12c22b28c62c7a43a115b0598b60b442dc097350473c4bd5ca9353a15cf0774f

Sharing

Copy URL Twitter E-mail

General

Target
fsociety-3.2.10.zip
Size 172KB
Sample260619-v411babs6s
SHA256 12c22b28c62c7a43a115b0598b60b442dc097350473c4bd5ca9353a15cf0774f
MD5 76740d6f8b2f97c0cf7a2635f330447b
SHA1 ca15f4df5c88e28853eed6f2aff341c6ed210f6e
SHA512 58922f37a512ac293f2bf3e14129331033b460890129ab70efe91842aa39988e30b935bb11c3b28c4f86622917ab671e943f0524383359928652c271390781d7
SSDEEP 3072:NvvH/0Bkx/jaie858fETT//1bylShqKwftmmKEQLiiq/TmBBKHS8N+nj:RHMkxro858fETTn1bylXfHQWfSLfPj
TLSH
T1B904E02AA2711E83F33E157107424C1AABEBF0039F4F5F4151D21E245BAB69E7AB458F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  fsociety-3.2.10/fsociety/__version__.py
- Size 23B
- SHA256 6f571af1246735e80e68272a1df9cf11e7618bca8cb60dd5a6efd519cc2aba3b
- MD5 9ce4cd9b774b67ef765d8b6caca763bd
- SHA1 b2e4a5ab00498c8200e3686059adfb93ded2a3c3
- SHA512 e1e08e20839f8b474e1bdb3f5071203e18c99315c51d95d896f4223ecfdb7698e242d7b1fdfc62ae04dd2f006858895088d9c960f20d839c56e9e663a5ec521e
- MD5 SHA1 SHA512
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  fsociety-3.2.10/fsociety/console.py
- Size 294B
- SHA256 76be8c5961ee1e0fdcbb1e1fae573b77e0b4d9828472f5d9e47030fb6e602f3a
- MD5 264303edade233a88939911b56bc41f8
- SHA1 5bab46afaca458d4911c519f77aacaa007254d2b
- SHA512 37f2dac25c6cef68ba494393f985f33193d25ef8db0c5bad06ec1d61c83f077c101d5828769b060ad9b509d52fc415f918f7f03ee9c7ffaf38bb286d2846bdd8
- TLSH
  T105E0C29A1CDB5822B565B1800E16A82067EAAE030F8D6452B1EDD2080B914760CE02AD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  fsociety-3.2.10/fsociety/core/config.py
- Size 1KB
- SHA256 d57ab94e01ed7f29b08b194c25a2cc372a75e0b406801ec0ee383217c9f81758
- MD5 03da0fc4b0c80335ede8cda78de8fb86
- SHA1 bf0a9b3a22cb76cb739cd2223bc3169a98634952
- SHA512 ac48b4cfa629a872e7b9e9903834b7b87eb611dfa383def5bfd0b384b32d70daa62f6b16c48b57c8d7eec73bfc1667a35f05e4baf39f9702ecd69c613238926a
- TLSH
  T15631CE1B091D8C2351A68F48CA1B88695E71FB9B2F0A751CBBACF258CF7D51E4057118
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  fsociety-3.2.10/fsociety/core/hosts.py
- Size 615B
- SHA256 734a4355d1b1d6172ca7f9d7be9f378e2cbac1c844c59357cf2a450143713151
- MD5 1a375d6516937026705c57c8f22602a8
- SHA1 e54a52faadc75595e42196a7cc01ba1d580cc0f6
- SHA512 a8512d8af06f913ae76ad425581565bfbfcee4a5890799c05fde03c5b09f66accd5114d316543ef5bfc49087b257f9cfd81161c98a5ed0579f8b8568bca10cae
- TLSH
  T171F0AC1A841AECB3C2F295C48A34CC6A2D91FBA34F055D343DAC975C8B481768CA07A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  fsociety-3.2.10/fsociety/core/menu.py
- Size 3KB
- SHA256 892e2a82fd943e50cd8b8372b8f315aeafaeedadda34b6e799046612cd0fda84
- MD5 ce73e5dabd48bba9b51af59ad9f8c7a9
- SHA1 3d3de39b2c7384b7e885c74f12a1190ff2657c38
- SHA512 870866ecf345b7655a860c7970fa6870593feb2f8edbf025e981b01e4e522535fbde7bd751faaffa80deaf2b0d1694a88d4e474ff6589939425690e9be15d68d
- TLSH
  T1C171EF4ACD362416D78BC4ED8CD2D02266AE6D530F085074F5EC93702F8D67286F6AED
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  fsociety-3.2.10/fsociety/core/repo.py
- Size 6KB
- SHA256 b073caaf0e897f84bc1cbfbd95da12c571c765b093d10dc10070fb276a701a94
- MD5 6f695f450151b8da0054603a9ed2c7f1
- SHA1 0c6c6f46ddfdf39d72ba1d7fd82a76660a5071b1
- SHA512 596b31bc1ec359eab54fd09941b2d8b68c00651809b49e306e48a61b991524e0ea51b9654bc32a7675ac7ccb0467ab6ee39ae15b3a7487115388ceb294e19ca9
- SSDEEP 96:7I1FiEVswt/NWdj5LRJCHZ+HcRIflC8+QZPjcO/XUIcBL3E:E1sEV1+FJC5+Hc2fl2QZBUr3E
- TLSH
  T1EDE1410A462019A2FA5B8D594C97A017072F7A630E0C20357DFD92A85F56633CAF2FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  fsociety-3.2.10/fsociety/core/usernames.py
- Size 577B
- SHA256 1fee4b51d6ba9fd19b56343ded2f04149dc09852905207414f9c3de48a12b06e
- MD5 8d6b58ef5f511bc78ddfd06e1a1af08c
- SHA1 0d400198940e8c383fbc6b785f037dd3ef0277b8
- SHA512 50a8301e8b9ccbfb5f35d063586b06c8da61681d310c057117ce20853f1477c061e9b765ca413baf9e133b4a7e51513931dc773c19ed096ca453f01ac9842301
- TLSH
  T1E9F02BB7881A1C6381F944918A348C6968D4FBF31F1564607DFC976D4B542728CE16A6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  fsociety-3.2.10/fsociety/core/utilities.py
- Size 2KB
- SHA256 f6272edad9ecfa4fe189de829afab8e2aa7b310f7f74df2a75e4ab2699d5b087
- MD5 777a8785ab33daebad3919ad7870e9d4
- SHA1 a2cbe154e210c5550e9129e2507705335ef03474
- SHA512 0efb9b85535468f5eddf3150bf91af41dd1e9bd4beb7fe9c9ade6a849cb834a2ba36c32f3bce75ee78831de1a2b3c387ecffb5f07d7f1f5de9d10788591efe1a
- TLSH
  T12351F4258A37F054825F8462C913C066731DA917DB44BC7A7AFC57B80F86AB2C5F25AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  fsociety-3.2.10/fsociety/information_gathering/__init__.py
- Size 100B
- SHA256 f94642cd40328a424100b5f09606eb2984915b0e8b5a8ec92e69e31dd212aba6
- MD5 e6a50f45b96fbdfce1e6f13cf3b0fd82
- SHA1 3888d4e6eb077ff195645962846a418f6ab60b8f
- SHA512 ab69c73ae18200922e5434282d2fc3649e70430f3492d8bf4bacd07d8e4916eca2072df98a2d50efd6a9477c078ed4ffb672ddbc637d5292140e0e818802d401
- TLSH
  T15EB09236E43184038006E292C3C9C02A32B62C6258526132210147A9920E2233D96AA9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  fsociety-3.2.10/fsociety/information_gathering/cli.py
- Size 404B
- SHA256 893c61ab9651f2285e156a0c346a563a661756e1068ea869d2caca14be53cc25
- MD5 98354feda18bbb63f791c3916742d4f3
- SHA1 788d3d122e7fa5f0e43c0d623c9d294e2894fefa
- SHA512 f80c6d8d7c483efb68360de6f23bd8327a7a37c9d1b8248dffd6a7a5b42da8eb4e9ca8c6e49b27d166583d02b1a5497c2c01be934ed4e034380e87b56aa74574
- TLSH
  T1D9E0920F48B33E58C7EED0F28E0E95302AFA9C762F72101851B513358BD844B9CD42A4
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  fsociety-3.2.10/fsociety/information_gathering/gitgraber.py
- Size 1KB
- SHA256 8d0869cbfd20f461038521209d108971f9b5e5e8534c668490d4a61da77c9033
- MD5 2d3e198305415af98f6a3401f12f9cbe
- SHA1 36770c8b21e537ff4ee080930fb8695d88ee11bb
- SHA512 58196406841b3082e4a8782ec9a81f0526c69e06d76cee449e051347d421cf14a0a901b3fac32b15ede7c1db72b132919298b16b172ee94d7f8d3324fe834ad3
- TLSH
  T17D21C14204276C074BA7E7E34F4295D67225F8BB6B012C1974FD449CCF49DA58BB8FA8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  fsociety-3.2.10/fsociety/information_gathering/hydrarecon.py
- Size 782B
- SHA256 7cf6dd160371c18f813969131a29310d78fc3ddb826a7fc752f0b5c2cfc0c324
- MD5 cdd1d7f432c3a53ce034678d55789bcc
- SHA1 d12acafd280e1a5cc3e0171d9419ff8e88245eaf
- SHA512 234c77537c5dc0821a074d4842f3df3cd2e251f2e8c791b60dffe84eda011d170a9e4c94e111d9acdeef639618af060e53888f89cf7ad74649826047562b7df2
- TLSH
  T15A01C0495823BC8286AFC5672E377922B272B5730F04300079FD62D40F4CD9196F472C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  fsociety-3.2.10/fsociety/information_gathering/s3scanner.py
- Size 866B
- SHA256 5465fd2a0df05c4a3765f69504188236d2db1bfc56e4ceef1a6aeabafa15e4ae
- MD5 e70e86bab04e38f228e2cd646162219c
- SHA1 be6ec13b8155448e5b6f119c3692517ffd13dfba
- SHA512 7d7cdeefff60a865e98d8562afc78de779c101b6645cfbc67e39dd982bd95af900af6772ef37aca075d770f65532bf5fd62b52aa2657a96a3073312d420730c1
- TLSH
  T11111D04B4827646443D7C65E2921B817B126F0B35F046824BAFE61940B5C9FBC6F5BAC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  fsociety-3.2.10/fsociety/information_gathering/sherlock.py
- Size 859B
- SHA256 d6596d571eb66674ec334506f0c59c8b9d778d45b2bc08dfa580609ed14018c1
- MD5 8541c929d568a7a501b0c477817cde88
- SHA1 98dd4a5b5962252dc5460b6d7051a30d77582718
- SHA512 6e135cd339da031b2d058c912d2b84b9f3b62759a2fadac568859b52b32ee34ca83986331164dfcd1d5cea1731a24ebf238d7b8dffbd37bc553e7f0d914790a7
- TLSH
  T1E911CBB644327408530B60930E196909F2D2F5230E0834147CFE93AC0F8DEB58EF0D2B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  fsociety-3.2.10/fsociety/information_gathering/sqlmap.py
- Size 738B
- SHA256 6090918eb40dbad2752437a3cc9ea046fc25175bee288bb359aac381bceca362
- MD5 064cae98349249d9c05bb17fcb5c5833
- SHA1 9ca43c88a6978fb00f29fdcbbaacb4d4ddd99765
- SHA512 8290e8f2bde890f27b9a2fa79b5f55046c617a845c988e663f008f7bc22686a12d39692263dd97938e544d4263d650119228c3f82767a4ed45e034238d2b9d6f
- TLSH
  T1A5019E0A5327B403C39B825B5942587692316C370F4634287EBE60684F58D5387F1AAA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  fsociety-3.2.10/fsociety/information_gathering/striker.py
- Size 570B
- SHA256 564c480d26223bdc029510d46ef90545085f44dbb4a7de01cba61276bd153a47
- MD5 1afce72079aee4f34966761db06d5545
- SHA1 81f01a173c422ad539fff3d9ebfe8b5f722b6249
- SHA512 4235856e62749a6dafe8325ace9c5ba8f002ee7a29b940e4575b49a65648d39d0ad100880f2593b63fe3b5f186cc6ac78c7bd2159603903904534b0f53d887da
- TLSH
  T174F00E491D13E006839B86972B225816E237B1634F1C74117AFD625C8F1D95ECAF07BC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32