d7301435ee207ff96c5ad372939dc46d39e0f9db2bcce487cf1e8f739a2e845b

Sharing

Copy URL Twitter E-mail

General

Target
Oracle_VirtualBox_Extension_Pack-7.2.8.vbox-extpack
Size 19.1MB
Sample260502-lfktract4w
SHA256 d7301435ee207ff96c5ad372939dc46d39e0f9db2bcce487cf1e8f739a2e845b
MD5 1ca3fc369d89f2d3937dde9275e4e5e2
SHA1 fdeac4f680b680591d68acb9fb1c1ba714725cd4
SHA512 abef46967131ef0d37ab63a5c0b2d0b843e7c723a31b3f2daae8d9dd05fbef4feb33bd039ff0b7da2b1222e16809fa767736432d3bf533915b786dfaa89e70e0
SSDEEP 393216:zXu6ZGRrgKl0wk38Vp+wVPHujNPaPE462VI39UvDZfYB2JOxNxtVzTMNT0NRW:z+nd0wkAtmj1+0iI3OrFUAyXtVyUW
TLSH
T1C11733CF8AB2417E3A78353CA7E3DFB98D0DF44984469B964F0952F355F068A01DE829
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Oracle_VirtualBox_Extension_Pack-7.2.8.vbox-extpack
- Size 19.1MB
- SHA256 d7301435ee207ff96c5ad372939dc46d39e0f9db2bcce487cf1e8f739a2e845b
- MD5 1ca3fc369d89f2d3937dde9275e4e5e2
- SHA1 fdeac4f680b680591d68acb9fb1c1ba714725cd4
- SHA512 abef46967131ef0d37ab63a5c0b2d0b843e7c723a31b3f2daae8d9dd05fbef4feb33bd039ff0b7da2b1222e16809fa767736432d3bf533915b786dfaa89e70e0
- SSDEEP 393216:zXu6ZGRrgKl0wk38Vp+wVPHujNPaPE462VI39UvDZfYB2JOxNxtVzTMNT0NRW:z+nd0wkAtmj1+0iI3OrFUAyXtVyUW
- TLSH
  T1C11733CF8AB2417E3A78353CA7E3DFB98D0DF44984469B964F0952F355F068A01DE829
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Oracle_VirtualBox_Extension_Pack-7.2.8.vbox-extpack
- Size 82.5MB
- SHA256 687c876feb92da0b966dac92fc273e15d78a69ae3c3ed1e691a63bec6270f665
- MD5 81d3e4c2a26b26496d6f40f03c2e5d58
- SHA1 c0e4b8df6d4a5181b67fb9018a7036efc98e70ba
- SHA512 a9d60eea1ec8c5b5d37db8263a68ddcbdd212780a8185c35fa28498eb4937b79a0d515d259c8d7563e7d925b2338c160e72713b66ae8affc398cee1ebcf5b1f1
- SSDEEP 786432:+TMZ4GSGG2NcnA0DymGYK/sRNcic3cEahX/7r:6mD/sR3c3cEah
- TLSH
  T173188E3BEF2C8C1EC589867E77AB8B712B30F8510572573706D9E2359C962874F0DA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ExtPack-license.html
- Size 10KB
- SHA256 d323942ce5115ec94f0c400818935883865212a7885696d010d00ca51eca5d41
- MD5 e5c315881ceb72a6188cdbda4517ec1e
- SHA1 ff3a623e1dcfad6f03e4af51718a2af3e29aa4ad
- SHA512 6fc81ee5121db08d0ba4950009bab91a8426d022fdf2e390a13d9332f2d5781e3bc52ece47338e538a709cf8843fd1826f9b6540180bbfae3074fc1a3f6c3ace
- SSDEEP 192:qLayy8KgvxJI3XThbH+cDlprVjcgd3404ErXC6xoe0yDGpRpP7ixYU:Caz8KgMHTbprVj40rk0DGBGH
- TLSH
  T17D22D9E7B34827A11787037A36478FD5F369883D76BF451020A5C11A2762D7883BF6AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral5 behavioral6
- Target
  ExtPack-license.rtf
- Size 19KB
- SHA256 00e1e8ef63cdd94af6a8971961131a59287e1feddc9a9fb251ac1d06940a49cb
- MD5 307cd6f1206ca2a3ef0b053a67e460a9
- SHA1 d58658149451b56f0b79068d387b776b5405ae8d
- SHA512 0a6e1211ecf915c219a4efdc53558c812573d713c4fa1e81d917d3bdcf5278bd288c46b2ead30c1df115ff7bbbb6f16f15b333979487d35b21180c3566b2210c
- SSDEEP 192:wJrjv1M0L/yjpKWDJIT0TyPH7cDcpr5wcgd3+EoXG6xoB0yDGpRpP7irYV:whh/wpK3ITspr5qOoDDGBG4
- TLSH
  T1CA92E9B758434AE425C50BDA0E92CCC8AF7AC82C353ED1AE576580C8366FE7847366D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ExtPack-license.txt
- Size 9KB
- SHA256 eb31505e56e9b4d0fbca139104da41ac6f6b98f8e78968bdf01b1f3da3c4f9ae
- MD5 2f91f68e2bda53fd0f9e90728e5700c9
- SHA1 83e240950d4eb5334d3115ee99b95cf10d3583f3
- SHA512 31dbc102ca678dfa2b30051834fb648dfa1c2653a2aa40d2141f5df8313a367eb689129fa92549695683f66f9e9d3f4701727f79c76b7b6826f38d4945b1f0d3
- SSDEEP 192:gsZusp9d+8a7asayKLceuzCHQszVAr3vfgc3NdiV+HXz5l/mH7pOpP7kNm0:vUs/d+8a6YeuOAr3ZaQVoH7QYb
- TLSH
  T18922A5A7F34813A21A86067726469FD5F339443D7B7B515130A9C11C2727D3883BF6AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  ExtPack.manifest
- Size 8KB
- SHA256 d46533db9453b47403402e4707dfc86a03e84c4acf320beceebc7b3de8b4bb17
- MD5 20926774b3b7180e01466568ebb2a088
- SHA1 ee24052d609f3dca9ad4b3cbf79105b6b5f5af52
- SHA512 5f8fb109e07bc76b3b079a23366c80d815e82ccf26c2cd257c8a381b995a38cd0cdee49dfe1131e0547ae98ea539a3aa3e53c974e9d626b3d35cab2d779e8084
- SSDEEP 96:7K4GGhwasGogNbXC5j57AISDZnw+15BpRz00jmgJcr9+Q/vYYmskFwoG2oC2zPsl:2CzSSDZzc0fcr9+Q/wbsgbVoC2gJSjc
- TLSH
  T145029523166057FEF164058D41C39EE4EE9E47591CB670BF6DA792804C91E0E5B3C8CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  ExtPack.signature
- Size 6B
- SHA256 08cebd0aa1eda87c3fc301d5d838a80528614ca823ec7e78e6ac1aee9a7f0021
- MD5 6179fbb96e8c98bf4682ee248314537e
- SHA1 2ea2960dc1a941af743ab2f1e44a450cd08cd13f
- SHA512 3cdb71fefe89b4530018e97ee0fdec07c8de1d8a053b87dfdd883c570f126cd2066f565d3b4c2bbf3efe248fa8c6371fde70aca094ce558e0ebce1764127f621
- MD5 SHA1 SHA512
Score

3^/10
behavioral13 behavioral14
- Target
  ExtPack.xml
- Size 445B
- SHA256 e7175e2e2583212b0052549d9a2493792ac0fdf42eb9bf31cebcd5354cbd528e
- MD5 b8e463e969911213d62ffe2a79876869
- SHA1 fb9ce708a67487329506b3a1b00ca43dc62139a2
- SHA512 0e61da16af2a3b06ef356066ab6d16a8732e1bbbf364e3118d17276f4f98e093945fcc51f7fae7295f0dee9913bd737bd37435cdfce64a04004df6a827d97bbe
- TLSH
  T196F0270D84D2E83150364D0EDFA1D182DFBD030658D20498B0EE80860E302DE4667CA6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  PXE-Intel.rom
- Size 48KB
- SHA256 7d0c3ea5eae5c1319e646340bd77ea116ee3790e0e27991132bf1bb6d1939127
- MD5 63b6f5259ac842040326c16c75af4525
- SHA1 47f1b957b11eaf72c5387ebaab3276260cf57ecd
- SHA512 bd486f107c9504dd74f3607d5f14efe22052399e27e26a906de48c1a4d82fa65a2ed8e5f0fbd60278c1a8f921df9ca9c127e13758d07d347ec2a81190fd5fd9f
- SSDEEP 768:p6smHh7iLTelqMlkU1vOQYjpHKnCmMF5aGa7sLZyi7UFRsTlkTmjYZxlK/:gPHViLTePOgvOQLCmM/Ra7sL77GepNwy
- TLSH
  T17323BF037205C37DC9C9D3B6725DBE7E7071FD01AA89002E5159BEE423FADA8E3A6125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  darwin.amd64/VBoxPuelMain.dylib
- Size 6.4MB
- SHA256 aa32ac009585cee7c3f892372f33758dbb20353949844b3df47965f93dc63bc9
- MD5 6fe09ec1711f07e721f76245eb939183
- SHA1 22a7267323bedf544e68c0788daf3353789d80e3
- SHA512 5dcdd31f330eaddd4b4afe0e164856cf641599dbc5950770501a565ba47b36d2c9d916ced2ac31ca21067214c282135622a2af8a35fb440bc2d69fec0bcaa67d
- SSDEEP 49152:ILygAUY9BTyRyxC0yUPSdQK9L7zkLi+Qpk6iKdCoBOeuJlFEB0fkb81GUCsmOoeD:MXY9RxJZS/jmTYMZ8EdXb
- TLSH
  T10F66A66F3A73D47CCD61D035961B83325A30F19A1932BB2A1DD8E2396E34C659F2981F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  darwin.amd64/VBoxPuelMainVM.dylib
- Size 30KB
- SHA256 f0d01ed2e92c104b0f5307b163dfe93690970bea6b41ab6dcc3f4e453794880c
- MD5 05a8480bdf010ab8c148c8f7c568cd9b
- SHA1 27388ce1abaef4891833e99d7e7fd0cc1d238e05
- SHA512 053ed9048e1c0fb4ad0420e4992e3edba9f15d4261239648d83751f3655680b49800ce467d87ea935821ffea0a98d145b4c7b5a217e8b047be90ba4b1117a945
- SSDEEP 384:k4VYwRr+Q8frzJrcZpr8kjNWrNab8er5:k4Vd8GFZUab8
- TLSH
  T197E24B971B5C2826DC48A67403CFF7D3AE33F2881F62001F6092C4E52F93B796A2995D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  darwin.arm64/VBoxPuelMain.dylib
- Size 6.1MB
- SHA256 1064d6e01285a632d9b8a059c16db58431459a2a2b6401b9c42ca09f582d08db
- MD5 ab39f8cb6088fd0c10a83d9d5daf9113
- SHA1 2df037b1a49911efad2e80e1744daecd32982ef7
- SHA512 ef0d762784d2cb077c4d9cad9aac4bc4128e2d89f98b3dcadf2dfe331ebce5d27a8f455b63dc2175babba8801b49286c012e26da9f056e1926012a841df0a88a
- SSDEEP 24576:TdeDKstAOcKfk0wxqyW72q1Vmxqyqn4quhCgcSNu5F61B17Ya03Ets7U1deNcf1d:ThPTKDVKwU1PGUHqyEEab+A12TPL
- TLSH
  T1CD56A460E1AC5828F6C5E2BD7E8417E8760BF94448B4D1CF78FB028EED55AC9646C3B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  darwin.arm64/VBoxPuelMainVM.dylib
- Size 66KB
- SHA256 60fb6d0a87e80dc84acc375714547c1f2cc00709cc697bda0d69c1e6fc34a857
- MD5 da6b73a69a5ed40563186a0d3f62d01d
- SHA1 0a3a30d6c62b433833191a6d265b81a1e5826cd7
- SHA512 f0e76e7ec2bc72a84cde1261380e91b71647e3af426152449a038305bff124a03478f68e048b9fde2b01b91147c94dfcfca198c2872ab9f09c44a32a65c20854
- SSDEEP 192:xGCpz51o+61i7VRwsWezYzr+RjG8P0GzrzjFJNzr/zOJr8kFtNWrv75alZ8P09rw:xe+6Xewr+Q8frzprgr8kjNWrNab8erw
- TLSH
  T1C7632B931B5C3816ECC4997502CFB793EE37F3995F52001760A2C4E52F93BB92A2985E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  linux.amd64/VBoxPuelMain.so
- Size 8.8MB
- SHA256 2ec9c38a2b3af264d4ae3113a1e5d73b0b76732b19ae343bcd4b62cd2f1b0e24
- MD5 8f501316e37f419fe19cc564cfc4099e
- SHA1 e16d3c3425e8379cdbaa69b881497e9449bb03ee
- SHA512 8a82918585d510b0c231d3a82857571e90a473948ce6b71772b3a9db368019ac95f82252f1e236bb157dfe01a233d45bc23f38d974976f5341ad17f6dc8d27d2
- SSDEEP 49152:lawyK28TzUDCcuyRDfhlbkMXynJ9bftvzsLgBrarh+qYsIcIqcO3Eq5+ku6cKicg:E8TzsxDfhlwMXesJGVMIC9J1Hd
- TLSH
  T1DC962A1F2637A45CD6BDC0B8895FC2B0AEBCF4E0442534376B9BE37069519225F0DA7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  linux.amd64/VBoxPuelMainVM.so
- Size 13KB
- SHA256 6b47074dd7bf2f6f374abe833c8cd26d1c09252599d517d3bac3fbc636dc57fd
- MD5 362ff1169e10c89237d00888ed3cc852
- SHA1 dd2c3e82fa184dd6026a64d648c531092523211b
- SHA512 34bccc64bdeefa2a0f0b64c90927e138f5fc696c765cfb9ecbe1bf9081f859986da3fc191f80b561caa806862ff2ce38f148232321ec42fb08a818c59ea3527b
- SSDEEP 96:Rr0tsQMBWBwUjosXhiwfAJwTiW+HlfvlbDScUT:R7x8OUjjs/JwuW+Ffv5
- TLSH
  T1AE52941BE761CA3FCA6C06B4C8E707707279D800A3D24363A279B5311D8775CA7569DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  solaris.amd64/VBoxPuelMain.so
- Size 57.8MB
- SHA256 5dddfd83897c5680ff8f177db0374da8f827694e901aac46b4869a090368749c
- MD5 89f1bc2cb7cf8056924524dba231f4bd
- SHA1 6663d1ca2625692f70df6388e567d525f41b8088
- SHA512 c027a45afacbc43cb2c019e04c67b606b6061869b94f7a841c0323657ac010847c3632aeb9213306dadf7e03f24a90b30bcb575f4dce7c15a3d5b3c22ff8f793
- SSDEEP 196608:NB6cnA0DymGcsBQK/5JKhR0Irci0c8I9xwUqL1E6CQJ3cEahX/76w:OcnA0DymGYK/sR0ccikWPa3cEahX/7r
- TLSH
  T1D6D75C3BDF6C8C1BC58A4E7B77BB8F112770A81112A3573706D8E6359CD62474F0AA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  solaris.amd64/VBoxPuelMainVM.so
- Size 183KB
- SHA256 fa1f0957e6a1d9cdf2016538eaf7fd25f4149f7b9c499356b2a15b17e5cb7d43
- MD5 8dfa1c1d0bda8bcc997b22bc56b11212
- SHA1 d92e9452ff08a3a13bab6eea0b036ac1bfabd13b
- SHA512 fd4fac2b495c939a72f60c6bd34ca1e837d33e252c6884acd04f1d4493523602bf8f2bdc7b2ec59cf80e00a17c42251e7717691b14a3590e1c238adabec85675
- SSDEEP 3072:ujlat8OM4HFZIKE3QLSwevdwnixU/skZAlmI9Wj7YN61y7YodWjVSK3FifM1yGzN:wlatJAKE33V5xU/skZAlmI9Wj7YN61y2
- TLSH
  T133045A192BD3B42AC3BB3A70EC566B7C0BBD75CBA7CC5A16897005608FC133D6C25696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  win.amd64/VBoxExtPackPuel.inf
- Size 1KB
- SHA256 879eefb85c0e3f6cbb0a0d1d58d56522a38bc7562ddcc789d46dbe43b9dec312
- MD5 650bee14c43e2849b83fe75144a2209e
- SHA1 2b450ab66fba6cee6817a8e46a95ecb2f7244d2a
- SHA512 4ccdf1a79c0c1086375d477bd9bec3efb2fc457cd882f0ee0c33d1741c1a56ecc325bd5a13858161258033f692191665c37494611129ea146d5f4597e9618ffb
- TLSH
  T13641314A4283E7231A3006A97707CFCFE36D4202A99E0402F66AC9BBCD1DD1D1279CB4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral27 behavioral28
- Target
  win.amd64/VBoxPuelMain.dll
- Size 1.3MB
- SHA256 50c5bdc8411ddf0d8a6d6c01c1ce07c4696306756181bb50ff3fdeb488f8ea27
- MD5 f9f20970ca592da2d83f865ea4d48f86
- SHA1 8780be3b97133481b301422bdd8bad2733e19700
- SHA512 b33871ed9d5f48f07fd01856b7f6cf681d43a0531c5e46ba6a0f045b4265a2c418a163c96befd97bb23b5d64373cb6356281d8efcccb7c3488638c49362f63d7
- SSDEEP 12288:CXAQTmEwFRZiLadFg6zqJKB2kopedVdtPn0Nc/XDKmC1X+Tpcp6jj1bAwDRvoTMq:qAK7n1JK5pv06/XDKmC1X+Ts695NYHcS
- TLSH
  T170554A4B23AC4065D47AE13DE2538B1BDBB3302147A2D3DF026587AE5F237D29A79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  win.amd64/VBoxPuelMainVM.dll
- Size 23KB
- SHA256 ada5742fa9979fe9407698e6986d4097369e7ec02a5dd9d6e8932c195d27f110
- MD5 6abcc32ccb6502d3b27376813c6119c7
- SHA1 fe5bff6b077e45aa90474fa47e4a11b5f8bf8cb6
- SHA512 65640a1e152b2952b33e1e742318bbbd3475b4a2abf9f3b789fa9619db1b6496b4738a16e1af09f43ed0604b62f74789c3f01e6b1833c039dcf04d70d6ec6642
- SSDEEP 384:9XnPsg9EG0PyjHMwS46rMIYiq1GVMJ7Ly8RbmL4nNyaxc:BnyDy9ShrdYi1VEL5ALCc
- TLSH
  T197B28C57A6E40C55DC274D70E8E25622E876BA501FA1D2CF1324C1290FA13873BBD6EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32