3c3a2f020d5e053514eefa30dde49e596b857edef6971b655bdfd09af504b0f6

Sharing

Copy URL Twitter E-mail

General

Target
Wireshark-4.6.5-x64.exe
Size 100.1MB
Sample260505-dmaclabw8j
SHA256 3c3a2f020d5e053514eefa30dde49e596b857edef6971b655bdfd09af504b0f6
MD5 0991d8d71103edfa4b2ab85296be18c8
SHA1 1fb75783206e5ba13888a3b7964b0475eb91242c
SHA512 3fe3c0b3d488b749a01a88bfe2321ed5f52e71577d4bf106427c1fbbdf108ccecc09a118cb5ddf0a847dc57f6ddfe2c6293308f2ee7e38b5a27b43d0732d6045
SSDEEP 1572864:dz5LwsCzXrRg3OJL/GD0BvuSBMyZMdWbstTpBCigjT1lg7Yir11gV:dFLGzbRbL/GSuSBCZ9pYigjTUr8V
TLSH
T1EA38336172C3E254CF90803B4856F37E60FF1FA9BB686101AACABBC371B8955D8B115D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Wireshark-4.6.5-x64.exe
- Size 100.1MB
- SHA256 3c3a2f020d5e053514eefa30dde49e596b857edef6971b655bdfd09af504b0f6
- MD5 0991d8d71103edfa4b2ab85296be18c8
- SHA1 1fb75783206e5ba13888a3b7964b0475eb91242c
- SHA512 3fe3c0b3d488b749a01a88bfe2321ed5f52e71577d4bf106427c1fbbdf108ccecc09a118cb5ddf0a847dc57f6ddfe2c6293308f2ee7e38b5a27b43d0732d6045
- SSDEEP 1572864:dz5LwsCzXrRg3OJL/GD0BvuSBMyZMdWbstTpBCigjT1lg7Yir11gV:dFLGzbRbL/GSuSBCZ9pYigjTUr8V
- TLSH
  T1EA38336172C3E254CF90803B4856F37E60FF1FA9BB686101AACABBC371B8955D8B115D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Qt6Core.dll
- Size 9.8MB
- SHA256 a92bcc0621276ae4ca9170337e1b634014b1d476dc4623234e5c858d5d967fab
- MD5 a5201ff6ff69a3b029d7c8f483d418ac
- SHA1 7a3acfa58ff09f7f18abebbb9265ac0c61742a91
- SHA512 fe025c14ca3d7fa0fb4765717ad8925117d6c89aae09197f1247306f4edac31fe016b8f50482eb9978fb40d2f698a140a0a873a5a0e34c3e215765807eba9aa6
- SSDEEP 98304:u7ULMekqCZDPAlKFdu9CwJsv6tMYdJMS2r/38:uxoKFdu9CwJsv6tMeSSa/3
- TLSH
  T170A639036AFA0102FAFBDA34DAB71252DBB27C46673596DF025461185D337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Qt6Core5Compat.dll
- Size 857KB
- SHA256 50852b240fe9d306119859321632a64b8b4268fa64aa01fbd0e31d8a2bcc2ce4
- MD5 1e009e223f8c74604f481df8927a1da7
- SHA1 97bbd6373f5c7988b8ec84a4d844bde396130fed
- SHA512 dd717fd529a64fc0a70b914635f232782c7369e69876a31b63c70c7c9a231f8a86d6497141f5772337f5eb5335baf4f9b75ebcb81a729b77900f45ac434c7b8c
- SSDEEP 12288:9jAnM4mR8zu/r5hBdXvPGE/4717VKIxBDPzHkSrGGEfvrfLO6p:j4Aj/r5hjG7VRDPTwXfLrp
- TLSH
  T1B315BE7772A80956F16BC03DCBA3A913D7B73016536286EFA66087077E63BF1297C211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Qt6Gui.dll
- Size 9.1MB
- SHA256 dd020850a4f593f3626ea3c13a1043790b7cd1f58211aecbe0cbdedadbf3f5d9
- MD5 09a72831098b0006d0dccb0c231aab30
- SHA1 c653c4c859e3485fea3ce26d181d8fc4fc354410
- SHA512 607b46420ab8b9ba1bd7404a90e4be6c011b20401f27e69d3a5c2ddf37a32f2761d68133291a03638cb198e901d61b101f61abd498bd4741a1f12dc285bb2b36
- SSDEEP 98304:4LWJ76kJHgTZg+ZC/PVqGJ6Q/Sx5kPthKMG5bpZa5M2EXU:bFHg9g+0YQ/Sx5kPXK38z
- TLSH
  T113A68D57B2A911D8D57BD13C8B9B9507EBB2700503629BDB01A4CA562F33BF12ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Qt6Multimedia.dll
- Size 1.2MB
- SHA256 6da21f888cedc1cd60235368f1e9cf94b0823e05630d4864e3f3049f79428abb
- MD5 d91fa351f970ccf27df13c7befcc395a
- SHA1 f5bf212bca5d5438874f491ee83023fe7a7f5d4c
- SHA512 d37dd5a1ab0600ca8013801452d2f4e6848902910d4bfd28c3c8e2075999eb90d776854fe2e21f2bcf1b3977994c97002bdd66f19d61af8083cff487adcf4388
- SSDEEP 12288:nO8y5eo5K9Kqtc0SU1Y7qZzQpl0BZ8+Wb6+8wC97lg6WET:nhyeo5K8Ev1Y2ZspU7w47l5
- TLSH
  T1F0459D5BF79441DAC46BD13DDAA78A16E7B2B0141302CBCB12628A0A2F77BD11F7D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Qt6Network.dll
- Size 1.7MB
- SHA256 76b4bd9fb344fe60f86dae73e59e29c5ec6df8a91b2169faebeed54a3d02c95f
- MD5 6b8a94b1d9fa023ec7c912719db572ec
- SHA1 2da848d3f62a93375472515ecafc551fa80ea94f
- SHA512 0a9ffba075b8eaf6d0289ceab9f913222401344d4a6c6f5b79d0fb2dfad02e90610d1a8e21c913232b2a38cdb183226e56f3e258ee8057ae40aa07207f71e298
- SSDEEP 24576:BaNBuUZQb0e9m8EPrcoEuyRhOaUVhYpflc9j:Ban5Qb0e9REP4fu+UYQ9
- TLSH
  T106857C57A3A442D5D96EC27DCB4B8A0BE772700543669BDF02648E152F73BE21B3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Qt6PrintSupport.dll
- Size 399KB
- SHA256 74697535822c1cd547b1f80f8e01f5c08e6436ce1aee00129fc764cf2c68cdcb
- MD5 fe3a97e34d2f463418d7630810ff2994
- SHA1 38c30e0f0f5c8200f27ac7345230be8ae4949172
- SHA512 710778f4183c5210b2c0c0a5394cd862e95849df4b1e5da9b6e1d2ed749c266872376223b4a2d586cb8c1992876bec269e107f6ce0797c1e8c82ae6553cfe33e
- SSDEEP 6144:0X3Mtg6igp6Uq1rYzOGhyDa11KnW+3A2Bqa5sGc4rZHYGpxgiWbMEbN3PBH5AYlu:0X3N6icBqkOGhyDe0WFW
- TLSH
  T1E8942887FE660181DC5AD23C8A7B8516D173B0D90363C7CF022E9A09AE6B7E1797D394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Qt6Svg.dll
- Size 620KB
- SHA256 062e4e68a6d44aeb0b00a37bc158f1b3dc3ac5d8c774ed4997ed869a973a5b72
- MD5 b8256d6f2f94e6ddee9ef6d94fd21b3a
- SHA1 14898ce54c41f98e80b6ec9897e73996732c7eb7
- SHA512 a7837c4d814d420ffe588b9d13d630d41bafbd66f76f1504ff02529e3e8559fed2c26ec38deb9cac2a9a3d538984391b91fac30cb97c2333c2b0e624bfe8cd31
- SSDEEP 6144:P6HNycivcATzSTN7xMeheA74qaBaj7TfAAgutn2ru0Gf+crP8Sx5Yj7yEA3+ITIW:P6HNbibzqfq4j7TtNQuR+cvB5/W
- TLSH
  T155D45C57B3A60786D86AD13CCB5B8423EB73704403A2D7EF41A58A552F23BE16B7D360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Qt6Widgets.dll
- Size 6.3MB
- SHA256 381e2dfdf2cc08f4b98e9f8854dbb2bba87f28bc8b6b9bd470548bcf201fe325
- MD5 100405ade156184185f61265657cec4c
- SHA1 851eb2890a995065f3503f26d4b136d68f981b02
- SHA512 bbc9fa860d620e157c5b7f573f8c857590a732346e95ab1e2c68c622bc42f3f76c1a0bd8272e879b7b7ff226cdd222388d9d10ca237dfdfcb4ef2264ab32b5a2
- SSDEEP 49152://jhOtxRzXn31a0R+oiSl8U7jtRtzX1s3e8fCTjjvDsXjnq7TADWVb/G5ImjNyzN:yRNj5zX9jrNkwqZjSayK6gckA7/HTHa
- TLSH
  T1F0666B57A3EA0195C4ABD17DCB0B8A17E7B2700443229BCB11698E592F737F12E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  USBPcapSetup-1.5.4.0.exe
- Size 190KB
- SHA256 87a7edf9bbbcf07b5f4373d9a192a6770d2ff3add7aa1e276e82e38582ccb622
- MD5 93c9b5098b1d42c53c7bdd68fe9cd6cf
- SHA1 ccfb1497abed432844ad972dea65853dd0e7cba1
- SHA512 dc6b84d0784ae36941615565ff21e8634bf36e3efdaff598d470035157a2f148cd1f10031504476f821cd0ce0180c61ee9fe6a7bd0beb3721c4b1c738f61fef1
- SSDEEP 3072:PQZmPYFFiorvcQNpDjrc5nMDi93g6HC+0vaiFxMv6mwSARrwPKVvbygEXoHApLG6:PQLFhJXrcVMDcgoCtswShkTAoRA9
- TLSH
  T14D14025A23E1C0A3D797063098F66637BEF5E2100152691F63B0A6673E872568F5B1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
behavioral13
- Target
  WinSparkle.dll
- Size 2.4MB
- SHA256 e35f36cf75c0cf10db721205a6af40e13447371851de169d796ecdda70fa2ed0
- MD5 250f4cb584c1e0f832312a2b7a5fe3c9
- SHA1 77bcbe283ac309a3c1171e14e3f8323e6108d3b1
- SHA512 97db30734931e6db8caab947703cdd6ec04131b25023dd4aa25362148c443a6978eb6601db4d5de7caa0d633370a26a061257920bbd057512043e11deb36a14d
- SSDEEP 49152:gXfRcalA7wchHjSjSrb3cAAutEWWP6QzylkwA:ocaPS/ZltEf45
- TLSH
  T1ABB58E0BF6A441BEE4ABD27CC917AA06E7B2B8570270E34F11D049AE5F533654EDE321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Wireshark Release Notes.html
- Size 42KB
- SHA256 e4ad12a2c95e429c0f02ee8825b908b10c358419fec27302b7819de60ad57746
- MD5 22c895e973700b66d60ff8309e40aceb
- SHA1 c1d6c729cf8ec79ca1080df8958fb525bf399373
- SHA512 44c010897021bafacdcd6427c3779b81d53eff670e94b3a7ecbca2c87b7478261f50d3f604a71dde94e7c36fe2ac8494e3a2e9d0c70dc863a8bbb9951e8cbda3
- SSDEEP 384:SrSZ2K6EigLdcUpjyLFNI16+G6sYsEN+YWGImpHo4:i7gL2fNI8+Q5E3pI4
- TLSH
  T1781322BBA4C0727A0B878A73BF3ABD7C5A1305EA8DD1362D51F38624F8445B24D41D7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral15
- Target
  Wireshark.exe
- Size 20.2MB
- SHA256 9457a3c3246b0fb825ad4a20ea68712f61773eca66b2d1c1bba8ba5688a8c483
- MD5 3b13dd4c0d5fea0c6953ffc38cd8c01c
- SHA1 abcdda28bf824c9803c5d1ca4c1bcca8c1df5e4b
- SHA512 1a03cbbc00c906d9ef1d7f39b4e8dd125b6271f9236589f83213ce60d0c72e9b1499945021409abb2342d987a8fabcc2fff05fc4c4291950a54129ad4433f145
- SSDEEP 393216:NXvJkxbCjjCkuXML1TOPZPBFAVbl4G/XtShtFA:NxcCjjCk3L1C1BWwtK
- TLSH
  T18327CF5F22A402D1F13AC0BDC7CB8E47E6B1341A83555ADB0565D69E0F3BFE8487AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  avcodec-61.dll
- Size 13.3MB
- SHA256 abffb4c5c8f69f020ece699c978c5dade20f2db40c98a903d73bd4edb12b112f
- MD5 cb7569aa632acc60ee239b6f79316f61
- SHA1 e2ee1ab2c059478a465b0c69b7c446e0ea6fd97e
- SHA512 de230dbc18c8d175097cc8a5876e14becf6f23829f206352cccf11c99d58e3d06822cb78f1afcd4414379be9a0f8fe2a7c9e97644f5872794a08ac9036dbc34e
- SSDEEP 196608:RKOZyR5ZDyMOAAmMxFNUNTlC+77/2f42f7pd:hZi5DORmlB7/2f42F
- TLSH
  T1BEE6BF46F2A211D8D57BC034C667AB0BFB6534BD03506AF75691AAB43F73BE05A3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  avformat-61.dll
- Size 2.5MB
- SHA256 8e6a4ba5b5919465b40df99cb5f47a5f25c03493ce269c7da19434cc48604c33
- MD5 7b2a8fed40b8319311a91bb9e13ae48f
- SHA1 207b617d06e8921292e4333349f75c09d4831ad4
- SHA512 ca186884673cf3cee58a422cf6e30b8185dd68e36e90b10e9ee890ad355ac7a5d5731c337d416dd589a7a18fb2e3a1d61487bce1b832f517abd1d542ba0bfb2a
- SSDEEP 49152:Rv1oUBbg0IaUcUXF8DbnCjHDNIOAZbG3zs3FO0IJL98p05h:XdPUcUUbndOia
- TLSH
  T1D1C59D87A3B510A9C5BBC178C6575707EBF1B4151320ABEB06A08A792F63FF1663B311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  avutil-59.dll
- Size 1.1MB
- SHA256 da006c8b32edeb31b0fcdbe4ba2735648dca563d2418a990b804a16c0e2c1353
- MD5 8881b796ecb421fce9c80b13d2f46868
- SHA1 ca01bd10d855b4bdcf3d1ac54866f74dcbb984d1
- SHA512 b34517a3fead50c60e493b32d4587401db234af953ae55c7a8f1ff4eb3384b5549704fcce154ce92f1262a3775d0869a395876477d1a2c97856e6e15c34adc60
- SSDEEP 24576:HDwuT+iLgt4qEuoZMyJYnGgILOK8POpe:HUOVLgt4qIZMyJUIn
- TLSH
  T19B457D4596E104B6C86A4534D267954AF2723412C760BAFF23E14A683F23FD21DBFB36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  brotlicommon.dll
- Size 148KB
- SHA256 9f5fedce83c2c98749e1496e3d0a0fc0953db1a1e0548897beed3a25c9f077f1
- MD5 e27a66b509d2e607e69bb97debaea421
- SHA1 df35382fec832620e9004cca73991be07eea6c0f
- SHA512 90f6ec7a577af99567439332171401d286f3afc5b4268c2b1122e14f283e207ded7585f2c3c110cbb0dcfbdb627cf5d6145247096c1f4a8f6572cd7ce14c7f81
- SSDEEP 3072:Vjk4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBSzT:Vjk4AhdNorGvHdbi09GJIH
- TLSH
  T136E38DA1B3150337C25B227AE499ABB9F33582B593630551B4A9026D20C3DE4973F7FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  brotlidec.dll
- Size 64KB
- SHA256 047323d7284e7dca1859253fde699e2d3a1e1e9af5877305818e61de1d436d3f
- MD5 7bb6fee66efd98fc98696b8764695531
- SHA1 3c2626b24970ce6d1c6a364407ee3629238d05e0
- SHA512 466c1ae1770e4c208b9ca8de818172b5c781ce372d6457b8bacc5829414e1dc94bd249e0ac4257952677d59e63f4fa888bf820675fded10480415bda93d16440
- SSDEEP 768:li22J2umqzaNLlJNYpyh6ADc23V8YylazQxARbYs3Mg31sPuBL2Ip4ACCTxf1mlM:lyReNEyh6oz3V8YyGj1/i9HafIkF
- TLSH
  T183538D8266A5494EED13C138C3B7E29BE3BAB49B6384A7FB71A0F5201F137E06375154
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  bz2.dll
- Size 88KB
- SHA256 ef43f451b3b16ffdc77d4b7537cb86db65a4cf6e2c1a6932ab6e4d3787e9c5de
- MD5 42f15a07fa2962651b4f6658bc127db2
- SHA1 6244bdf8c44f2b402b5ff0666ffb76cde35f8373
- SHA512 0f93f960502a2ff796d7f07ea838563052294468563b93ad883075669636d6c251b3f891be5d6355af32077c46751d865800ee95e2c6669b83992975c3db8561
- SSDEEP 1536:Q1uS1dcv95FBSQhLHNUgViZ/273Dd96lrD0XO7vE8i/i9tfILy+:8khHNJ8p2r8r2O7vX0B
- TLSH
  T1A2936C4576A7AB7DC99B853846A3064BEB35FE780B5007FF20A0967A1B13BD10FB8215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  cares.dll
- Size 209KB
- SHA256 94548a788d9d78273b1cadc2c81b19571a7a38c85037dceacf2317b4733bc611
- MD5 0ddf3f5368a40a6b0afb05d34f5d3a80
- SHA1 dd2d022a550185586c5b97b74d15fecd54fe13e7
- SHA512 afe0a6397bded5d59cb5d032df8819d62b2d055cfeb7241eb60098a0854b0ff1ba6059ab607174a8e5db92abd377b258ce0479ac411036c69aae029812448c7a
- SSDEEP 6144:lk6R5/ZMP4VBVP+R+Us9vqkt1e+z7HBKG9Pnvetw:lkuZMPu2+UmvfK
- TLSH
  T1C2244C5772E40079E567D13CC996A617E2B2B05137209BDF17A08BFA2B13EE7663E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  charset-1.dll
- Size 25KB
- SHA256 680b6938698cbbaf6edb7ede4639e87c421a7e43c07b3e83082abd919fd47dc1
- MD5 9443f8a06b29eb24997f3a0f240bdf16
- SHA1 f8a01bf5129eb96d979e8adc7646b0c554da84dc
- SHA512 94c623faf156d86ae69d3581c4106d8175412a805529a5af5cc2a51b24e60827e5342493253ff7fc39b0ba94c189230db82ccef064b4ea3104277000aba41490
- SSDEEP 384:B2tyXY7vY5L7Vp8Upw9rjMW3cPuByqX2Ip4LX9TjdAA1m5wMI6ucKZAlRPmtE:47A5L7nxwsPuBL2Ip4xTxf1mlIJ0lCE
- TLSH
  T133C27DDEA92880A7EE174A71C5E1ED87F57CF7E329619BAB11B1A1400C533C2B31E16C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  comerr64.dll
- Size 34KB
- SHA256 ffc7ed60452ec282af3679169a8fe30c2d8cf15f201147a52d317420a020e42c
- MD5 e0b6e84854312534ed12488bca3ddbac
- SHA1 ec199325264a24219bdbb9aa7fd8ecd2b6803e1f
- SHA512 9704446e260a6003a1504fa73ec672e04c16102c4bfb2a533e067cbfaec59ecbcbfae0150d06e6a8d8691a890601d08b8f3d1cec82f93f2c78642b035443f0a0
- SSDEEP 768:/2hzcePwoExG4/nMRsPuBL2Ip4f+Txf1ml9dH9jLd7s:/2hzVPYl/MR/i9GfIbH9v2
- TLSH
  T1BEF25BCA679412D2EAB6A934D1F1AA67F43077939B3243CF165158590E32BC1EB3CF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  dumpcap.exe
- Size 549KB
- SHA256 daaaa71f6d72f5b8ee7801df3d5db6d10e1260a9042cf0454c21afc5e1754e8b
- MD5 6ddc2d4a75d913def01e5fb3d6facb02
- SHA1 b56e8bc629af5c5a83830ac082f7cf17cf4a7237
- SHA512 1164dc346e29c61c5f5a76e922eff35a69b078a66e678cbed8d6c0129caa7ee92255c11cd395987e016763423c1d2650ad681b1f54bd05c7cff63a879ad6c49a
- SSDEEP 12288:9U1vgXytMWOdSiDjsAzjnOqgpFjWqsjFP9:+1cy9OsiXsAzjOqgpF6q8B
- TLSH
  T13DC4299437C4D9E2DEA1113A8003B375A1B36EEC57A0A1CFBB5CB70637339D865BA158
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  dumpcap.html
- Size 30KB
- SHA256 eb58e16006d58688f340a6b60afacfd400bff12e9800b09557d420dfb8b8a6f3
- MD5 c5d4c05fe98b89c6cf213bd98f49f043
- SHA1 cebe9709bdbc34de2537171114d7cb091b50c626
- SHA512 a65551ac2cff48fafbe730415cfdd6b2a6819d994bc88eac8334d21aa8559385b69fc1646f4ce093aff39d07d295affd676385eadb4d2322e9968bae7df92b0c
- SSDEEP 768:IyJVW4NALj3SBgYQTnu+Oz28wasYwVKiI:hW4NAPSBgYQru+Oz29as1I
- TLSH
  T19DE2441AA54153B70CE222D1B2382FAFF75595ACF5E725C821EFC3B42341CA2D5BAD90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral27
- Target
  dxcompiler.dll
- Size 13.7MB
- SHA256 8c09c78acdf1a40f9d17e1e6cac4d5c2a355b9eaac52f685d27653953cdcd757
- MD5 a78a6cfd0ed724233a6d2077ee855474
- SHA1 f21f299b4c8157ccd5287284aa3ab07a56651248
- SHA512 18156a0a47379b0fffa2125da166478417482f3fdc2fdcb402c8ccc8a82b1506e5e5787c313c33ffd8a4cc11adf7ef071d54402f787502345b045393ecfe3f5e
- SSDEEP 196608:o1qA9hLWHX4eSSgewvFmEGdNdKjcjftN9CVexNcpLQ:oYA9hLWHXJS7ewvFmEGdNccHAkxNOLQ
- TLSH
  T15DE69D6921AC01E9D4BFD074CA178D17FBF2B46213B0AB8B06B406A62F677B1563F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  dxil.dll
- Size 1.4MB
- SHA256 f8e18982534386b52b4483cccf405ce9e6c1a4ad1855eab65db42cae66fcd479
- MD5 376c486c2482fae4db13beb09ae8d94a
- SHA1 555b94d7128beb1f7aa1c275f3638e47fd1f5627
- SHA512 bf876155b13656ea6fca26dfe2a8a34f5bc9f796c601ca5fcddc938c442ade3d5229c7131b42dc3fd91ca63cf319333dab1d7d165e6b6bd9738a7fc5e203340a
- SSDEEP 24576:bCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrY:bCfhbh3v3mtEAQrW41obCraeRhy9ou6y
- TLSH
  T1F0658D1B229801B5D4BBD178DE578E07E6B2B41503B09BCF12F006A62F2BBF55A7E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  extcap.html
- Size 10KB
- SHA256 060c11c999b510bac0fae491ea1e1e59f03985e23285e5383a5f508af2a8751c
- MD5 a3e3e86a1b918109391e712a233ca7f5
- SHA1 408c39c9ec18c325b7ff9336bf94333170f03469
- SHA512 bbeea3bdf3694cfa6c72e709f3fa064e7dff49fb612279498122bbaa8d2f952fed098f3d3258e2ef860157cae732d269bc1d7bc4d537190b41493f31226085a4
- SSDEEP 192:vUL8i2xjZgel9sNsDnx/6cqXpuxAX4ikKFa1a4An0kOhZiE:vUr2lZHl9H8X4j5qBVE
- TLSH
  T142227423A440137305C382C0BB7A2FABF6A5DA28F86724DC95F943984783DD7C5EA5A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral30
- Target
  generic/qtuiotouchplugin.dll
- Size 102KB
- SHA256 fcc146daa9ddd0482ebdf1246bc144956400bda91114556866e09466bcc812ce
- MD5 ba3cb5e8b140ba03e9a2a6cccc73eea0
- SHA1 4742cdd9962d41d164124f5b70efd38c22dbe212
- SHA512 5d71008519491a50df0e3fd10e3815364d399c58e41f9108cc324d9fbeaa478291736cdb103980e8684c03d2675c2b86430b0f114d25ecb5cef37ef41a3f75ae
- SSDEEP 3072:aQE90V6rxM8EX8F84Df5qdd95lQoiaobk:anmyM8dyiao
- TLSH
  T1FDA35BBB52A042D6D96AD279C79A8507F332B19517319FDF02A496490F33BE21F3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  glib-2.0-0.dll
- Size 1.3MB
- SHA256 670c8b2ced449020fb7b31b038b0dfb523bf88b56b1736a6bc023656d579096b
- MD5 050f03f148e3666f30c1b6d344201616
- SHA1 911758f99f89caa9364104c6b85c36e5eb2bb8d0
- SHA512 5a7f28a7a56ed7361b9e590c73b65b846624cc39f1595d5e315b3f0165dc21ce0a1cec8bbbff25e76032518ab7c2821acf27ca92e37af34e1619e9fc5128b6bf
- SSDEEP 24576:G6a8+4WtiJaW49FkgUiKFhGce5elUmjC2kvd5ItR4npgeOtvQ8P:G6f+4Wqaf9FkRioGce5elUmDkvd5S40R
- TLSH
  T1A255498AB24574A7FB96DC3884E29353D27071140F7355EB2F6CC6291A2FAE7127AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks for common network interception software

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Manipulates Digital Signatures

Adds Run key to start application

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

Drops file in Drivers directory

Adds Run key to start application

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32