73c39c5fd582ddf8fc67b2ca4a2f383718a0f6cf0f5e705d27289a39430ad8e5

Sharing

Copy URL Twitter E-mail

General

Target
73c39c5fd582ddf8fc67b2ca4a2f383718a0f6cf0f5e705d27289a39430ad8e5
Size 8.8MB
Sample260528-blws4aew61
SHA256 73c39c5fd582ddf8fc67b2ca4a2f383718a0f6cf0f5e705d27289a39430ad8e5
MD5 4e9fad3caf6ee5b970a1a2011147974f
SHA1 da79f916770c6088643c80e653c5e1b85f20a1d8
SHA512 e6b58deb1398d1010372fedcd12cc05c1921165e01b99ef1cd50ecb35a09ffae49296eab93b40809da5275f6dc1219b9f8713d53e56a58b76361fc3314fe5f94
SSDEEP 196608:u5WfocN3TM+Gax2UCCDs1BsgcSyaKJ07BXd6R1vGGMlqF:umog3I+iSDsjslSDtQ1KlqF
TLSH
T18B9633E48418C3D3371D340847C7496C7EC0AD2FD792CF6497BA8606586DDAAA62E5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  HidSharp.dll
- Size 236KB
- SHA256 8c58e5fba22acc751032dfe97ce633e4f8a4c96089749bf316d55283b36649c2
- MD5 8d3eb299f8447b633334d1c426a2f0f7
- SHA1 8497ae75f2dd9271d9158a27250288905e8cca28
- SHA512 e1b65393bc4c338a23e31ddee7071129aa70597b651c51c07b90e6d93d5d67e45f7715e0fe034c3508df4f2196f37360b2e07969036370b0a6170b0d8627cdfa
- SSDEEP 3072:ct5N7ozr/ES/jKLCPuamzT/n3yJ/TLSIIeTnImstJr39ipdDnVnc0CK9MaCr6HGo:60zzZ/eLrJ/nkrIR3EpdnFp1MEGdZY
- TLSH
  T147348D0A9B9C8A2FDEEF07B9F43125018BF1E445E656F3AE149D98E92D53BC049013E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  LibreHardwareMonitorLib.dll
- Size 695KB
- SHA256 a0f2728f1734c236a9d02d9e25a88bc4f8cb7bd1faff1770726beb7af06bf8dc
- MD5 ca5f27a875cd921a43e054cee361432a
- SHA1 a989ad6f4d9eacdc30b31344059a57735e3c5377
- SHA512 ee2bc2983048e4ee6400f433d3b88dabf8a2b28edac1f6dc90c82868f1c1f07fafda9ec05d703f73313ed21d9c714ed1146a51e88fa04098eec4b2165547722d
- SSDEEP 6144:ccd/FoGOl5yTMIARV5pbDoGrrXyvSUb2usOLPOZHxnuvQgnAwOfMQbpWCJv2G0Hn:ro7usOftpCR14rPmM2/Gbh
- TLSH
  T1EFE459A173EC4C0BD4AF5BB554A11E1887B1B807F7B1EB1F40B4459B14A7B00EA963EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Microsoft.Bcl.AsyncInterfaces.dll
- Size 26KB
- SHA256 5dc372a10f345b1f00ec6a8fa1a2ce569f7e5d63e4f1f8631be367e46bfa34f4
- MD5 970b6e6478ae3ab699f277d77de0cd19
- SHA1 5475cb28998d419b4714343ffa9511ff46322ac2
- SHA512 f3ad2088c5d3fcb770c6d8212650eed95507e107a34f9468ca9db99defd8838443a95e0b59a5a6cb65a18ebbc529110c5348513a321b44223f537096c6d7d6e0
- SSDEEP 768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
- TLSH
  T1C6C26D16E35C5317CFBA2EF5E570D6432A35E78A2C12E72E1148E2A51C97384AB31739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 47KB
- SHA256 039155f155c5d14f5b73f4ee2cd1fbd9290f391b88a1d2a0ba815569205edb74
- MD5 37eb7cce6e282d3572d64c880e1ac3c8
- SHA1 9a2952589a19d650932e7c633577eb9afc04f959
- SHA512 e3c2ef1cc52e3aa5bd77b74dec93a4fc9e908df823426f13ca304265d41605de51970cc8c7e18c2e76319d3225707b2ea2d8613402a25c4fbd3951e70fcfd521
- SSDEEP 768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
- TLSH
  T137234D01A3FC4253DFBE2A707CF59300DF34694B7522E32A6649B095289BBC45B64BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Microsoft.WindowsAPICodePack.Shell.dll
- Size 529KB
- SHA256 e6fa9d9e34ff3bf63ce782654b14e4b54a3abd1022c87bc099032c2948157672
- MD5 54fe9a2748c4a0f282d4ec91e3cadc16
- SHA1 970b783a697d893ecd4916dd86b5ff7574896c9e
- SHA512 c7d567e3c039f98f3a99249b2d9bc2186c34efd73eec421331732d2307a8af940911381e27b015f58d0f65871bb4b038cc0f27d3fa495acd08994226bb033b7f
- SSDEEP 6144:KRAFnp++R1yj124hKX97kANqQHlWBwn9dgPan1W86b8c3v6n9c6KwZErn+LYHtA:iApI2D97kANVFWBwn9iPIL9Mwh
- TLSH
  T19AB429207BBA811BE19F477CE5F61721D7B58602B213EF0D0E8462AE2DC275645839FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Microsoft.WindowsAPICodePack.dll
- Size 102KB
- SHA256 418b5e7a96f9a6105cc6fe45896a9164e79c8849f40be23a411b5563a8e3a0d0
- MD5 9531b41519156855a45c46f0b379a784
- SHA1 00b857f09dcf0c71dab40c1a8c4c54d411fdb197
- SHA512 10034288101d235cb7af984fd6a0db11c7f56dbed648a71596b8b0c93f68d5ac5cf00be033153a91e71a311374b220507f07aa5b6e1849a80930d37a5c2577f0
- SSDEEP 3072:3BPJ2fTauHhiiWPCeOMt0ImL6HKgqYR1FliQ:3UpWPCeBHxZ
- TLSH
  T18EA3396173BC467AEAFF2F78F8255120CBB2F9862213DB1F2C94754E08927809959773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  SYSTools.Updater.exe
- Size 4.4MB
- SHA256 ac8782d04a9339a542b520c3b0c332cefc97b1648590fff7026ebd2503a8b385
- MD5 ba6bf83d41f9e1ea08d267b1cbf40539
- SHA1 89ca7b4da6113b54c05e840332683006621b48a4
- SHA512 7768ac16dc793382f8dbd51df179d4feffef4373b1534ddc2eb41b4ce582d6b56b14ee6f0afbf77c01281758d143293f2cf273e83a8327873879c8786e157b7c
- SSDEEP 98304:h4rsI/uiYIzQB/Y/sUw+p0z3VwDhM1CRkgkL1MbU3TXx4IH:h4gImgzQY/HnhZRkhL0U
- TLSH
  T11726129A3210D281E0095F3CCAD6F1F01AB16E791B458A4B6DA5BF0B35BB346CA1537F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery
behavioral13 behavioral14
- Target
  SYSTools.exe
- Size 1007KB
- SHA256 5293b544bb86a5ec3cb0fa5c513f5802ef33a36cbccab7efecd6bde04ee3889e
- MD5 6d7fb7b3e3e01d38c342db1272858e70
- SHA1 8001b6cc8ccb20450ecfb684d52603742a853edd
- SHA512 0c4f9079760fd8d15573b6005478d5d605b84a87e6489ea6542de4bc6b20d08e7258e8b509d739d8ed4a7b3b0314d96bc943086447c5002a1e7734169789605e
- SSDEEP 12288:ne2mh39N6EaNq+n7EZizdTz/fo+xZ60lRhfpALSBbYVXttyGnPfI4+1gNS3lfgj:njxE8q+nxpgLckVdEGnHI4+c
- TLSH
  T13825DF2972EDA93ED6EF6AF985B9E098CEB3625E1305C31F205BC15BE4241C14F193C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit defense_evasion discovery persistence
- Executes dropped EXE
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral15 behavioral16
- Target
  System.CodeDom.dll
- Size 29KB
- SHA256 0071a5e455bf2a4b04c3e103417aac30789cb5b5b0c99f3f078a4ec5171b93a5
- MD5 acc07f521936b011e6665a63a7bd442a
- SHA1 89b053b11d08fd0b457a2480f822a26e2b52aa85
- SHA512 69b5c6fa4b5bfe104592d1d9eaf3cf9dbedc228340372412f750f4ade1d32c65d9cc304d9701d7efdd15587246e14df83f58e41b077833d439cffaa79f987e00
- SSDEEP 384:Dxaz4VsBrLcTPWi3h8241EEtYW0u+BxehzsCtZ7U6rtk2OyavWBuWUYA6VFHRN7k:NK2hTjaveEtYehzZ5kFClYdl9zxE+l
- TLSH
  T1A6D24B6293EC4ABFEEBB0B3075B7D1D50FB5B2D22425D61E1544B40D2AD2BE04A32736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  System.Runtime.CompilerServices.Unsafe.dll
- Size 16KB
- SHA256 66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74
- MD5 da04a75ddc22118ed24e0b53e474805a
- SHA1 2d68c648a6a6371b6046e6c3af09128230e0ad32
- SHA512 26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8
- SSDEEP 192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
- TLSH
  T1CD72294A4BA80313ED736B309AA4D443FE38A7D75812D72F1985F1B91CDB7D4AF21628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  System.Threading.Tasks.Extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH
  T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  System.ValueTuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH
  T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TextCopy.dll
- Size 21KB
- SHA256 88513a0aba065dcf35d8a14b7d4d733c50cbd39536c375988fd01adea4b0f6e1
- MD5 09c55321e06b4a37652284be16c3ced5
- SHA1 caf82150cf00acdebfae457de2188b885269b564
- SHA512 f75a2d8be3b9229bf73fd077b6974a9369a6678c02e600fd52c4d1cfdfb614479dd725f0bbf027d12ca5f6d60bc0250795247ca089a0aa2f6e806f849637eac0
- SSDEEP 384:SbIAxMl1GrY3YPJtEhsPJYlGqd1KG7m/IfkEQE86wEPcDGam:eLMfSvP0sJovXiIwzN0cDGR
- TLSH
  T1D4A27C08E7C40133D6EF3B3C6CB727048BB0D9555D26EFAF0C9DA8595A6B74019193A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  en/SYSTools.resources.dll
- Size 12KB
- SHA256 78a67d93f79f98af7225a96bf9d75539b2d21a6b852cef124eeb518ba699aaf0
- MD5 1d1766facb65ad74b072921e674de67d
- SHA1 1eb50104c4585e89c18f94b2af284d8e3ae45480
- SHA512 e081d3be9a4fe6a8e96b9b56c26b6f646b51b001e9b8ad051065f402117473d6903c8bfa876bb6649afe8287882396e4788977b17c2e092f7e0ebeb3ad5bd7bd
- SSDEEP 192:hRWq8R5thTS+WAV/xi3N5vpi1ziE7arqzpNgfjbSMK3It8DVk0Ii:bWqES+dVuNvBzrqtNySt3Iih6i
- TLSH
  T1C442A303A7F91A2CF5B36F357AB689106976FE566E01D40F0148114E2A76B90CE72B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  iNKORE.UI.WPF.Modern.Controls.dll
- Size 2.2MB
- SHA256 cfb7d56af4c8bdfbd3e66f9f9b556ba4d41c9bb29ce34178aef9d69bccf0cb57
- MD5 d0cabb0296c3ab18bec26cc434be95a2
- SHA1 42676787e869b42757b54356b56a95d69c442147
- SHA512 b3d62f8ef92481e3dce570cfe632cd837f92a8fcc0f74eda906fbcd089d050d3f9442b3abd50546fb301b2cd65541d8793fbd030ebf87be04dcf6a34415095b9
- SSDEEP 24576:a/6urMdB/lOaZauaQJ2F3Kd9AAmi7la1zNHFzd9y5sKtU:a/6dhlqKPAAmi7lubSXtU
- TLSH
  T19CB53A1233FC0179F1BB2B36A4B566985637FD228AA1D66F5441262E1DF27028FD1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  iNKORE.UI.WPF.Modern.dll
- Size 7.2MB
- SHA256 45a545832070917a09b7d47e091c2c19a904edd37333e745bfb053f39540a775
- MD5 845a732edf60c06ca05fcf6d9ca7f421
- SHA1 884cb0ee4018a851a5683040b85f7b264a9a37fc
- SHA512 0cb87df123156d8c9c75638f73a01b752e74b20958f0379992521361275461f4d001a65b518feead008b92fdd204d6c1df6f879f16db40d931df3cf0539e74d8
- SSDEEP 98304:MLON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7lVFk0:MLO9oNdvPpA
- TLSH
  T17F766B6E17ED0D32D3A392FA9CB077210C65A87E3141EB8B6F8B5B1D54290C48DF16A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Power Settings

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32