afbd78dca29d1dcfc1be9226347a10ab2a2fc7867ef1834596eb1bb476fd1827

Sharing

Copy URL Twitter E-mail

General

Target
PortamentoLoader-v1.3.exe
Size 18.9MB
Sample260502-ss6ejsft5m
SHA256 afbd78dca29d1dcfc1be9226347a10ab2a2fc7867ef1834596eb1bb476fd1827
MD5 08098f14a7c74c8e190eab711890e1ab
SHA1 5c0c31e81b434a9be8a8b2ecd1dc265a524b504a
SHA512 ba0fec8aa5cbd2906baa134b08d7e8669b6da94214ef241cf0661e7623e3c713935fe40af574d1c4e3c16c31fab52a546d7e98e343b10549c1dc5970d3cb7a00
SSDEEP 393216:W6BuIGDABEgfvSlIzAnn3tbrY2KMIfiIWkB532Cqq6hjQHfzX1PPtw1X:WBI/KKMnd+f1WkB53/kjQ/z1Ht6
TLSH
T1081722AF63636F47F6C16336992AFE354230A3AD726743B154F2BC9F39542A18927430
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Targets

- Target
  PortamentoLoader-v1.3.exe
- Size 18.9MB
- SHA256 afbd78dca29d1dcfc1be9226347a10ab2a2fc7867ef1834596eb1bb476fd1827
- MD5 08098f14a7c74c8e190eab711890e1ab
- SHA1 5c0c31e81b434a9be8a8b2ecd1dc265a524b504a
- SHA512 ba0fec8aa5cbd2906baa134b08d7e8669b6da94214ef241cf0661e7623e3c713935fe40af574d1c4e3c16c31fab52a546d7e98e343b10549c1dc5970d3cb7a00
- SSDEEP 393216:W6BuIGDABEgfvSlIzAnn3tbrY2KMIfiIWkB532Cqq6hjQHfzX1PPtw1X:WBI/KKMnd+f1WkB53/kjQ/z1Ht6
- TLSH
  T1081722AF63636F47F6C16336992AFE354230A3AD726743B154F2BC9F39542A18927430
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 13KB
- SHA256 92f34db47c34d6867e6928d4a9cd27747ff642392c0e361f9cab2f5d8c4df300
- MD5 9b2bdf058d377da28704af9ca3ef1142
- SHA1 0fc0d7fbc4c3a65eec33d9577ed38e545b3cc04b
- SHA512 ba0c2a312732832874642f6ca8d3b5aa4274da5cbb3a09d990b442becdf9a1abb98c61c5cbbb55f6a5341d2997388d01f93f69e4946e923a1892c7621775b93f
- SSDEEP 192:pK6RrZcTOIiQP00nXGqk3XsGZ4djZbfhhjv6WoF1dBaRp:I6RNcTPPVXG0kIjZbXjv6bBu
- TLSH
  T1BE524B51738888F3E786053D345237039B8A55267C916DE2C6335FC9696B19EBEB2343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 e90878fb1a9f6f71f58e091706778408c455b1461da28fbfa742b0a8dfee0478
- MD5 4b2c42148ee0414fc031141de8d07508
- SHA1 3c6e243194b250d401bd3e6c504e644dec0472d7
- SHA512 e584683bf12cdbbc7a1ab659dab7d602458e4f5ac5b5a6ec1f7f0510b9012c2eca84bd0961b82e535282833b6c4468513e52dc5c9d0b441481f3a00f7192204e
- SSDEEP 96:GJX1XJX70VnIjKdpClMdOfHFI2NaeI0Q1qND1qN3riUTEVXQcL:G1x1AVnIudpClyOtIs1QUhUZriUTEVX
- TLSH
  T15DC1EA7AB5C23CF3C24D0F757C1524264BB5D4251B180204EEF79BD2BE86E92EC34689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  App/Launcher.exe
- Size 23KB
- SHA256 ffcc32ff038febd136305a363caf963b7b032ec81ef4768edc187172094d075d
- MD5 512f54a6317cae4f4636c3c9634ddd36
- SHA1 f3606998ea190d89a6143dac0e5537b18216d1c5
- SHA512 285dc5dc97d0ec6ea1abee778419eca2bf38b32393f2a952ec5604093b750eb6709c0b54c2fbba3b5ed9832c1efd4e38d55574bc5fb6937c467dd2665909061c
- SSDEEP 384:Gc9Y7MEGfU5idaMHtytaiwZBpJtzaMtL:G8svTMbrJJaMtL
- TLSH
  T1B6B24954DBA204C6F1B5D938C4B30A05EB71F6137322E66FA7C680291F622D1EE67F52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  App/lib/Cryptodome.Cipher._ARC4.pyd
- Size 10KB
- SHA256 e37da2a2140eb18fb84065d4138ad1072539c82464475a94f5a87a049e601f7e
- MD5 41851aa1dd56679c1f5ec9853b9cc616
- SHA1 4e8e9b4798e6275c0213bb0189f80b52d2f72ca7
- SHA512 eadb1acc224c40cecb8e273fe3523c97c69aa934baa79876e38592df50a8bb4bb1bfbb25033c9064a208947b1db824ac758a0f7c56cf04695f0970ca2b9d7ab2
- SSDEEP 96:1jZuck7BNymq3UtFfZAn401wlKsQ9AfJkSRsP64Cz6Tq2c5n1kBRcX6goyOazh:XkNNyatvAn40q9WE6W2YORcqgola
- TLSH
  T1BC22188CFA564CEDEA6540B58A270B4FB075B711575273CF03B0917A1E637C6363A706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  App/lib/Cryptodome.Cipher._Salsa20.pyd
- Size 13KB
- SHA256 59ee075ecb9877bc24f5c27fa2d590bae0f6aa30a6e02432e1eb25cb459abc0e
- MD5 73d2494c8bcd6738b2767fe7819df72a
- SHA1 7f3f3de2eebe1aca142aeb181d6bf5ea7e7084cc
- SHA512 c694e0db7b3eb2935abbde06935c52a0c3d95e18ad415eae36b607fafdb6a656c37b7c0854d387c1a37581703493951a76563d89d5d6ce36beaaf6d1313d4e7b
- SSDEEP 192:nBeCWznuR5zIzpshfrQ0ZFqdeofnLjcqg542:nBOCMpqVDqdge2
- TLSH
  T1D9521796F32701E9E42B9175CD734A4BAABCBA00635167DB1320D1578C62BE1323E7A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  App/lib/Cryptodome.Cipher._chacha20.pyd
- Size 13KB
- SHA256 5736506ad6dc2f3d893b978c8727d74c2f0ae87bbc2fcfcfe8c7e982ea5e86e2
- MD5 ae0d9cbaf7463843e438dbccef1b27fe
- SHA1 87889089322bcbd79fcad0453667f577216597ef
- SHA512 566a28152ce33e185f8990d55408e4f36eb51b4c9970e12bfdd47462a9e2ca5e17cda61f5f5dba6f6177f3b6937efe04cc337af08525c41228e79ff4781dfb68
- SSDEEP 192:v30Y+Ne3erKrgMntNGWCL6qT043ZJPsBne9lkNEcqg2:v3ko1KLK2J19i4g
- TLSH
  T1FB523A89FB7054EDE56240B5C433070EEAF1BB20E711ABCB4360959A1EA3BD1313FA55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  App/lib/Cryptodome.Cipher._pkcs1_decode.pyd
- Size 13KB
- SHA256 ed12c3d512e5e0b4245fdc5a83fd46497bb2df31e49199b6265ace5142fe5021
- MD5 0900e8e081214b321e38c80670be196e
- SHA1 6919c2e76572c16c75b04393102318ddc04c23e1
- SHA512 75732fd2ba3d25b5c17279ba69adb1da008daf309397d267cf5304d8ff835a3bfc688f9ad8b0cc669480a427f393e10cd56fd20885e8bb4fff9b4d309d8d6e36
- SSDEEP 192:hc6XJdfr7i0iNWGO6z0x+/TOn/cqgvVJWC:nJxC0e+QKRg
- TLSH
  T1E052E846F66AEAA8E9674174C62B4B1FB9FCF500636073DB0351C99A1DB33C1327EA40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  App/lib/Cryptodome.Cipher._raw_aes.pyd
- Size 34KB
- SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
- MD5 4c869a3047220f0b344536ca22b2987e
- SHA1 5812d84fa35514c9cfce57bbc36242f930386158
- SHA512 84e6c817b3b860c538e04698e90aa0ea82e21a19ef70066e5fba7a1203baf5ef6c12990ea8c27db8180620f3dce6bd81ad4b24b4132af94684f191c326d4e2ee
- SSDEEP 384:UnqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRX:Unqs3C75tCKaVS4j990th9VCbT
- TLSH
  T19CF2061465A92656DF850E7AFF03CC0BD6B17821B762F23625E9B30C201B3AE2B7B455
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  App/lib/Cryptodome.Cipher._raw_aesni.pyd
- Size 15KB
- SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
- MD5 0b2596c23bd2792fa5cdb304417dd36d
- SHA1 c3dde92f4355aa8152e3b8794c5d44cd90665448
- SHA512 0716b03540f0d4a91d0aa2c9308e16158e166a62744294903181cfdd58c2299ba0d8cde1a4617df2ca63dfe4c813f14ae77e34bcdf2b57baceaf42a9ab5b2632
- SSDEEP 192:dqTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUtsXIIMQkcqgGTqc:dlhNkYjCXOJvNuarPYUtKkgI
- TLSH
  T103622A8EF65644BCF61502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  App/lib/Cryptodome.Cipher._raw_arc2.pyd
- Size 14KB
- SHA256 eda56aa3afb9d6adfd95ba950ad1247b5e2c6aedaa2db86af0c8fa79217359a4
- MD5 85f63e63df3607939b73a8dfd6e97378
- SHA1 deb83e94476794c9cf2ed39fd7952656a434ed58
- SHA512 08322adf4e0516aef6b9e42eab4e45066a20ef8a4bdb2d09354fcd4a282d9dce45f4a3d7645ab4f624e0700ba2fb9582b0ba51a7e84d57b99e1310e2118ca928
- SSDEEP 192:DG07obuccnuzHysARb0tWmn++0dmwjxs8tZcqgew3:Da6n643mo4CRJgH3
- TLSH
  T1DD621B46BA7909F4D92F8178C5F3D70CA2B87199230C9FDF0264961A2D13FE56A3E2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  App/lib/Cryptodome.Cipher._raw_blowfish.pyd
- Size 19KB
- SHA256 eea7e0597216ece6d23b351743fdc08d32a5bcde57b1efa724a3b6138b692ad9
- MD5 bcd7095ad7e4edc042d58d4ec72cea9f
- SHA1 f14b04129bf2546ffbf05cd019d59be7b644b576
- SHA512 cb36dfe191778ca41c29e14e54418dbb65b686d527049abfaebbf0d241e8cc6b3b59a9dc55d8e68aacae3d60e855f218afa7863380c7ff378070b04697b0a382
- SSDEEP 192:gXI2AcU5uMeFhK8YVfyc0u/yO0Bfx4RqI6HJAyZJg8D0KThxA+rAQE+tnJiO8qZE:/eS701RiMpJgLa0Mp8pgIO
- TLSH
  T1ED925C4DECA855BAEE200234C646CD9EE12FF534633DEBCF2770168E09166E60E747A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  App/lib/Cryptodome.Cipher._raw_cast.pyd
- Size 23KB
- SHA256 90442d012d3f918cb0f78035680db6a373148b1de7e84545e5f3596c655cd6ab
- MD5 85ef185bc09402ab82f26d77119a8c94
- SHA1 e467d442b4d918d3b5600d58b48c54553b51b374
- SHA512 eda981161c3331315261efd4420acc2b10bc677e89be04e712f3c85c355d4d8d75df3047cb94d161b43499b710f846e785f392addefbc1eaa5a21870f023bd44
- SSDEEP 384:46quf9b7Dry3YcZXmrfXA+UA10ol31tuXuewg:v9y3YqXmrXA+NNxW+e1
- TLSH
  T15AB27C65F32588EDD667C435C4135E5FE039B861332543FB0762629A1E1B7E8A83D3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  App/lib/Cryptodome.Cipher._raw_cbc.pyd
- Size 11KB
- SHA256 6c6c5fac1b5933fb857fcc3e5a87765257b5484285de147e9bb5fc854223a707
- MD5 a8cd12651f1f241e6664e92f135072e1
- SHA1 68215631fec0e3166379e30d6a7ce269fb8051f4
- SHA512 5d6cbe4493432d727d41fedfb9f8d6e189e5b7623a6b80d763e020458be465e1ab8da4d278a5e2132d14838d7145d50733707d6bc41eeda3565265641a2d5bd3
- SSDEEP 96:X4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdAqke:XJB3jD2hoeeqLO9I1oC07xlYm6tcqg9
- TLSH
  T10532184BEA258BF9D1134336C0770649AAB5BB10B38277CF0365916A2D337D2723E795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  App/lib/Cryptodome.Cipher._raw_cfb.pyd
- Size 12KB
- SHA256 26e351c4fade35c146d84df0e22c2468e01186d3a8a1e51bb6c8d8ea87f09cd7
- MD5 8c2022fc051e9dc0279a2fe507e54837
- SHA1 00218f7e094cebb0ebee037fb58eb1d0f9f4d436
- SHA512 ab886529adf84836e42a65fae89f4605d9533fa65844f8fd3bb7bfe28a2a871e685f0e1400a4b77af62f79343da11a234fe42a0554f78b779fac5919a8cba328
- SSDEEP 192:wqDWsIyXckwWdk01fdpXHgc46cqgzW0i:wqibk5tdxjVgzfi
- TLSH
  T1FD422B4AFAA989FDF4560235C4374A46A5B6B704735177CF0302819A3E33BC53B3D695
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  App/lib/Cryptodome.Cipher._raw_ctr.pyd
- Size 14KB
- SHA256 229994e4cb838079a5711c8c0ffeb25fb4684a70ecda497ddb49c8a315594a83
- MD5 c22f3989dd44fcb927f0e9b2dfe7805d
- SHA1 47bec547b0ddfd064910e8af19bb69f2602b5b01
- SHA512 62c7441be9d46df11adb4a44fd2ed4f3a29759622e3306a55c2135e7d59a06bb975766a58f424a709d7cf73f3ee64e563c15d1360dcfbbb2e56b26f1b8d7321d
- SSDEEP 192:9fiEXDMXiKEEEEEm9JdwdNuRxe7CO/vJcf30pdA4kFoxX6z3IlPrx2cqgVVv:96EXYz9JdwdNuSLvJz/A49qzYltWgr
- TLSH
  T132621A06FA545CBDF61242B8C972450D92BFB9046360BBDF0765D2962E23AC4337FAE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32