e4647b560c4da581f4bb9275891a26f927601f424061738b0de51f1e52da1e0d

Sharing

Copy URL Twitter E-mail

General

Target
SABnzbd-4.5.5-win-setup.exe
Size 23.6MB
Sample260417-2qrm2sc131
SHA256 e4647b560c4da581f4bb9275891a26f927601f424061738b0de51f1e52da1e0d
MD5 8c443b19191480e9b2f90fc22b2d6539
SHA1 fd2f5182520a3188cb641952a805654e719abdd2
SHA512 5d6e03cfb9a50a6179288e77ab640497078b287624a247aa4f507a81c27a01f6131b391440f82fdd303ce94c6cf186b8d3e14f81e1823fc35255fef39a3e8ce1
SSDEEP 393216:V+TfRV64u+7D3aWD9cYtP/9/zgffveSYc1qW1+LCzukrGCkyyAoq9XHa8+Do5Y1:V+zRVlucV93Z+vLM0uKh/R9X68Zi
TLSH
T1D44733D2A4C2613FFADB413445DC83B689E4BEE3714444FA79EF375E3A3B928452A184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SABnzbd-4.5.5-win-setup.exe
- Size 23.6MB
- SHA256 e4647b560c4da581f4bb9275891a26f927601f424061738b0de51f1e52da1e0d
- MD5 8c443b19191480e9b2f90fc22b2d6539
- SHA1 fd2f5182520a3188cb641952a805654e719abdd2
- SHA512 5d6e03cfb9a50a6179288e77ab640497078b287624a247aa4f507a81c27a01f6131b391440f82fdd303ce94c6cf186b8d3e14f81e1823fc35255fef39a3e8ce1
- SSDEEP 393216:V+TfRV64u+7D3aWD9cYtP/9/zgffveSYc1qW1+LCzukrGCkyyAoq9XHa8+Do5Y1:V+zRVlucV93Z+vLM0uKh/R9X68Zi
- TLSH
  T1D44733D2A4C2613FFADB413445DC83B689E4BEE3714444FA79EF375E3A3B928452A184
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  SABnzbd-console.exe
- Size 313KB
- SHA256 4943604d31d7257a5f6ef75fce650e23b7ba1fda78974856ac28fb833260812f
- MD5 1debee3560dfe3e4a0cf5e1adb1a4880
- SHA1 098c6682c20e14b4da0feb2dd91f70d64ad1c417
- SHA512 4cf14c3055ca1deb0ccb18cc505533d08f4a99b0d6f458714ff13c5e86b5e42ff3cdeaeda7fb9b141f6a093e7f8b11b17743e26ae0bb0738680c634a30c95a69
- SSDEEP 6144:sPwQg8UkalFhkGMVHvEuK6Xx41eu3LohGaxGW+BNyQ:VQtEjhkGMVHvTK6Xx43khGC3K7
- TLSH
  T12F645A55A3E404F5E8A3423DC99AC626D672BC120760C6CB93E87E6B3F336E14D3A751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  SABnzbd.exe
- Size 308KB
- SHA256 6a70af10877297ae2cc4575952a5160c2ac389055c643ba494182ab2c6ff1375
- MD5 380099fd297fc6315b8ff997987b836e
- SHA1 67bff12e52f894ddd6700d95ed930b227d7bcaf2
- SHA512 77c690c8c7a7ec658267e83f74c67999d8abacf7b9d183b39518676b245ed4003544c5c98be88d95cc739ac2deb744f5adec9fa43a932071e5e0326239931f41
- SSDEEP 6144:r7EiGHt2ac+4U0yiiLzpARSCz1aQ3sYMGW0ODadyLZ:r7EiG32U0y3LzpARR5vsl3xaW
- TLSH
  T110645B5573D408F9E9A3823DC996C626D6717C120760C6CB93E87E2B3F336E0593AB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral5 behavioral6
- Target
  VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH
  T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH
  T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  _asyncio.pyd
- Size 76KB
- SHA256 bdd004633904171c4d00b84deb69707667b676156840d7869a38edb7ba52d25b
- MD5 4f6824c84a32dbcc1dab5ed5d9a3ac83
- SHA1 69d150c3bfc4592fd8df0a20d65e442ec1a0fa14
- SHA512 772b8a8d6484e3daf2e82d67f72d662de76356242a87534d71cc93f70d0c6e5950f77b889b089e1dcbbcc57bf19c0289bf19f9649b8d43ebf73860ccdd505005
- SSDEEP 1536:9yyCqKMb9cwgbLTVFs7QBxNoIMDnuh8y+kR9pBfIU/Hn:9yyTRcwg3TVFs72oIMDnd2n
- TLSH
  T1B5736C87A2A44086EEF79134CA536FC3FB71F1815A05939F55A4C18F2F533A18BBA721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  _bz2.pyd
- Size 85KB
- SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
- MD5 94fd94a3194ef83be4437755a14cb810
- SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
- SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
- SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
- TLSH
  T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  _cffi_backend.cp314-win_amd64.pyd
- Size 177KB
- SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
- MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
- SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
- SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
- SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
- TLSH
  T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  _ctypes.pyd
- Size 138KB
- SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
- MD5 5860d45269a360d830807497fda7dd50
- SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
- SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
- SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
- TLSH
  T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  _decimal.pyd
- Size 280KB
- SHA256 a33b1562acc8201411971f54444bd9c648f2d194d9914f0eb734904882213828
- MD5 93b63bd1e89c4e96c37b498f7695da4a
- SHA1 b296561205137cdf949a8376c7877de482980989
- SHA512 7225f613c1c419dcdc03b012565d29671f05ad3b78facb9709616850a243d1885f4b4ff08b3ee41ad31e4224a328b7eac617fa53d4c9b21ec5dd110ecef03778
- SSDEEP 6144:94R7esG0e0tZq2t+mmSIJ3eEmn9qWM23pLW1AkMk7kTt:94R7paEs2kmmbJeVHk7kJ
- TLSH
  T1B1547D56A2480CA4EE738074CA879A57F7B278854360D7CF43A48AA72F533A3777E744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  _elementtree.pyd
- Size 135KB
- SHA256 e28d76c0accf1fb4709ed2b01bdf2ca1c6aab309cda2b9ee8cb35363caf6f5cc
- MD5 27dfff9effc476dfabfe3c37b468fbef
- SHA1 9fc4e79a13ee16847c832f255875ff89ff984d5c
- SHA512 5a1fb0684e97941ed72ac14b63e403bfcfda8cb8a1b22b5bb62e3940a96ecb904e195300224a2ee155a09a1c5cb1eeb7aaad8a105e65709550e1682847000838
- SSDEEP 3072:p/6NMLHY3kF90YxUCZuSnSgcZ5wvoITbxGcLsJ6iPDgIMfftYH:p/23kFyxCZuSsioIHocLsJHrzH
- TLSH
  T1F5D3494B7265C0ABE462403CA6579B43D7B6FDA10E0083CF6294F69E4F273917F6A718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  _hashlib.pyd
- Size 67KB
- SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
- MD5 d60cc3d94442491b3f8657d54225198f
- SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
- SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
- SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
- TLSH
  T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  _lzma.pyd
- Size 157KB
- SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
- MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
- SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
- SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
- SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
- TLSH
  T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  _multiprocessing.pyd
- Size 37KB
- SHA256 a8fd9f42314077d35060055f946176ad5753e6bdee9ac175c675d5be8796ea24
- MD5 ea90d989a8c634447023be11b8f9c0ab
- SHA1 b660d6be18f5885f713fb726ca1fdedefd95251d
- SHA512 10821518f3437ac8ed72550915e831ce52648ba556815c7e4ac83240f04dc06c8d98a446e295d92d70f839b85240664d0e9f01ab1019316420998acfd5fa4e39
- SSDEEP 768:7FMV/WzNkb5pHGlYIM7tTo8y++RYT2Ip4ATxf1ml/6dHQSVvO:7PzNkb5pHoYIM7tc8y+kR9MfIgH91O
- TLSH
  T112037C85A6680053E5639A70C6A3EF87F535F7831B11869F7195C2CE1F373D1A32A34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  _overlapped.pyd
- Size 56KB
- SHA256 d08ccd8aa330d52f7793995194f79465a47cc6aab9dcbac017a72cd3c96398f8
- MD5 e3b2aea3179b548371165b59fb1adce7
- SHA1 f2611da38840c9efa12fdb530319dc99d0b8a15f
- SHA512 9ee8d167a16dc1c4ab764113388ecdbb1ea2c6b7422d047120f760092890cd67bf06a03fcc6623c8b094bcfd2745f95e2d9e29fd42f083961d74ff0e830a6e43
- SSDEEP 1536:MyjKfH92YcQE3I4tXrUWBkIMCtF8y+kR9BfIW44DNr6qw:nI4prUWBkIMCtgW4Ihs
- TLSH
  T193437C4A679401DAEE63D579C2638E47F734B3D34211931F61A8D28A1F73392A72F385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  _queue.pyd
- Size 35KB
- SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
- MD5 d2fb94ad66cdc01078d9150ef50c614b
- SHA1 7a4cbc8262e8abbabae26ac26937906c89246604
- SHA512 04aa9a0309b8253e402e1f8be90b00625dff8526d6a83b2a8e0c1c51e56012c0b670faeeda089fff4b96edfd93a3a99ccc3ebdbb703da0201de551212e88b922
- SSDEEP 768:UG5x+6r81mVRTYsIMRUnbo8y++RYT2Ip4oTxf1mlDeI6WSU:5YmVRksIMRUnk8y+kR9UfIUWH
- TLSH
  T15AF27ECA6AA84093DA67C970C2A1DE93F535FBD3570186DF2139C18A1F273C2A736359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32