbacdeb2ec0faad3c80
- SHA1 2bff09fa74c197b95899d2c6fcff2c05d1cb79bc
- SHA512 4f3e74141f4d50cdb4f9d263300e54b3bb85eafe1fef24587ee193fb806a3c23d21a53837d6894e44d0dcff671fe0f4ad027167d54df4059d11be54765b9da55
- SSDEEP 192:X9p9xWrCiHFa2wNbB0XCY+by7wHbHmlecrRv9PDeIJsblW8BAQT:DWPL/IUR9PDeIJspWqAu
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral8
- Target
  config/_prebuilt-hw-fluent.css
- Size 17KB
- SHA256 d31fba1bf73c58c00a854a04ee95f1a08e9f048673ced6c4b2defa1d033efb4b
- MD5 b54c2a31568bc901c1d57b2f1046106b
- SHA1 73957d03839ed78f95d2f05d95ff6504602e644e
- SHA512 39f0d113e51f635f2c3e4899b269083a6612cf0fcf00d452be4d4917e9e609d5ba921b292ba018adffbd5fbb25bdfdb48441498319a77a5f5ea90a06cc1aae80
- SSDEEP 384:DW/sEcAMxPPDdmdRsnA8Rtx/F1FMFMF+FMFzFMFI4nFnZsFMFfFMF8FMFeFhFNFR:DW/sEcAMxPPDdXR//F1FMFMF+FMFzFMb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral9
- Target
  config/_prebuilt-kyoto.css
- Size 10KB
- SHA256 3f2705b0b136e88e3ddd6d5d428fc1cafbb4275186b49cf31310df87bf31c66a
- MD5 b02ab6ade3a62d361069bab49ee3e472
- SHA1 cececcf30e5cf8dd0a9fb8ecd5fa3df11d6467a2
- SHA512 a8a3151fe1b212013915ef100e1ba54c53422b99cb17d33a674b8ae6af9024e53aa9e4fd4c09ed732709c9062204571203cb8a7552aca0d2cb7a3598073b4dc2
- SSDEEP 192:XC8Wr0iHweyk8vt9WinyJCQTHgjxdz4v6h5wP/p6OW8BAQO:xWQtRJ667wP/p6OWqAZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10
- Target
  config/_prebuilt-neon.css
- Size 11KB
- SHA256 e6a73ef0f6df504ae821ed7d69e2b4518eb4a8eab82653bb2bb98326ba6babbb
- MD5 216576d93d434ecab0286c422cc1dc09
- SHA1 a696eb12847a1b0c5143f064b692b03926f88566
- SHA512 2b7fcd3ea76e615fcb2d2630d47e1a2e084fb8b31351fbb1536f5980ca696a183c9255441e8e76e589035b572b3af04a70825186daa26e8d679d8d682cd7592d
- SSDEEP 192:XC8WrYiHErDF7UBi1QP9ox2pHqV5qbkv2hPWYgJW8BAQ2GbbH9:xWCBP6W2hPWYgJWqAp+5
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11
- Target
  config/_prebuilt-seven.css
- Size 19KB
- SHA256 f84bcee97b459b4e2533ac3750daa6999f18a40ef7f63f88875f16ca81e137fd
- MD5 630c9a526f5c29454a20e3dbf1dc7032
- SHA1 8e0e06dad419c2cc1975fc4a2144c296a938f200
- SHA512 3ef40356bcb875bea822690031182ceb0b2211b2d3cebdba70601baddd02ce1bfbccf5c55de1721249a082517b7c89e5b3279418a2ccaaad7a06c78ffb42eddb
- SSDEEP 192:DWfAQs9p9xWdrEe8FiIJlM2ZBkFqssNlEq9UCyXJIob7fS03zJ5pfS4HfkzLfYHK:DWfABWdr8FRM1FHTC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral12
- Target
  config/_prebuilt-unikoi.css
- Size 10KB
- SHA256 153e9a776f2a052b8e758a1d53263de766d64e876e28e24eeedfb4ed360bbb6e
- MD5 59ce30a04808c776b339600c150738e1
- SHA1 a7e36c22cd200a23ac336e7f98ae30566a6763cd
- SHA512 97c823f149c8ac451980fb987c509dae539a643e23550605c9d46b273eb136deff2a4cae083197f6032b89372b38d96f96d1e633f00d81f8e91867ac49fcaec0
- SSDEEP 192:XC8WrpiHSkoSX5LIyZt/8rL8Hltrb9YvARbPtpOyHW8BAQO:xWb5W5aUbPtpOyHWqAZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13
- Target
  config/context.bin
- Size 262B
- SHA256 a67124496b309e5a313c848139283818241197378b94e733931af2d6db80a32e
- MD5 812df6c0aeeec4d4c4231b91ad8e1832
- SHA1 c3081bd7b6bfb5bedf47d88d8e24182d0fc3fd48
- SHA512 a6595c996da81c44c7ff034713b35c41563912929613a377906a87598816c9028a310e4d625fc2b53e8a256492a68802ea40600766deb7e0cf3e60270cbaa4dd
- MD5 SHA1 SHA512
Score

3^/10
behavioral14
- Target
  config/devmode.json
- Size 10B
- SHA256 9175b89688753d7371f5ad803366cc394dbda9d202494fba0216c6326fa67004
- MD5 7bad0faf7ef67b6d4a2a685c8ee7ad14
- SHA1 220d29f9ad53d34f86bbde6e905e91ddb1bc16f1
- SHA512 3079eef87457b03a38f62e508f9f62ce5345e44de1319dd401554f21c3f6de89a1f92b2b74abebd6b1b021fcad697e681f817cda4faae67896655aff9c2d8a46
- MD5 SHA1 SHA512
Score

3^/10
behavioral15
- Target
  config/editor/bookmarks.json
- Size 152B
- SHA256 a7d4cecd7bab8fa8886749a167bce4dc27263b57440a0e6c85474cb505491197
- MD5 109facc9ed36a03a7261e12d8049f90e
- SHA1 1ef4cd43908f1657f0093176abab763e490da0e7
- SHA512 8251907115050d1127e7d61c5ded7211b98c35d401fa87236c4927a8442f4d8ec07483bcf1a65d8f361c4152b5b4a5b9a8e1883fccb3ae9cc71501b2a9613677
- MD5 SHA1 SHA512
Score

3^/10
behavioral16
- Target
  config/editor/languageserver.json
- Size 40B
- SHA256 c85972dc75e2aa59899fb9f14b2398f29d6cccc08527bc4144da37f9562a6960
- MD5 b900386caa7303c9c88bd603247b9dcc
- SHA1 ab62959124f4d610da38d6488c3588ae2281b708
- SHA512 4e7ef795b07cda895132763ac65cc16e121465a757845bfd4f865c876bfbcf870e01562a115977ac59dbeae520c0eabe1ad13e8047add72b03527adbffcb3893
- MD5 SHA1 SHA512
Score

3^/10
behavioral17
- Target
  config/editor/sidebar.json
- Size 66B
- SHA256 9bc5ac7ea6a2b27d218e4bef241aeb7dd42ee2c7e06cc59ef182e5db2951a990
- MD5 14c542ec46746d94b018c25e1b2b3bc5
- SHA1 b159a70741ab536b21ce520086a271c878418cd1
- SHA512 839a33c2e7b41d09a5c5203c2e30a4171339b5e926beb735a8c43e525382f3512052e2aa45299cff718aaac96d3ccce915fee2c88ac090e89aacb8f244e326f6
- MD5 SHA1 SHA512
Score

3^/10
behavioral18
- Target
  config/language.json
- Size 47B
- SHA256 c5a1e1f0e8ea128443c3a1f5f2ea4439dc81302981e0c4a0440ae9c42de2a30a
- MD5 d4dd8b9d8ad09975690293d340bf9ff5
- SHA1 bad54994c533a1a7ff00bc0448e2d758f840ad12
- SHA512 869f9c136f7ae682bdc2da194d3421add98d0e0b1f9cbf254c10ac77af34ca8c8f72e0eca6de9f2d8828f40545a2940cffa259e5a191b10ea90fc980db7072a1
- MD5 SHA1 SHA512
Score

3^/10
behavioral19
- Target
  config/meta.bin
- Size 550B
- SHA256 a05f6df635872f5ff0f54553ed6e2c1edeb41b188b6ae70315f4e807d3583035
- MD5 1ffb69e29b41f5f93d7803d4e994045b
- SHA1 64e76b634d29793e5a14daae2a67b22d0a5dad1e
- SHA512 b2ff28444509e3dd69f1fd769a089bfab66f7d73421478dd16f547355e11c5dfde71c2299ee8d92d0bb3a80563c13ab56dcd84209a79d4d0cdd90a3cc698176a
- MD5 SHA1 SHA512
Score

3^/10
behavioral20
- Target
  config/plugins.json
- Size 90B
- SHA256 3385682145bf875a3f17aea91c15ad111024339429478cdcee66e922c858d443
- MD5 71aa9eaebbae9a5a380b462c9562b64b
- SHA1 4c8c1b71d906e445ef47ec81413d0d8920a893f4
- SHA512 b3ae7d0a4eb4297619f948e6221b69411a05de624e325c0416605e69e224ad2237151a5548474aee2269433fb6d45c78da35fc2229b9a223687bba1cb8b81a25
- MD5 SHA1 SHA512
Score

3^/10
behavioral21
- Target
  config/settings.json
- Size 2KB
- SHA256 86fa3966e906c35d6a44a909a64425b97fabb78359ccc6973234eefdd3d77569
- MD5 f0136dfe15c01c58eeacd98c0a2b34d3
- SHA1 89f6928e0d2362257c73b8ad1f6690bbff8b5748
- SHA512 33e2570ffecd2d065ad7d636d980bef112cc7b4b645dbedd17572ed4517910f18eeb5531ba1697043320f48a44a883a5a3f950bed6237a02250571bb62970f2b
- MD5 SHA1 SHA512
Score

3^/10
behavioral22
- Target
  config/synui.ini
- Size 1KB
- SHA256 6c2169858d6a8bca97fe790d2f0aa4dad71a38bdf9e20337f050b52605d92a12
- MD5 ef5036f759159afb4c8561b4d4aef6d1
- SHA1 f89eeabd0d0d1a4b968b015519c1aa07c4d92fa7
- SHA512 6d8d779a2073930955de5a663ba6f3d9db168940291975d6daccab74699e6a6f39cbeb0bc42daaf7e9a85dbd16870030ac07e131c29556206a1cbd2cecbb01cd
- MD5 SHA1 SHA512
Score

3^/10
behavioral23
- Target
  config/theme.json
- Size 249B
- SHA256 9a19a1d9867a82a6c428ca58add4e5275455ed84399f1d68dce745b2dfbe5583
- MD5 b45fc0e377d32192c6655165150217af
- SHA1 fcb61677992f4f1f264a4fba25b0d929e1b9c720
- SHA512 bff12b8f39d575748b976100f377b8898414cc1f823fcb433f65199b6d930fe80187bf727d5fb87907437ea43dda18ff1f5a920ad9c42ec7205fffb3f99d1c09
- MD5 SHA1 SHA512
Score

3^/10
behavioral24
- Target
  config/windows.json
- Size 525B
- SHA256 85c6fdbcb1de7e53975fc0896bb9293923803113344fcc6d56158d1c6ad7b6ff
- MD5 1cee745b30dde83b1cf2785cf382e8aa
- SHA1 50d53dd2619b86e72fff1e263927a6d2b089b2d4
- SHA512 d2ca8c8ff78fd2d0f67bd1a5db81bec789463554e8f343e9306dc787a2d358ba1c975aa9be34410eb4fd7d1aedeffedb0429ccc712622a02879d34c88ed437f3
- MD5 SHA1 SHA512
Score

3^/10
behavioral25
- Target
  flags.json
- Size 420B
- SHA256 c0f7feed039140a9d3f063914c767d7c62c7e714c4af682451ef24418e3f6f47
- MD5 80b91487d5308e55b0b6eba50ece3859
- SHA1 fe962271d47638db441d40ceb3b25812cadde344
- SHA512 640f17af9a869ed9a0cf10d75243a55850dabfc6a71c4ecd652e2f38c3a92fa4ddf4f74b1c28c0238278eb484e1cea401beaa480c87e60108180f4ebf389d494
- MD5 SHA1 SHA512
Score

3^/10
behavioral26

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26