0baded16e75d5719fd131507c053aa6d89340e79475eaaa7d51fedd2c0c388c3

Sharing

Copy URL Twitter E-mail

General

Target
Genious-Bootp2.7z
Size 7.1MB
Sample260605-qs772agy2y
SHA256 0baded16e75d5719fd131507c053aa6d89340e79475eaaa7d51fedd2c0c388c3
MD5 80153fc32dfc3f1ff3da2335e6a08694
SHA1 4740f35483cbc5b318c0b1125167f42cc96901c3
SHA512 fc3af4f15d18f0aa025d8e639593d2e4a9dfdf82a2b677dd20c64bc85359e633b27eb598240c76ad02601da4cb11a36ad92cc72bb764fc7207f53ee9564758cc
SSDEEP 196608:5W+ufDIm5x3BBU4RKw2F5Cf08j3EuE3sm9Zc/wlFGPMOE:5W+eDV7RW4Rn2efNj3iLFFGc
TLSH
T1E17633EB874819F3C268CFBEB4F7555F40AF6424126E56CD240FE8FE691887980A3467
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Genious-Bootp2/Boot-GeniusV2.exe
- Size 3.5MB
- SHA256 8ae52304c2e1bc207f5f71b3a53432b7653974253a353b3ad79427b21a3470bf
- MD5 82c4f0610a87a17f675f958975bcb811
- SHA1 4246bdc1fe4afe44a45f57e2a6854dce8537c1d9
- SHA512 f5c8682695f319f0aa9761837be3ab93b46bdb85fb89e1bac8eb7c2028640d90926f971400b291ea4dc32989aafc5adb52db8e794be4e2bc4baf7822240745cd
- SSDEEP 49152:Ly23cLtSsrre4mWZjvrqtNoVi3HnyXDMgihziFhSE+LND3mO6wnvxlS:LOjFiXny4gihziFh6LNgwa
- TLSH
  T14D067B437CE004ECD495B73154B27A92B725B8441B3A2BC32FA25EB52E76BD02D3735A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Genious-Bootp2/local_bin/EqualizerAPO.dll
- Size 599KB
- SHA256 2cb094f9a14dad89d9acf29fae4b6e036d8896b7e8eac52d010248a31006fb1d
- MD5 3f96577baa37bf625bb350776a91296b
- SHA1 cb9150ed61774b428ee3c55b7ab61be62baa8e8a
- SHA512 62fe6ead155c9a176fe90bc2bbb848e9afa7d760add8b2d5e5ea1522997cc05c83d138ed1281d4c047599363f1658117070b85e425b4f3df3afee86bcd1a8e6d
- SSDEEP 12288:3ruD49udWGn9SNMbrS456F+upz31+s5TiaN0a:3ruD4sdzt3p3o71LTiaNR
- TLSH
  T12BD41906A2A903A8D0BBD27C8AA79912F7B678050775D6CF1391426B1F23BD1DF3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  Genious-Bootp2/local_bin/Qt5Core.dll
- Size 5.7MB
- SHA256 872a148e5fecf7df77231f68ad10d739cfc7c06cc2c04666b641529750dde991
- MD5 2f187bf96f7900698d8be13f55b295c9
- SHA1 8fda0e7b9e9d5eff146477f47c7e0fcc9c18d24e
- SHA512 f78d34aa2ee638025b7dd9fb14cb6f275bbeb9225915954b0c0d50dd7c59dd19841fffabd3de879c4b8e5b6ef4892a25a9558773e4b98b73d52af2d43ccfce38
- SSDEEP 98304:Fh2mYpTb+mDZZKQkJsv6tWKFdu9C2idxqf/gw:z2mYpTb+mDbhkJsv6tWKFdu9C2Mxqf/F
- TLSH
  T13F569D57B6A70150D0B6C23CC9A7821BE6B3B81287228ADF425CA70A5F777F1293F715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Genious-Bootp2/local_bin/libfftw3f-3.dll
- Size 2.6MB
- SHA256 42ca18fff35dd12890e04478bc990005b3969cb744f6843976bd436ccd7f0a4c
- MD5 9bc1a19ef7fafb31b43a964895ed9dcb
- SHA1 4e9eccb805eb876177a6b3a42f912ac52e9f20d2
- SHA512 72c5bc879c8869f0d3c00dc32f9187b267969948e5b578ac1a86af8c83d7126297eb9a7958d6da156a5f348aaca60bee0822c5416c17240cc8850dc2cadc2d8e
- SSDEEP 49152:ZbVolI4xMje7CLVUnHQl1Wv+sKwh14RT9Z04TMzYr1ZBXwD2idL:3o+0ae7GQ+5XZidL
- TLSH
  T11AD54A41B6ECCCDAF43E683091FAFA2B77257941490A479753A095AC1F637C02FE5A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Genious-Bootp2/local_bin/libsndfile-1.dll
- Size 1.7MB
- SHA256 740dc79589813c83f5a6b8ea214b5c1031041881b4dc96703e295a7c04d09f5b
- MD5 ab078f3f6241fddfd39637d7b9358834
- SHA1 c895b2555e99a34bed57ecaa328c56bda4481b3b
- SHA512 f5646ce0255ae551308c6861447c39deade07f775ff33526bdc58e22a90132cae86ac44767b2b83c07633f54f8b516e06e2efdce75de98d9a0fa530d6e581d78
- SSDEEP 49152:gmYf13JE1o6kK5eQnahfzNqTBboLTfKIK15sRcRcQQQkixzjYz:gNJELapfJq6b
- TLSH
  T185851827D653AC6FC3F681704642EA727830FC6DD3726ABB298066B13F529305F5AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Genious-Bootp2/local_bin/msvcp140.dll
- Size 552KB
- SHA256 256492fbbcf3dc63987318f83e5f49eaacdbb6a9a5be54e403f0ddb437582881
- MD5 111e00ce3412a863ddf3db65f237d62b
- SHA1 58503f051d650d0d95ea36515682afce18f504af
- SHA512 d586b8c2ee928aeed5e1e9f771dea24d209e09a47c8e84821ad0a5976e5fa16b77a04294100555f553aea85c5acdcfe49ad3aff6f645b5618fa8f482fcdb959b
- SSDEEP 12288:F/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zNyVQEKZm+jWodm:ZN59IW6zN+QEKZm+jWodEEY
- TLSH
  T1A3C40923B75D05E0E195A3B8A1838305D7F17C4A8312A3C792FB96AD2F673D56B3B190
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Genious-Bootp2/local_bin/msvcp140_1.dll
- Size 23KB
- SHA256 2c03cf78553689ca0523a3ef7c3161939b8f4a2fe246d9e90efa9cfef95c59a7
- MD5 6d0a35401a239a046dc2a43777b01a30
- SHA1 0d7070f9abaa911f636cad4f0d5bf8a3445a9e6e
- SHA512 9554ffb6d87aa25bc80bc56ddc46a5f310fe0cdbd4dd1ba412c58c4f103be55bd96dc76652c39865f662118df5853fc3d2886a7c02b4e156eb31d5abd7f1cc59
- SSDEEP 384:IXt9apR9zFzN2WWcZ5gWc/14gHRN7eDH24rlGs8:IXK79zFzEqQeT6
- TLSH
  T1F2B24B86FB284843F866543082A6DE07BA3DB3D59B2193DF1361E75D0DE37C1AA35A18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Genious-Bootp2/local_bin/temp/d3dcompiler_47.dll
- Size 3.3MB
- SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
- MD5 c5b362bce86bb0ad3149c4540201331d
- SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
- SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
- SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
- TLSH
  T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Genious-Bootp2/local_bin/temp/libGLESv2.dll
- Size 7.6MB
- SHA256 68d56f1681840e5f87e1b06c47a82887d9a147dcfc8de9c1f9a778f3370014de
- MD5 a536c452920e0d95c5cd8cd187ca3e65
- SHA1 c33974d8def318317615f9714ee175e0dbd80661
- SHA512 959c81d2ce72b498aecc96f07666461c6b59f4e0c6113b5118b5e1cd727e8e9370a29a07595516066b83b70c43e4d1ac62b87545ec708019aceee3b7e3657258
- SSDEEP 98304:5nlbXzhGP2sAjc8pjCT1VNpv0RCw+MGIuRStSVoYewueeNygIc73ECclRI:5nlLzhGP2sg75CpVNpv0RCAuRStSVEz
- TLSH
  T160860B46EE474CF2DCD33775B197B32E9A25AC30892BC6E7DE458224D9A31C12C26B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Genious-Bootp2/presets/DDSPreview.py
- Size 17KB
- SHA256 a5fc7f2959b2ec55ded0ab8164c2fd16531dbdc394c33c0adb0a4b7de169e253
- MD5 7443cbda06135e84f3d6045c7333b8c7
- SHA1 f20e1c8fa3ddb7d34a199a6a079a7760f605ef6f
- SHA512 ad06d00f6574f5e6538aea0a7c295920f679ce3cf69241b6ce6266c6c6090eb70ccb0057fe934bec541bad1c6c7a0f7e7fcad3bafd67d73655e61f048528f588
- SSDEEP 192:306/66i86vi6Ph6k20f7CA0pQMSYautfwS7P7k8dK1mU3wvpmSxVAgL:30PDRgP7k4QwvpmCVp
- TLSH
  T10A7277D2DA4A8114A533E86F15812D03EB2E9397981DD59F387C6054DFB4480C2F9FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Genious-Bootp2/presets/FNISPatches.py
- Size 9KB
- SHA256 393feaa7b7927b66f3ede107a77d8b2e6dae9d4723cad9565651e64ec1a9a12b
- MD5 02aa10fba48dd5e388de1d182d82e2b6
- SHA1 e0053ba2cbb6e25806e4d13f62312eb20ce18140
- SHA512 0c2d491789878a0d559b0094b1938cf2376b04d81ad95f83fce0bc55ffc78c01c0644ac5c8fa66f6708eb46855f93a2259218fee73cc7c8ad5639babb903cc10
- SSDEEP 192:MBqMjctPihOPhX2yXyjU7d50QEOadkut/zkrJVKhpo//nsjgPRFuo:cqKUi8PhX2yXyjUgJdkukd08tB
- TLSH
  T1EC2275F12DCFAA11E2B3835D992EDCD3F31B816B11286512797C82543FB1494C2B6EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Genious-Bootp2/presets/FNISTool.py
- Size 19KB
- SHA256 9cdf21f7e797cc0312fecc385790ca3a67555d0af57406d696251e09fc37a042
- MD5 0b0f700ca8287585c28c61977b25053f
- SHA1 a1e6a94311f217d0376a8620837c75f0d5c209a1
- SHA512 3623307587c1c3b4a24cb564743fdd2eb363a921d6c82a9cadaf2647ec9b1d308463353a362fb99355b020ceb6ab02d03b0b9c6cf757c4df09c16a6e7d4b7125
- SSDEEP 192:M7jbnrMCKJ0PoRnQ42k57jUg/y95pnbaV/g/FlpbNHy/8l8jHPzy/T8UfFcSt/DQ:W3MDJ0PoRnQ42k57jUD9znWy8ws
- TLSH
  T12C92869DAD9D6A21D233432A193975CBF72782CF001C0E2A743C4BA16F7845583DEEE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Genious-Bootp2/presets/FNISToolReset.py
- Size 2KB
- SHA256 69c3eea951ae26dddad43c110a0814a427679822b5bbb0b7f9249c903422cf75
- MD5 929641a65d9317b0a21471ce02802bc9
- SHA1 2a5c81100a0bfc01a51760f170a88f450cc6ad37
- SHA512 4b4457ab5cf8b903a21c8764af41ad4d580a6bd815deddc90c99ff81912c3645e49e3ebac3e2fdf98ede96b52fd7a08d60dd405f8dbd94a03afa47df05cde9ed
- TLSH
  T15241FFD1AD4BDA54923BC26D2D51D983F33E52031D1DA217B8BC81B06F385A4C1F9ADC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Genious-Bootp2/presets/Form43Checker.py
- Size 3KB
- SHA256 32688f5ca3bc6eba94163c0479dce9622b07907d5aa5b405e9f3b1968940dac8
- MD5 cad8a25b2c6169b6a0f407f55885ce79
- SHA1 cf16a384dc9bc8943045b8935bb6a13958b7c3b9
- SHA512 97fcf215c1b65bea29bf1e6cb52206c93b35dadc340434f62b295f786f7839e7503d422b94b3d34f9d8fca73d8f5da3325301e61d392359cd759019e4016b5fb
- TLSH
  T147810FE2EE4FE805A2B2835D8919D8D7E75DC79B051C9203B57C90A02F36866C1F6ACC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Genious-Bootp2/presets/check_fnis.dll
- Size 50KB
- SHA256 4c20fd64783299a172a902d6ed363ef95eb8e81fa7e8c56f114e090e712d6de4
- MD5 6b1118334b92edb81c42680660e74bab
- SHA1 1e07b57e8f6ef2f276786795dc317b07957366f7
- SHA512 18cc6a6f0ff4b1d811c46df5652f2879ee1c95d00663673b5dd902c52a7c53d26ac0ffabca2a1bed2bf93d14b6c6f5538a172917138ddc538c21834d0be77bad
- SSDEEP 768:f1DbtJWRyg6pG/JJFpx60yWTbohR7Beu+/:pWAg6pG/9px60JbSR7Eu+/
- TLSH
  T1FD333A2E735801E5E178C2BDCB5B4A56E272F4204362CBFF4355472A2F277C6AA7E604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Genious-Bootp2/presets/diagnose_basic.dll
- Size 131KB
- SHA256 03b0f12b25450d4cf51fbecb2177ce67b16ba63a2d3e1221d5cbd770bd554178
- MD5 a2ebbf85b1043919bd9fa7e514b0c65f
- SHA1 c9e761e7e9525ef1a071a7cd3ecdbe8885d699e4
- SHA512 ab2f604915a16768bf6422e1a130b97a77da88a26a537afb9ebf76d6ddd887f44df9f577061485f54248a038f642575661c3cae5d4d846ce2936322717f49e91
- SSDEEP 3072:Q1KfXscoAf0TvKQ9qCKarMczQNLd9jKk/:Q1Kf8cBf0WWkhczQNLd9jKk/
- TLSH
  T137D35A2F366602F3E526D17DCB4B4946C3B2B01547129BEF036A072A2E377D06E7E690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32