747d93f4ec45203a68cfc064dbed6b406ecc19a93f54c9b7a54b122385f076c8

Sharing

Copy URL Twitter E-mail

General

Target
23180457508.zip
Size 27.2MB
Sample250822-rt355svtfs
SHA256 747d93f4ec45203a68cfc064dbed6b406ecc19a93f54c9b7a54b122385f076c8
MD5 770e7ae2e9728da40f8a5b0957fdac8e
SHA1 21da42e1ae4688a371e2aaf90ca7a15f22e9814e
SHA512 32949c92c0784f62dc5056429d0883c0dbf1bb408bf79517d1275d7a866b58a5614aedb2b4b9e4b1d1e5aada25c92b042b3d0537a2c51ea65007157663228fe8
SSDEEP 786432:bX0X01Cnvo6uxdzgyBxrB4+gsH8ks5d31QSop:IMXbcyxrBEscdFHop
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery

Malware Config

Targets

- Target
  ce2ad8b6d76ba03c96d9248ac3d22590801e00611244c1942875adf52c154971
- Size 27.3MB
- SHA256 ce2ad8b6d76ba03c96d9248ac3d22590801e00611244c1942875adf52c154971
- MD5 6fdff41e8b7c3b107618708cfd0c4ebe
- SHA1 b33c760d45979b46f669928856c9b532fdb06f8b
- SHA512 e44036d22ff761b23cbdf735b98658411c0c467c5f44cb329ad65cf0677a4b23538717c3e7cfd892c86bba68ba5a1202eefa39203ad20f8977ee824bf59aa069
- SSDEEP 393216:uNwi7nhUXRl74RJoBqZTQhP3W+1hsvNTuYBJ4bSpiO9dZVz/uzXqJ:uCv74IBHPGyholu8J4hO9P5/uXo
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

defense_evasion discovery
- Modifies trusted root certificate store through registry
  A root certificate was added, modified, or removed in the trusted certificate store registry paths.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  3.13.5/_asyncio.pyd
- Size 62KB
- SHA256 c6b42022809d8acb9534c66cd0a3cf51e63a9e88a1b3e18b0acd0b932d012140
- MD5 2b1a6067d9427f9e29f7f0e20731c89a
- SHA1 840f8af95f9b88794f972b2ddfc80f752e31f68a
- SHA512 5b6120143e4f59eb8b311479cc41a79fc28db0fd3b095076750468f94a6d52357f92713370b0b85d98cda9f67130ed3b105ff0c15a97c98d3b4401f8de9d3835
- SSDEEP 1536:v1s5t3L+U37Uw03zkNd3ykAGOh2HVIsvnfgGcyEJ7Q9IfIgHh:v1s5t3yIx0jk/2GueVIsvnfJY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  3.13.5/_bz2.pyd
- Size 81KB
- SHA256 78b6c6b7e85f23c568f455c54a63dfe0cc2dae789c3d25841d3594adb85e4599
- MD5 8f0dd810e14c331b83d828fc0916ded4
- SHA1 25345e20a6e044fe0241356cdab4f49aa14e4155
- SHA512 7b5a9c5a375c41dd89e83088f3455e20c7b152a235b13fa102e35f897f59b36712d2a53ed57221e470f30eecf7bac72a8d72038fa461cdcb105d413ebc4e9099
- SSDEEP 1536:8shKo7p9om0AJfDf1e+XkX38ukPadIsLVKyEJ7Q9+zfIZRE6yT:Jp9D1DfPQsuwadIsLVEUZm
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  3.13.5/_ctypes.pyd
- Size 117KB
- SHA256 586f667b1a4688b8f60fdd69f022775f1f5901501578eeef1d21780519ef2161
- MD5 b59859a16bb8ec2a611a5fcf3a2fa02e
- SHA1 23cd502683aca61b29fd2cfb29a869f81f36517f
- SHA512 b3a26ffb438ef63f2d462bb8f414cb008ce9697e0951778466135fe245be70aa7e0d1918c7829740470ff4eeb950858c995f2fd42de5b941f8f20ba3bb98104a
- SSDEEP 3072:o6pO5xbbP2aNkTwzgvwwNSw1F/Y5Fb6xx+CqRIsyPbH3FW4IYf:oIO5xbbPzkvwU/Y5FGxghUHf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  3.13.5/_decimal.pyd
- Size 228KB
- SHA256 88329514e3dcaff2b916df36798429b1ff00b134c79440534479fbff5836d87c
- MD5 6bc9b92fd7b1696e1fa1b41da283d7be
- SHA1 deeacb621703513a64d091f19cfb8cb6ff3e5e05
- SHA512 b30e79295a62d7ba0c70a8367238b34c42dd60902eab0c688b33f4e1f7d0848cec47222f06c36fa48f31daf2c6810bddce2fc506c15af123645416ea31e2dc28
- SSDEEP 6144:l3GQfOAIBiHZxHsTAsoor9q2aZ3grW1gkSAfP7CME:9GmUiHzHGno/p5P79E
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  3.13.5/_elementtree.pyd
- Size 121KB
- SHA256 c2ab192396166e0ea94be4c547f1f18c185218e3a724c8563969f7a0c530fd11
- MD5 812080c773f595ec442e1c743f4f9cef
- SHA1 f8a0e760a4a16bd7fb32249814b15b86b8a0f822
- SHA512 c87c8c79a6ab655eb85bf00b5adb166fadb4d453d43ec86dedad2973441e03b52c286f7d820479cada4c5c6d7037cf144398d86914ae4960096b86815f9f89be
- SSDEEP 3072:hmJJ1vRpiUmVmaPdV44RWqd9ui4NIszfeF5GZY:hm5vREUmVkCd0i4eMY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  3.13.5/_hashlib.pyd
- Size 53KB
- SHA256 911b405cb1a3da08f1a2b5ffe3ebe4e8c8cbc1ea75db860aad4176646da5d2ce
- MD5 1834d01e2edc96b18347f9233649e66c
- SHA1 e62d0e8c8e299e29e5d939a4c0e87c93a1a6941a
- SHA512 e6bc3688194b38f43d4d482ec15e075c76722f1fc0b98a74541322ba46a5edb20521b1a30e929da551904f128f2ddd58d96e0003382e01bef849c9db5bf8f8cd
- SSDEEP 1536:og2SVk8r55akpxj9dUhIVIsvI4uyEJ7Q9AfIgHe:KSW8r55ZUhIVIsvIgY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  3.13.5/_lzma.pyd
- Size 144KB
- SHA256 9fcaa46b16e0866f884a8b6419ff572a6c5122a8c053b9102fefd04ab1647778
- MD5 03d756c70cd5ec0e65bf5be2bd78321f
- SHA1 aa3ffc7defac614cc9718139db3076dc13e8e459
- SHA512 c51271f6e19518110d905a4de28f39aaf44fce192a9a0e1de6b8471a26a2532346bd3487d52aa290384d70c51a1e7475d5dfd44a820c1da5b7c5170449656e54
- SSDEEP 3072:eG18x04NoAZg0CTGx2inhjOjrTHuAdC1RHc93XHf09mNoeQGpdIs01r1W4IKh9:e04DcIn12djsYOetpC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  3.13.5/_multiprocessing.pyd
- Size 31KB
- SHA256 e07930f5673c99fc4ea0dba1c076093514b806d7f3abad5e88b5fb95467e63cc
- MD5 477e2a2301565f4412630a96687d30e9
- SHA1 e28bc0bf36a1f92dd6d18cd5b56b1b205ddb2f7b
- SHA512 a005907d9decde6d67884c6e9842f11f1c34128942b4018179484abed2bb1c4d77a62ac4c591cb34861ee31527369a76f18bbe022d83479c328845469a0acd27
- SSDEEP 768:9tPJkdgrLj4z9YqJPFIsntpZyEFqU+Y7N2Ip4gTxf1mltPRVjvg8x:9zkdgrLj2eqpFIsntPyEJ7Q9sfIZRFJ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  3.13.5/_overlapped.pyd
- Size 45KB
- SHA256 dad302c2522b0564a9126df1ed3c5a729b3c88443c502248472f3a893fd92e86
- MD5 34b05e7963f3b8bbf5538be7cb94028e
- SHA1 6b2a4afa10d784e22549b734c605a91ad6a69e58
- SHA512 00bc66313ccfe39f9f2f6c32cb71c959f322760de671db64e933027c19c134b158419ff34a1b1188cd8ac2d5376fe59a11373a0c45a3e25e9b40fdc63f7b57c2
- SSDEEP 768:auW/Me+wE933lZgeS9VA5kpoeyiH7rpIsWtidZyEFqU+Y7N2Ip46XTxf1mlWZG83:re/E933lZgz9VgkJyiHXpIsWtiDyEJ71
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  3.13.5/_queue.pyd
- Size 30KB
- SHA256 3b85e050fd6ef4c85f1351a14cad21f32bcb6374c7691a74878b9d3e50943c87
- MD5 06382d6d4e7a1110217be5da55f66425
- SHA1 332d7689051c0004c9ba28682efd62e578efd09f
- SHA512 3f30716d07e7df7202ec92ca6514af4bbbb5649eb61a8f6d0f96ba7c661808e0cc0745d20dc36b3a2ce0b8d46ce59dcd80be97d03847c41c0f1486a8304007e5
- SSDEEP 768:vjb4qFkv6rwwfJxDRIs9UIzZyEFqU+Y7N2Ip4mkTxf1ml/6dHQZZGr:rbVkydfPDRIs9U8yEJ7Q9ZfIgHGMr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  3.13.5/_sqlite3.pyd
- Size 99KB
- SHA256 3d2f0ebd720f6aae4c338824e9e5ab1ba79631cb63a8bdf8f0fc9071a39545e9
- MD5 8129def34fbffe57b6d0485f84d77a25
- SHA1 7a445bbd682b4e773d75fede20ad8963602d920b
- SHA512 332b822f265310e30b5fa2865648cf57f58326086f20f310cc656ea60e1691c86f4337682eda393b809fe448b36962c8d1f1f2cf46316c4bff7614ef9b91c7a6
- SSDEEP 3072:RIvgg3KxEGZoSCivmh5GMbp9igVIsvQnmuzvW4Ix2W:K+EGZYR5N9ig89S
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  3.13.5/_ssl.pyd
- Size 158KB
- SHA256 4c60c706304b7051c113324470dae1476a51782148ffc161e90ba66feea4095c
- MD5 79040f65a4de65b5727490baeafacbef
- SHA1 cf6222a18d659016b901aa06ac8776fc65a68391
- SHA512 64f26cc1c8f3c5faf203fe7fe2f6950198a85312f8476e5dad4a610809b56b8751e37d8deadcbbe746def223a172d15cc1d1884518fd356f1db6276d434a81de
- SSDEEP 3072:Y4DsxHnVb+WjDw17na6vPsoOKoL9BXdIsL74OsdhrW4I0V:Y4DGHnk0Sa6vPLLoL3X1khn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies trusted root certificate store through registry

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32