General

  • Target

    malware 1.zip

  • Size

    2.8MB

  • Sample

    250604-rn4vgsy1cw

  • MD5

    bf4f8ee2e56c79cf4ff988294f95be78

  • SHA1

    ea99bfc2f6fa8ea75cd28974c1ad8973cb515c6b

  • SHA256

    0f8479e74eba02574be8a12e91eba991e4a792600d7c9fdde7a62707431d52b0

  • SHA512

    35d67d0974db9a5774b8dc78cba8e7fc48e5802af10ea58c3b6dc81e8abbc978aeef57d4d7abfef3a8328e1a348be4863f5d5b5bc3f29056c854432a6bf387d7

  • SSDEEP

    49152:YF6Mmqogo3Sfb3KfGpQsijDD+nRsDgAFL0kJzJbkGbJlh//+pjcxzMaPw8U0Gfpa:YcpqMSDGsiXEyXJzJbkGHh//+RctPw8p

Malware Config

Targets

    • Target

      malware/AudioCapture.dll

    • Size

      76KB

    • MD5

      2a82792f7b45d537edfe58eb758c1197

    • SHA1

      a039182d4d1ef29c6d8c238f20f7b8218c28f90c

    • SHA256

      05aa13a6c1d18f691e552f04a996960917202a322d0dacfd330e553ad56978ed

    • SHA512

      c6c6799b386e0d6489d9346f1d403b03b9425572e7418a93a72c413a4b9413945aaf4ea97a7d7b65772e5e3f00cff65f180f6fef51a26d4fdc2ff063816b5386

    • SSDEEP

      1536:96Y+zbZm8/v/k957pyPkLDfORFMTlrSWqNj5CdnTrioQ+ywlj5CdnTXZQ+8iA:96Y+HQ8/3k9RppYFclrLqNj5CdnTrIwp

    Score
    3/10
    • Target

      malware/HTCTL32.DLL

    • Size

      306KB

    • MD5

      3eed18b47412d3f91a394ae880b56ed2

    • SHA1

      1b521a3ed4a577a33cce78eee627ae02445694ab

    • SHA256

      13a17f2ad9288aac8941d895251604beb9524fa3c65c781197841ee15480a13f

    • SHA512

      835f35af4fd241caa8b6a639626b8762db8525ccceb43afe8fffc24dffad76ca10852a5a8e9fc114bfbf7d1dc1950130a67037fc09b63a74374517a1f5448990

    • SSDEEP

      6144:Jd0nVF1ZtRq6itu9i3uxUnNPhMKj8TwFIKhJ08fvF0dGhZUbol:JYZrokUnNPhMY8TwFIcJB0i

    Score
    3/10
    • Target

      malware/KBDTAM99.DLL

    • Size

      7KB

    • MD5

      ccc736781cf4a49f42cd07c703b3a18b

    • SHA1

      6ad817d7e8b7e9dc978763305a4cd4f1ab9abb66

    • SHA256

      000c4b5b50966634df58078511794f83690d693fccf2aca5c970c20981b29556

    • SHA512

      39245c4ba554a5a178310af2b8578401360bf60efda427332249eca02d6d65e4b419270ba648e4ad36aacca810133f8e4404372dee98a3648c1e4a9b85dedccb

    • SSDEEP

      96:Ze+NFyw5fGU1irzSJ39uEMpi4nKW8cWwBvv:ZrNgUiyJ393W8cWq

    Score
    1/10
    • Target

      malware/NSM.LIC

    • Size

      262B

    • MD5

      b9956282a0fed076ed083892e498ac69

    • SHA1

      d14a665438385203283030a189ff6c5e7c4bf518

    • SHA256

      fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc

    • SHA512

      7daa09113c0e8a36c91cc6d657c65851a20dff6b60ac3d2f40c5737c12c1613c553955f84d131ba2139959973fef9fc616ca5e968cb16c25acf2d4739eed87eb

    Score
    3/10
    • Target

      malware/NSM.ini

    • Size

      5KB

    • MD5

      99f493dce7fab330dc47f0cab8fe6172

    • SHA1

      16906fb5988303bb462b65ff4ece23539a12f4b5

    • SHA256

      e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d

    • SHA512

      2c58171c30aec8ae131a7c32162856fce551b55f861d0d9fb0e27a91bd7084388df5860392f80cdbc6df6e64e97d8bf2cae587c3d6b7c142ce711ae8e240bb01

    • SSDEEP

      96:L1DgNnkStXsfpsNXl0o1n49+jJeQScwzTHXllBXl3SXlcwah0SgAh0su9h0kEhhd:h4nt9kgamEvfUsrywp7

    Score
    3/10
    • Target

      malware/PCICHEK.DLL

    • Size

      27KB

    • MD5

      e311935a26ee920d5b7176cfa469253c

    • SHA1

      eda6c815a02c4c91c9aacd819dc06e32ececf8f0

    • SHA256

      0038ab626624fa2df9f65dd5e310b1206a9cd4d8ab7e65fb091cc25f13ebd34e

    • SHA512

      48164e8841cfc91f4cbf4d3291d4f359518d081d9079a7995378f970e4085b534f4bafc15b83f4824cc79b5a1e54457b879963589b1acbcfe727a03eb3dffd1c

    • SSDEEP

      768:X52mBHj1XCdnJ8EriRGp9E+l/kaTj1XCdnJ8EZp9E+8iROA:JPBHj5CdnTrioQ+l/kaTj5CdnTZQ+8iX

    Score
    3/10
    • Target

      malware/PCICL32.DLL

    • Size

      3.3MB

    • MD5

      1274cca13cc5e37ca94d35e5b0673e89

    • SHA1

      a8754c94f88273c304bc45a5afd61a383bb52117

    • SHA256

      cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd

    • SHA512

      52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c

    • SSDEEP

      49152:MTKIG4K8I37tlHf2ikvy7V/lE8gHT4RaCg6cOWSbWc/id:MTKIG4D+tlHfnR/lE8tHgkWSP/i

    Score
    3/10
    • Target

      malware/TsUsbRedirectionGroupPolicyExtension.dll

    • Size

      13KB

    • MD5

      d89cda3ff8427da82de6cce39008c5bc

    • SHA1

      33889517517b8953707796d12d6907b039c715d1

    • SHA256

      f44cc1e23d0d192dcfd84069b27704cd0b2a8e7720eee43656f57cb474433762

    • SHA512

      4a73be7228960719236f39abc6dba7741498d3a3539f7bcc31b6d28a2574e41e4f85e6c2e0fbcffe9ba3b6a646fa3fa078adc0a53c46a4676b871fb92e11fe4f

    • SSDEEP

      192:wWMcTgQEri3hPkpzRK7KVM6cqm+saSLysnlsam4oIWa+W8:wWpTgTu3ypzRo61mVag9Jm4oIWa+W

    Score
    6/10
    • Target

      malware/WiaExtensionHost64.dll

    • Size

      11KB

    • MD5

      5d084613c0e5c8c3022d9e0f316b0e23

    • SHA1

      784dd38d9e553eb4b8955320fb596ae4e6854f23

    • SHA256

      07bc4dc48d5d9bcc2ce52ca8a0f925ca021092dc34cb811e183cbc0d32e576ba

    • SHA512

      263d3de392b5a4e40e9fbd791062b2731f27410e977dbdacb61810d1a1c2cf24658d8abf5d09a99a18ff7a87c122d9b6744d40723c1637621c5feb327fad752a

    • SSDEEP

      192:A21YiMppUPSz/pO6IsVTHzdZpCIdglelWWaCtW:AviMppB/w6NTTbXlWWaCtW

    Score
    1/10
    • Target

      malware/client32.exe

    • Size

      117KB

    • MD5

      1c19c2e97c5e6b30de69ee684e6e5589

    • SHA1

      5734ef7f9e4dba0639c98881e00f03eea35a62ee

    • SHA256

      312a0e4db34a40cb95ba1fac8bf87deb45d0c5f048d38ac65eb060273b07df67

    • SHA512

      ab7240b81be04f1bced47701a5791bbeedcba6037ee936327478c304aa1ce5ae75856ca7f568f909f847e27db2a6b9c08db7cc1057a18fab14a39a5854f15cba

    • SSDEEP

      768:mfVZl6FhWr80/Lqar2pe/KLKFKcMkuNr2pe/PNKFKcMkM:m70hGTqaee/CIr4ee/VIrI

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Netsupport family

    • Target

      malware/client32.ini

    • Size

      1KB

    • MD5

      fce60232070183d3f7510e2a5513d993

    • SHA1

      0aa8cbd6371aefcf1f8577e8e0a276330731a779

    • SHA256

      747618b8c54626ca710c1321e8c6419308a5248bc94ec7105dbcb2fdf843325e

    • SHA512

      41e9e6d7d28935065109cab5a1785beb94441552bae24f9e6b120ae4c2f4f69f16f65cd01fa7bd77e50e94f1bf3b944e8cb31771827f32d356be6d6c3d69722e

    Score
    3/10
    • Target

      malware/comcat.dll

    • Size

      10KB

    • MD5

      835ff05a3f5e16e0fe41e515ea398bd4

    • SHA1

      e025cb17bbb01a1b5715ebbc745272a8611dae6c

    • SHA256

      8dcfb1e6aa965df4bd4c0551d03bdfd6472c80219ada4671910958688fbb4ab6

    • SHA512

      e6a7002316b05759c433b3e0516843a14199ee4b23315d799b533a52f9932f4715fc8aa5fae96892901ac67f0dae6d239eb37fc722558cb7c9dd906564719cd1

    • SSDEEP

      96:j6cuh8B0DNcU2QD6SNkdSWn+smK/4W70ADlqNXEWPT0lF+WwUL:jLuTkDSNkQ+h4WoADlBW7a+W

    Score
    1/10
    • Target

      malware/getuname.dll

    • Size

      11KB

    • MD5

      91c68038bfc064ea8fb6d432acd38ee0

    • SHA1

      4df7e33b6e325f31231eaaab366e2e710955babb

    • SHA256

      68de057c4175d4c94afa2acb2abc1a9ccac04a3ceb8e84c33f7f414bb8b0eeb6

    • SHA512

      002aef67593058c88b980a4107f1ca4ddfec5268456f76d1d358179e00ea2a0cd64c93fb31a7e78055885cfd508c90a7b19c6c6fa7a5a3c3ffa305677a0955d2

    • SSDEEP

      192:f3emo46V4w9263FeVpszrEc3YDtmWIdW:Vocw99e8YRmWIdW

    Score
    1/10
    • Target

      malware/ifsutilx.dll

    • Size

      16KB

    • MD5

      27a7213091cda31e84967bead4d29bd1

    • SHA1

      e705e0fd25167c8cdaf984f067e3bdf4be8558d3

    • SHA256

      42214053995b6188b2e20935ca8c92af77639f0d5541a132920a5cba2cfcbde6

    • SHA512

      a16ee540cad2661f3d31071aed3b2f30ea5c0f068f51a350ef693fb83df30ce97ea4701714091ed0ef4a0806d908d93691beb0d8060b5ec73f62422477c8f3ce

    • SSDEEP

      192:peIxDV4pntj/Hi3SbYMS9HERLChPjuARtNlvJy7VfYN7EcX2D1WsZW:peIxp4pntja35JExChjhtWYNZ2xWsZW

    Score
    1/10
    • Target

      malware/initial_preferences

    • Size

      693KB

    • MD5

      2973639794b095b240a5c4af2c23fcbf

    • SHA1

      5413cf9213db3f09344ddec363d4c431ee05dc67

    • SHA256

      48869dffdd9e50569289daab5365fd4aedb8e64577dc71b9e95465e22d828e5a

    • SHA512

      e3bf0cb51a949eb558cf444a90b37bf7bd60a23ad360dc8cc40690000d10415a307410f93b900289ef618208d093ee0a1e34c546ce6147529b4a157cdd9bd1c8

    • SSDEEP

      12288:xOhdbgnPYW0lquxG4in2hm1vmHJAD89utQ0R76ZTWXha2ydbHGeXW74tFi:xCJW07xG4o2I1+HJ1wQo76ZMXoTXW0tM

    Score
    1/10
    • Target

      malware/libEGL.dll

    • Size

      493KB

    • MD5

      4291d4ba9edbcf567fb9f2397c168431

    • SHA1

      9903889a223dd4083ad011060d3b9fcefa34953f

    • SHA256

      fd626c18e2c6ae437d288dfb5a9f4039bd5a3a68d01183a18cc25fb37ca48cd7

    • SHA512

      fab2151159973e6ce6ef8759548a44be8d09ca7577c451391c26d7d384f2efebfc0554b14e9fafa53428adf8f61deb27b32d001a58b2d94b1e1af20023caf26d

    • SSDEEP

      12288:i4ufaxKM0UUQLjS2K0oa2fVE1M8mCL55ZHb3:/xKM0UUPooFa5ZHT

    Score
    1/10
    • Target

      malware/libssp-0.dll

    • Size

      15KB

    • MD5

      d37b46aaa0276d199d13ddbc06b53fb6

    • SHA1

      5b37e302e826488bca5f29a1fe6c9d3e3037979e

    • SHA256

      e1b206a63410bdb6d91a7a61941e7329b3309d93d43b4a1d35df890713c0a1f1

    • SHA512

      819a5cd39f61f2de2203029fc2788612a2355b85c7f9f499a9e72cb4ef5c182610d72e8a0a592eac9e006853e5fd993ea471d5d1f2be5af9ea5367e3e2d8f7b0

    • SSDEEP

      192:sYRdUKvxkxqf6JAHTRhrrgDdVnwqKfIPf+91wjQtOqH7UaG8xBtq:lRdfEOpzRhr0frckf+PhtOqbBxBtq

    Score
    1/10
    • Target

      malware/libwinpthread-1.dll

    • Size

      54KB

    • MD5

      ec5d913ae28217edee26445e1c151aa5

    • SHA1

      db042629b0d6dfe7281fcd773c51e7e9d2304a60

    • SHA256

      1328d7628ec5aeeb2ed7489cc1a3b11a242018d30e073e530356f0c1756505ca

    • SHA512

      7b9b234da3061431488e3ac24c5e2a9842e00c8c57fc19ff34a32c32cac32707a7c40f4ad2b1b835b23e43a2c74ccd78b127af737126f33ca3d961d3e31d121c

    • SSDEEP

      768:JH2fEUrzSpNTGxJRo4ajA1/0BiqMw+iescZ7SzORRRMwRHrzPm3YTL3dU:QfFrixgaU1Zp7xvHzPm3YPdU

    Score
    1/10
    • Target

      malware/mprext.dll

    • Size

      13KB

    • MD5

      0eabd6ab464758f058fc039a47f61750

    • SHA1

      51bc562a59e565e3f39a54e4c788896b8803354b

    • SHA256

      f96e8d99b736e4ce7997bb1de65d88c32e16f1f725d8bd98f52c39a02969fd87

    • SHA512

      f5a038615ecbb72072ef2a72d166cabbfd26aa879f28c911a26db71581cb8b93b7554b1cfa1517b063fdc5f942281e7d409e70c998b8273fe9ee6a0fc61a00fb

    • SSDEEP

      192:t2sVilvoSG4X6ryFKdEwFQnuyfc38EcX6mWf3W:t7Vilvo74XAyOFQfc3U6mWf3W

    Score
    1/10
    • Target

      malware/msidle.dll

    • Size

      11KB

    • MD5

      b1c1bb1ef2ac2d739aeaed77c33c1848

    • SHA1

      efa181a1ea01e02cd44614f80259ce794b7a455c

    • SHA256

      cd8d7caebfeb4eb9124ba3e025aff68dde554a8dd6b3365654bf936200c4e563

    • SHA512

      f4e24c508248e6f331aa16ed01c7cdc6cebbc4cd09dfa9f511d02544e2c04eb36c9480ae71d9ddef039a1e9d6e0324179a9ba0f1c323e20c4bbf813a154e2fc0

    • SSDEEP

      192:PtHC6MRyx1TTmcWOznzYuhcGZtEclABY5Wx46QuW:g68yx13maLX1ZhAa5Wx46zW

    Score
    1/10
    • Target

      malware/msidntld.dll

    • Size

      5KB

    • MD5

      504e51418d856d664db23dd55a61352d

    • SHA1

      522c0fb1ed2b9594e7a2aab9481883da57d8ca23

    • SHA256

      f190e142f402de460455ff2d1835294a3e118ba74d76aa092af49372bb9b76f4

    • SHA512

      28bebb26eeb8ba97fb0ac8cc4869576d3cc58cd7c0fdce988f6fe160c7b426c2a3906799ca021a65a26394cba266dfa3d3e58790ec41c7eb7ecd0fbd89d6e0db

    • SSDEEP

      48:Cc9m3IIuHkvrQ5yHqO2JsYa3yBk2lFIZWxHtNukt685WwHg6ab:Rm4ZEvrU/bTaiy2HEWhtDdWw3

    Score
    1/10

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

Score
1/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

persistence
Score
6/10

behavioral15

Score
1/10

behavioral16

netsupportdiscoveryrat
Score
10/10

behavioral17

netsupportdiscoveryrat
Score
10/10

behavioral18

Score
1/10

behavioral19

Score
3/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10