3d1d192e9879d33a954ea6e5eb0199cd3cb03622d88f2aebd50074eade956f61

Sharing

Copy URL Twitter E-mail

General

Target
kkkkkk1.zip
Size 28.4MB
Sample260620-akxtbsdv6z
SHA256 3d1d192e9879d33a954ea6e5eb0199cd3cb03622d88f2aebd50074eade956f61
MD5 090d8996b3d4c3239223d43726751e16
SHA1 bd941a6da9512e9c1949a0c29cdf5a276de4947e
SHA512 46f7a07a1a90a0460e285d183ef7a76bbce213470186352de99504d64bf2239fff6217c8523bfffa1db1303771aa5b111eb16ccf5218c82afbccb466e04ca79d
SSDEEP 786432:tedDhVwxTx/7rHn4bvpBUgim8MnP6W3CQJcdFmodQE6x:tUtmxTxDrHn4bhBwqnP6bKC+
TLSH
T1AF67231AE999E236CAC32BFD11099722D40ED4C76265BA973EF90B803C636C50F9F745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WPy64-31502/IDLE (Python GUI).exe
- Size 141KB
- SHA256 d965de954e35290e99785f6f0aec07d06a35c907a47d714bc511553de92bf85b
- MD5 7ce657f5fdf5a2d9804ff34e671d9488
- SHA1 8662bbf4de09da946a4adfd2bda0b832bc13842e
- SHA512 4da0352892ffb4979502b207b876cc3fe356f2884698b8cd28400eaf84251e6fa1daf065ce4dc269d509c934dcf8d09598cd1e7ca25e76d235e6a7f592dcf97c
- SSDEEP 3072:isz/jePwXQbcM7SxwCo8MoMulVVHCElNBi:F/jcwXg7SKzIKE4
- TLSH
  T190E36C0B7A6570FED26A8A34C8424905DF727C724B90AB9F13903ED61E776909E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  WPy64-31502/Jupyter Lab.exe
- Size 150KB
- SHA256 2891d9d79bda7128a1cf94c92c5c3cba5f0c2b174925a918b4956c88f44e0f5d
- MD5 f83686ee456f67c40f8f6d01bd7ce085
- SHA1 bec483314b1983adc52814da79983e8d46d6d11a
- SHA512 2e0da1ba76d0ea89c965f2647345b3b9daf0e82bbbf5f93bee587eee25ba120e96b11ccb4a2a7e47db733cc0ce20cfc0ec4c0d9dd9936dcf174ea50581d53f5e
- SSDEEP 1536:/YWZ+UYq49Pm47Ugr9kfSVgRj74xaZAlt4BqjNsWdfd09dl5xhET1z:/BhSt97xcQG70aZAliB41MrxhET
- TLSH
  T1FCE318D7F3B760F8D066433C88611916AB71BC3577209B9F0B59624B2F772A28C39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  WPy64-31502/Jupyter Notebook.exe
- Size 150KB
- SHA256 e4a3acc5cb21c4a2a5b0b10bf364aacab34ff142de0e9cf6745bd3da2b6b7531
- MD5 38671103c43ab01ab3d8312ec81d43b0
- SHA1 d82ccd61757cd4a5e6f50d08043896890f9b8531
- SHA512 dbb58b78d65b5f4c479bcc31b33fbc0e54fefb5b0a609a235a23c578bd1bca4fbeed92baa9fea0c3ad6093f540561e20870fbbcdc6811189cb5f6577e9c1721a
- SSDEEP 3072:R5g6AXWLLZ7lVqU56kiqSC5UZMoxEhGikT:RwGZlVj5ZiqFGa
- TLSH
  T149E328D7F3B730F8D166433C886119169B71BC3136209B9F0B59624B2F7B2A28D39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  WPy64-31502/Spyder reset.exe
- Size 131KB
- SHA256 75585bd6ba546bf0801ab94e5f358dd768fcc96054409dadf63ffdb58a9e2974
- MD5 9c8520a2b44f16c5ec2e835e3edc3fea
- SHA1 56fe71ec1ea1ab9af8aa836084913a5e41189dae
- SHA512 d31446fe60f6712b4f3f40850ad81b1702886b3de024a8d96a37495d97c2ba73202780a23fd34b5c8e16de9a197b4e47085e021c154e173e6eb09a352edc88ab
- SSDEEP 3072:yJQ/laAJg+CvhF1FV+mMMPHEbgDF7H2lmd:yy0R+Cv7YwAg
- TLSH
  T141D307D7E7A521E9F439623484734D139777B47E1E209BAF029C713A6F232C14E2AE16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  WPy64-31502/Spyder.exe
- Size 221KB
- SHA256 487a75609100155dd7713d38f0c347d41fdc5cb7f9bdc291eaeb6cca66bff32c
- MD5 2a07bf3381e858bccd982a7b3fdd8070
- SHA1 bf3426ca8e61c650383aada61554b64d7cbdf8bc
- SHA512 2303eb6f7f72c2de1bf87de0c2761116280be22d851d947ff060ba2762d6a6e88b48fa8d3226f5e014b05635d277c647ff3d938820ba48073abf71abc71a6955
- SSDEEP 1536:38XrFqtSbLsFHFeAyZ1d9QuF0q0SL7SXq2HJNoBlMzwsWvd09dlylTBz/jfYFy4Z:AFqDIhrQuF0lW7SaQfo7MoMkltr
- TLSH
  T15724096B67B37CF5F596C03884206C458B27B93642E09B8AA74E0EA3FD633504DF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  WPy64-31502/VS Code.exe
- Size 186KB
- SHA256 a5ff1da302501add17b796b8f177cb92d604daf7f79fa26d89e7c1607ae42387
- MD5 d5b9c56923373076a1c48386295da621
- SHA1 11824f2d3c527da0bd7b6344243cd491c8598a04
- SHA512 8b818442ad362ec65c8d82a3b5acb8da69944ae6a50ae7d9ac3a349d8c7f767e8d9ea62e930d5c64ba16464e063380d5e8d3c92899dfc11c65f0ad53638778a9
- SSDEEP 1536:XxgWxiJlymacwpIaTSxZI2vRlF2gMJwEssWayeZd09dlpJaE77MITY4:RxYAawpgu2vRlNMyExzMP0E7gY
- TLSH
  T1F514F7B7239420EDE125813785BC4A439777BC210655AB9F0A60FD271E3AE9DCD29F2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  WPy64-31502/WinPython Command Prompt.exe
- Size 145KB
- SHA256 c2a83049e4506d7a07a00df7afb0575203117a388632a5c9cd22d6f98108d6d6
- MD5 feade9111be7e38cfb031fb1d10a9a6b
- SHA1 23d3d6806d64d293b3aecfb1613ecf2dccd42e62
- SHA512 6213a973da2859fb44ade7fed944e754ed274f2d611d839803ecfaa64d16fe40e13bab3c1d0b462d1f442efc39f90bebedb4c27c9e974ecfffe2116d0471fab4
- SSDEEP 3072:cT27oObvbT62MtQQNewj7HM1WHWBy4lFS:jZD62MeQHj7/Uy4/S
- TLSH
  T190E34A4B73A464F4D2254174C8A2D971C775BC364A61AB6F03E0AE1B3E333D1AD2EB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  WPy64-31502/WinPython Control Panel.exe
- Size 170KB
- SHA256 af6459ca952a6c367498d9c53328ed2d5ec1c9880a5d414c9263615689f79d22
- MD5 02cd09c7710e911b8db0c02f07afdca3
- SHA1 5f3015f81500bd4c434d87c169d144ae3b311fb1
- SHA512 612b5dc5caf7dce9e219c4f839d329f8326a86bb5f38165749aed302a640b4c6a6f21cd24f87fe36d9044acbd8470a9c5eee45b8b24d0831c46c3aa05dcae059
- SSDEEP 1536:kFgLyjJTBnhzvMTsqayoFj9b1JUjS8MeIjfFheFWVkCcKzsW3odo9dl2yLa5wALP:3LyNvLvDb1KFMeshAakCpy4gy558Pq
- TLSH
  T165046C07BAA632FAE27A8931C5434809DF76BC714B90A75F47513E920E336E19F2E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  WPy64-31502/WinPython Interpreter.exe
- Size 132KB
- SHA256 b141fb788cfce13b73a033e4175fdc74613625c8cb4840907933f4e34fb68a9d
- MD5 607d20ac7896132bab547287238af8a5
- SHA1 caee8bd395177ee67e845bc5fe404f2d175e4347
- SHA512 d7df63ed984a6e9f14f816ea740c0e23957c785022a4da8898176e8a4bbcd532b5067445dca8254a9e5f00d000cdbeade138899e7c88f85f5162f9704d3c043e
- SSDEEP 3072:5T27oObvbT62MtQQDewj7HMyWHWBRlNBi:wZD62MeQZj7QUR4
- TLSH
  T1D9D36A4B33A530F8D5768238C8A25A05D772BC350B608B6F13A4765A2F337E19D2EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  WPy64-31502/WinPython Powershell Prompt.exe
- Size 131KB
- SHA256 8702bb45a69452af8219bdaf79327e5400bcafcf4a299fd364e0d9f805d78f61
- MD5 008ab0df6e25183e346832ab5466c39c
- SHA1 728d0927a4a57d5066faac8932fbaa851144e317
- SHA512 68634a5279e7bcabdc3b5bfc801a4b122a23ed4de57b8e76d9e67d3ae9af048932d0811f78502552d5de477eecaa8873557dcd777aa5a85dacd445fd00c6f162
- SSDEEP 3072:sNxYAawpgu2vRlXMyExzMPlE7gJ1r3BgDPUWl:swNZu2vLSg+gJ1r3ODPUWl
- TLSH
  T162D34C1A27B624E9E436C138C4528A019736BC7556A19FEF07A4F2652F333C05D3EBB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral19 behavioral20
- Target
  WPy64-31502/python/DLLs/_asyncio.pyd
- Size 60KB
- SHA256 ba89088801b66917993d166096fd1ca2712ed1bead35a5e0d554b97156022e44
- MD5 93f81d33bf94b33c4133173ba25cc377
- SHA1 d0f919c100c031108220f2c8db785a321ff52942
- SHA512 70e4477627da6a2fdf9099d8953d96d82e079efb1d6b7f936adb165cdf263088ec0ff0dbdfbbe19f1bcf3a5bbbdd57d9a6c2ecde6b775314130ce6fd7acb6494
- SSDEEP 768:KfSDSKTkcQcAM6Z00N2UZ8Koc9l4qMS0OaML9gjtglIb+KkIsDnt:KfSmK1eMOPFocojC94gK+KkIsDnt
- TLSH
  T110532982E2E441C5E96B4178CD571F83EBB5F4406B0093DF9194C69E2F633B24AFA722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  WPy64-31502/python/DLLs/_bz2.pyd
- Size 70KB
- SHA256 2467eea3649ab513d112d87592df0a51bbfd76f63aeb3fe0e8e2be1f3bd6032b
- MD5 c07081bd3f8404314289f90e78c4d03b
- SHA1 d28e398f703eed41db40d43d7df7673be41cacb6
- SHA512 f6a17dfe3974e6c7c2e8ac438352d68b526f5aa41cdeab803b87881b83182483c73948d30b5689a4cadfcabb893d6fe248275775579732dc85d0e9f6d78c8759
- SSDEEP 1536:LHHBN7+AaJ4ZYwHG3wGY0hHm8LxyYUm+KMIs3V:LHYQeDBHRLxyHfVIs3V
- TLSH
  T167634B46A7B652F5E1AF91B546400367E730BE280350A3EFF784425A3F22F52ECB5369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  WPy64-31502/python/DLLs/_ctypes.pyd
- Size 127KB
- SHA256 f0439533223a3c01ad1e6658d356749c453f43d4030ccbcab0432400a61641df
- MD5 aa6d19f5cdacdabd3c8aba0602944a21
- SHA1 c48417c94420c6e7652b2d41fa3bf481683009e5
- SHA512 77fdc40b63d37898237660c7459e3c9997bfb74c226cb12dca63130f395dd2a00c95b5eae54f3dc7a7b437912977788493b7079d7517711b4d220ea6267787c6
- SSDEEP 3072:HgDihucClcvbEAWEiGdtRvhxzJ34ko5R7GwvmxIsGP:vPrRpxV34ko5dGwO
- TLSH
  T160D34B0B73A801AADB634178C5639E47E7B1F4156B1093DF4254CA9B2F233E2AE7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  WPy64-31502/python/DLLs/_ctypes_test.pyd
- Size 115KB
- SHA256 8674cc7552500fb910d0a9fd4711cb22e2f6e1e780728b560a5a29c0a700f4cd
- MD5 5292cf9e144170ae2f0c9deb348c3f36
- SHA1 41fa357189d0d85f1e8e2d3fc56cdc308a75e6a4
- SHA512 3a7b94b0fac5cc0630a111ea6fea9142d749a11a467258b06d3df9093c02098d6a6354af416d00cb3ad3d0d23b2436d36f99366e6cb8d906ab475351bb2a6003
- SSDEEP 3072:eKifVMjI7bvjlRINxfJCjyf/lvVTCmgUsaKNB00qlox7FIsfk:eKiijajlRINJ3dxCmgUsaKsK7
- TLSH
  T156B3DF18E36FC9E4CBB94939E0D80492CA7635A2B6325DDF186BCF101F63DD6A539027
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  WPy64-31502/python/DLLs/_decimal.pyd
- Size 304KB
- SHA256 976d500e3bb7cf538ee601992774e9de05502e08b6dcd7d283e0097a821b280f
- MD5 97c6c974b25462b8cee776d1ba8eeb28
- SHA1 ec6d3a9d8579b1057760461d7db1a687dfeec946
- SHA512 c539c42d3a33ae82fd935876f1d64238bff9c86bbc91a6097a93ed4b76f03004dc21cc406f71f35b195d67302dc2cadf76e3855340266ddc23d013c3c83c5ba7
- SSDEEP 6144:PwVtW6JL7MnJ+TTd2NG1xWvjnu6Cxl/dPW0MIP8mMhO:PI9BCvgP088mMs
- TLSH
  T1FE644A87D39909A4E677803DC94B5667FBB2B8408320C6CB43A5499B3F933E3673A744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  WPy64-31502/python/DLLs/_elementtree.pyd
- Size 126KB
- SHA256 d8f123a7002171149cc768e4bf4df8a80c120198a46fd2815f333045ab444fa9
- MD5 620c0ac642f6aed1ee22c0608942b209
- SHA1 56538d68490dc2e6a4deaaf50fe901800fb8cd00
- SHA512 d527112f833897b33f1cb6f32a790ee46b14cc27b816d58039d751bce469eb51ae0e39d4236c8c9e5d33e42ba4b4f6930527d7b6237adf7b6e9a5756e3d1159a
- SSDEEP 3072:01wreTgEvGoNMhGCXpgnJQlPayjZiFI3NQnFIsff:01wreTpuo0GC+4ayliFI9Qn
- TLSH
  T15AC308667196C1ABE992403CD4530B02E7B7FAA00B12A7CFA350D96E5F273C67E75720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32