a5c8037df3f1726c733e90520df043f138658015b258e68c8909e5bb9b96d803

Sharing

Copy URL Twitter E-mail

General

Target
9b8eb1986e07473972937fff3b2dc01064fedcddb2961457659f35f0d28a4b90.zip
Size 30.0MB
Sample260620-24fspsa13y
SHA256 a5c8037df3f1726c733e90520df043f138658015b258e68c8909e5bb9b96d803
MD5 982f5800b76673c3c95e02571b29bee7
SHA1 5323eec88d3fba1e673e5fdf41de02972b12f6e5
SHA512 a4ae2fdc2d1a42064cbad26e6f53cf84bf05bba1e2282219bb7252a62ff645d03c972e749b67f1049940c2ddb9aa290d489e0b806ffc455c47ba2d8ea2da14ea
SSDEEP 786432:AEn78JF60Ar3dQnsJmju4C0Eeirm/d0Ex:AEn78D6V5JmK4C0Ee+Q
TLSH
T1A0673333CA114D0A30677AE9B147B7804AC6A627D69F74DB456A7C08CF38E13A5BCE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  9b8eb1986e07473972937fff3b2dc01064fedcddb2961457659f35f0d28a4b90.zip
- Size 30.0MB
- SHA256 a5c8037df3f1726c733e90520df043f138658015b258e68c8909e5bb9b96d803
- MD5 982f5800b76673c3c95e02571b29bee7
- SHA1 5323eec88d3fba1e673e5fdf41de02972b12f6e5
- SHA512 a4ae2fdc2d1a42064cbad26e6f53cf84bf05bba1e2282219bb7252a62ff645d03c972e749b67f1049940c2ddb9aa290d489e0b806ffc455c47ba2d8ea2da14ea
- SSDEEP 786432:AEn78JF60Ar3dQnsJmju4C0Eeirm/d0Ex:AEn78D6V5JmK4C0Ee+Q
- TLSH
  T1A0673333CA114D0A30677AE9B147B7804AC6A627D69F74DB456A7C08CF38E13A5BCE5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  9b8eb1986e07473972937fff3b2dc01064fedcddb2961457659f35f0d28a4b90.zip
- Size 30.0MB
- SHA256 9b8eb1986e07473972937fff3b2dc01064fedcddb2961457659f35f0d28a4b90
- MD5 ca2e3e4c8794b7492942937f67984d08
- SHA1 65578c3c9f09623ef92e823eacb41856f0edcb07
- SHA512 0d75087421d5f299d52a459500143369406e100ea74a0ec609be931cfe9f2c15679cd04150dcf20d2656817d51f8d7daad0b5c65c349cac770464dccdcac08db
- SSDEEP 786432:YkDY7Y8Js1f5+3rRcXxlFZmShXgQVfuQTmxx9v8rFoNNHCqZsBYg:YSExJOfmMx4kXnEQTmxjvKFoJZsBYg
- TLSH
  T170673314487A578EAB67C623A82E57F780084F92B5307F79F01A7A8C8A475F478735B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  captain palestine virus/MAIN.bat
- Size 63B
- SHA256 8f0ec9235cdd41c6b3deb129fbd74b788dbd053e79b62e9a18f31ffbf5720f4e
- MD5 a6e56fd429d64cc26589fcfe5fdbd3b5
- SHA1 41860f445cfb567a613b236b2ed0e3f4cde23474
- SHA512 9d87fe38cc12850d8747069bd73c0b38e217d707d43dd62b7113252cf774e24b5ab9be2ea626f26894f693b0de732243f12600a42566c5719512cb17c9d1a5e9
- TLSH
  T15BA0020A05915A80517A69CE909B15D9BC1E759720026E891AB1E27E6C5F571420E591
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  captain palestine virus/captainpalestine.bat
- Size 63B
- SHA256 8f0ec9235cdd41c6b3deb129fbd74b788dbd053e79b62e9a18f31ffbf5720f4e
- MD5 a6e56fd429d64cc26589fcfe5fdbd3b5
- SHA1 41860f445cfb567a613b236b2ed0e3f4cde23474
- SHA512 9d87fe38cc12850d8747069bd73c0b38e217d707d43dd62b7113252cf774e24b5ab9be2ea626f26894f693b0de732243f12600a42566c5719512cb17c9d1a5e9
- TLSH
  T15BA0020A05915A80517A69CE909B15D9BC1E759720026E891AB1E27E6C5F571420E591
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  captain palestine virus/code/captainpalestine.py
- Size 6KB
- SHA256 732a6f1bbe93397cb7349acbbf69f2191d506f3d6e1c486cd31cc40830dd9956
- MD5 e48d68e8b0850eb96f158083397ee715
- SHA1 224f49ad7dcfe02215773c545fee27935e49d7ff
- SHA512 02d0b8f809ff50bf38f9ba3e39a74c59c01afe21009b9b9810f75b6a1de3e6fa9ed530f3a2c7b714e88f286dd3bdfab8cb45822e86607551bd0192eac638b70a
- SSDEEP 192:4fKdK4TCS+zwKCaT9mryP8lLXuYMwJf7AN+1JB7iVMMZL4PblVXuYMLF:4ITCS+z9slL+YMQ7AQ1JiGlV+YMx
- TLSH
  T1CBD175624C6B2C5980B2C85C79CBA092E72602135C773A0675BCC7B03F745B6D5A9FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  captain palestine virus/code/running_audio.log
- Size 16B
- SHA256 4739e4c0865e83189e5d359c1d2aacae1fc0bfc48a55ef5a77111c447e2fc6a3
- MD5 659fcf36ef08c5045e7f91463af82e02
- SHA1 d69a3ee2b7a346c63c360644eb5ce04918bdbf73
- SHA512 9cd3131c5712e68921786c53748ac0ed50f3543a8cdfdd7fb14e394000ce495f09d0132a22e7ec6f440ac0bbb58e7d04b2ab688d002895867b1336d875d05bb2
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  captain palestine virus/code/running_videos.log
- Size 461B
- SHA256 fac85ad1cc5e0eefcb9dd727e99801e913ad2bbfcb1cd497169f0c60e00e8199
- MD5 76e58271e51d09b4157b5da4e69db0ef
- SHA1 4a0f1f67850fdc41caaf64cc4c16b0e91ced78e5
- SHA512 bead10da4ec94c44de99116da98bc7b3d029347f2e48d93d23390c7a7e6ea3418465622b3a0e951294fc6ccb61fbcbb4bd5b319b560ad2abffebe0c6c24fb9f0
- TLSH
  T1E1F0EE4F4115DD76757403DD46E7478EC2E02C1015D1AF824555589B12C7ED482D7D47
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  captain palestine virus/code/shutdown.py
- Size 998B
- SHA256 8d081936bc7f6301a4fe8e7f0641c609c0fe1bd9a5bc2be35fd5eb2dbe5ddc30
- MD5 5cd62910c6f7c9544820891f11f31eaa
- SHA1 aafa6b6f970359873e0bfb2c2f4d07008edd5f96
- SHA512 bfcb4580e4ad1d02f48d92207e53d201b18a04dd1a8ceb276ce595eb34e886d33faf03f2d4638096d07726b3fc290c2519c44a49c435c6405820c96e2950cc24
- TLSH
  T1AB11612B5C5E7C6600B0CF88FF47683AE609B01345602427F5EEA15C03E0810DBF16E9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  captain palestine virus/contents/Qad Tasama.wav
- Size 30.6MB
- SHA256 cf84cb0045ed79b96ca0094f52f22fa62ea05142df1466f03a71ab1524c339f9
- MD5 f858fd836bd159fb55a3ce4fbca1ada0
- SHA1 d1450dcb0e2e03f3260ae81ef90f9ec14a7fb6a5
- SHA512 d37cc3e3ff93625d82864c40d4a6d5feb21c2ba08dc07f1b97d42bbb6e0a38d4d7145d9439471b9daa2615b3aecd5fd42d0b15febfb6d727e98acb28cd4a5cd8
- SSDEEP 786432:TuZkpUeKQrJ7fw/Yq/XLRUR8PYXv35fBDU0Ae89o2E:TPpt7f4YqvFU6PEvpie89oZ
- TLSH
  T13A673389F7B19981F81C837806C68E9C27027BC97926660E127DDED375022C77D64ABF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  captain palestine virus/contents/captainpalestine.png
- Size 272KB
- SHA256 73b4aef863cc032f34c5502f255bfb524708de64456e6e6879480abd0e6b5296
- MD5 6436cddfd934abb5eaf1ec6a94b388b5
- SHA1 005c9dc8767eb247dc99487f2b440f35cfbae647
- SHA512 810012b6155e4f81cd5710af065d76d37cbd281de2915ceefcf04947868d7fb32b5a16aea13d4634578493b94a581895e58b39d42f2be4cc9cfad38b88144efe
- SSDEEP 6144:Ay5SX9ORJDXZo5ygAi3tpkWa3w5hvsojCjXTb4kNI3kki:fSt2JLC59AYkzw5njCjXT/Np5
- TLSH
  T1F444231F9A9E0E4A246CD754D44BEFB2F8DC7651DD29589DA2C8287801726203FFE0B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  captain palestine virus/contents/contents.txt
- Size 80B
- SHA256 e5c50818d6ef5946355cc65fab9ad43e87fe9c888ff27828e180fea27bd5f37d
- MD5 740f7611f4a10a6e66020cfa5008e351
- SHA1 5c86f129aab5f2aac6601af8c85e8fb8913b734c
- SHA512 1f50ca4b390b919516bae3fa7951a0dbba3208bec57fe2061302c87d77185b3bddadcbde6d37389aa014b0ecf752010749157ee85e8c1ada3adb7c0cafdd5efb
- TLSH
  T179A012A4822409D14A002ADF00450947808032C9C0000800DA21D0CC1E1B5110178057
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  captain palestine virus/shutdown.bat
- Size 55B
- SHA256 e2697ed61b7013476456b4a584697d2b9f38b26c9bd0a5756302202470116e8b
- MD5 2eaeb9796d7eee44350867b940b22685
- SHA1 4ca8c8079cbef444b15ba1611f80a1cb11a51441
- SHA512 45d33b278751f59e920f49934eaca871ac3b93542646982f62791e5785ee63cc522161c8b42e8a23ec16f0ac052acc555025569c8418b7e1918c3036289ff9d8
- TLSH
  T10590220200A0008080AA0888800A0008AC0FA0A220008A083B30C2BE2C2A020820A0A0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24