f3c46aba89b4c6bcc0b2efcb282461fccd25cfa7eddd97e1b07772f09a530dcf

Sharing

Copy URL Twitter E-mail

General

Target
CLARITY MACRO + DRAG.7z
Size 17.5MB
Sample260620-e7ptfset8y
SHA256 f3c46aba89b4c6bcc0b2efcb282461fccd25cfa7eddd97e1b07772f09a530dcf
MD5 475a7de627bd78cb9ae1b3a9fc409c5d
SHA1 c19483c17417a4d30d5445726a0808052a571d96
SHA512 f81ad7c4d5d4f9f69abfec043a9ff4adb9097a6032248e97584c3654c2c006599a70ddf9f320ef19701c392c79716c8da97f8e227edfbb1c217c035d77324c9b
SSDEEP 393216:ZXgGhxVn5bwnxHIe9iVk/iYuSVvRIDlJz1S1bb05TqLEw8Gsuy6n:Xx5kxHI8iVVLJz1S1bMgX8dD6n
TLSH
T16D073329D981FC4F3E08442392B69FEEFAD071241BA0E700145DE82CB96F7D9D997879
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  _internal/81d243bd2c585b0f4821__mypyc.cp310-win_amd64.pyd
- Size 201KB
- SHA256 25352e867f88fb639bc036ce1867570bf60d2d0be9926c09603cff3f3c2c9fb8
- MD5 e4b22fbf3ebc78af3f0068da0a14cc56
- SHA1 ddb350e275c65497419ba12ffe9d65a75fcb21dd
- SHA512 39b9659f7e514aebbf35fb80436893c86880016606db1eef6c69a5987fe5c58b8215beaac51e71576dd7d3ce811b5be43d954f312b68e443ae442d7f0a7327af
- SSDEEP 6144:mCTo9q0VH1fk0/WdixkP8VXaVHaT8fyFmiGJZMz2mgEISx2:mC8q0VKqGJ
- TLSH
  T1C614193952480060DDB752798C739623E5B3B662073156CF08D0CA755F2BBEAB7BDB0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  _internal/PIL/_avif.cp310-win_amd64.pyd
- Size 7.5MB
- SHA256 c77ef37a127d5f9cc52b124c29514c39dc4e60f668a4a50e296a3a0655130640
- MD5 f6a4206725e4e5fd7f89662bfae41ede
- SHA1 a95fd954bb11930b080081483528eb83a1cee041
- SHA512 cf4c21eb5ac0a5390d8d4cb13a3de2bb376e5148b6567d1521bbb8c2bf824c289ae746ec142fafac8cb501431ad5f8eba98482ee5caf929473bfa039c1a587eb
- SSDEEP 196608:XJnInaNiX+47tIIAThcCEgJ2oxj59z2TfeZUpNRdQz+5YW+z00EtvZsRQFfbhENJ:RInaNiO4ZIIAThcCEgJ2oxj59z2TfeZl
- TLSH
  T10786D08AF19391E8D22384B4857BA716FA24342E9715527B33E6C5397F937E04B2EF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  _internal/PIL/_imaging.cp310-win_amd64.pyd
- Size 2.5MB
- SHA256 63909e2f10cff5f511a1c4fe62a6fe6ac293b5fb32af426ca30e631e9faaba3a
- MD5 28ef74a24fc52b0574faf4d3bf4d836c
- SHA1 9c2fab01314f6a4dda2de0a3087c255830b5fe23
- SHA512 2b9d6651f4bd907594bc1993f9e859d2ced8438a899bb06af387750263c0a35c0b09bc2260e8ac203e42da9980f286fc813462f07a7d7a98047d3ec18db82f47
- SSDEEP 49152:m4Tiv8VatRqUgQT/V4yd5cvi8/VkidCfHdwzBPd1e:+uJvMidCliBl
- TLSH
  T140C56C46E9D19499C6B28034CDA6C216E3B1B80D17F187F77684A7F93E23BD0353A396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  _internal/PIL/_imagingcms.cp310-win_amd64.pyd
- Size 264KB
- SHA256 fcf15ac5c914b0e41da055325a398a0f4eb85d6f17f89a63cf5af7900fe1dc3a
- MD5 2fcb5d943a85facd84a6933ec701d238
- SHA1 f76a7726d635366f499b18671dbe7bd9d199a640
- SHA512 24dc8f6e8bf6489caf40dfd73ad782904dde98dcc57129783547e48351a15646e6241407d7498e7d83eee080d4d4f3e4288423580f95ca61492e5e3a79fd188a
- SSDEEP 6144:fj0U/91NmBC4RI7OjhELmLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwLjPjx9Fl:bN/9HYhELmLg9uP1+74/LgHmPr9qvZqv
- TLSH
  T16A442756A2982CF9D477E03AD193A50BD7F138150321D6EF43A08EAE1E17BE5693F342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  _internal/PIL/_imagingft.cp310-win_amd64.pyd
- Size 2.1MB
- SHA256 f89038fc14b8549d575b11e691d02642f66e90da23d7ff3b266fd066885f5c0f
- MD5 51c7a7789b3d74998f5d4bae236c5455
- SHA1 1952bc172d834a7eba9aa1ff402d418db4ee65f9
- SHA512 7046c31ae87127bbd8cb212ffe7f3567aa8cf4eeca808e7abe7fbbb701b49618fc6705df45b7313dd162d25b1a0b06b339fef1b4997c9169c430d3ca29e88415
- SSDEEP 49152:O193n4L6O+JQdulGoTjNZui4TNaR5KJunC7Y4yFhr:NE6
- TLSH
  T10DA5BF86F29601A8D97BC174C693861BE3B574010305ABEB65E09B997F23FF11BBE314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  _internal/PIL/_imagingmath.cp310-win_amd64.pyd
- Size 24KB
- SHA256 a944fdaefebece7633bc9d8eabc48967b18af1797a612e43835bf4f6094f7542
- MD5 0fc86b7ec4e685ec147f2e2e0a229869
- SHA1 d6aaa413d117e6b54706f5c79d99db0b125435f0
- SHA512 ee2fcf2e5ce436f3f057aede2e099815929bf144a606d7105c622e3f64815a0a0228292f3fab44d628914b0aae40857d55968809969fb9b24c2d440f4b7e16db
- SSDEEP 192:II6wv81mOmBtlkL83lXwdbc58hZCoWofHA+N6cCXdb4tT2ZD5KgeAAJQFxOUz:I281s716qyA4HAltxDUAAJGOU
- TLSH
  T14FB2D8596F901499CA2F473E88620A558129385313E45FDF82E2F2AD2BD3FC3663EF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  _internal/PIL/_imagingtk.cp310-win_amd64.pyd
- Size 14KB
- SHA256 d45a85d05cbf99dbe4b1b44f26f1979344d46ab11300a375fc96c2f0e806a925
- MD5 5550b36bf386d1c2f180504e0aa60b82
- SHA1 78d3b5c051347a19e5fb2002ddb6de9fde38061d
- SHA512 7d0ad444dcf83d30ca84db4e216256a99917ee156a8d5f6a20cac83dadc9a42218bc8406d01d320c7183668e1a409fa8f5988c72d2993a9fbaadfa514e796a36
- SSDEEP 192:FLSFtgQf8p8RYFomnlolBxJRREB7Y0aQAZdXgTAU:FLCu8C7lGdRWNAZaAU
- TLSH
  T18C621809FB6408F7D5248175C8B32E66D276F6345322A3DF8370D21A1E72BD26E36E49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  _internal/PIL/_webp.cp310-win_amd64.pyd
- Size 400KB
- SHA256 c76763a05650a1a6e33bc8ca18ace48a9058e41d0775233acc2dd5f9b8adc139
- MD5 8212abba1616cc22d5cd28dd88d7c057
- SHA1 5bd0f802b0cec7f91d6a5d9bbac961a9464151de
- SHA512 5d29fac26818199e528cdd4b9fc0ff2e116a23294f544f6a4b06f1b817ba4c41b2a9d9d59346928c348c3b340d334693fd900ca4701476a9d2a2c21517662ced
- SSDEEP 6144:nAtfDK1ZcNg/92V3VzwqBQl198HlSZTCNiy6TporL6wz5EglMuSg3:AtDOlE3Vz9DFS4Njco/6wt
- TLSH
  T161946A46E5A625E8C4ABD078CAEE555AF6A53C1C035096EB47E0FE393E33BD0563B301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  _internal/VCRUNTIME140.dll
- Size 95KB
- SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
- MD5 f34eb034aa4a9735218686590cba2e8b
- SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
- SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
- SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
- TLSH
  T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  _internal/_asyncio.pyd
- Size 60KB
- SHA256 2c9f565254e4b2744d52b58f4960d5da1330c7846059b772044e4415804d933e
- MD5 3aea41c0a41765d6b0eb3363804d94d0
- SHA1 26f05e3e458d5b90326ea40c6bbf236a3dbd49f0
- SHA512 a1f5eb597c43a053d28e16b48f365760189eeb129ac3ea1eaa3bb6648332c5f11a4a446d29dcd90e773858fb4b6367568fcd9c778ea1efee5d4972dcdfe4a0e6
- SSDEEP 1536:YWbvivBeDp/HmflsqHEY8ZIv5n4U7Syy0:YWbvaBelmflsqHEPZIv5nvE0
- TLSH
  T1E5537B86E2908194D967A074D8A30F46E771F6945B0403CF62ACD29E3F6335247FEB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  _internal/_bz2.pyd
- Size 78KB
- SHA256 31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
- MD5 d61719bf7f3d7cdebdf6c846c32ddaca
- SHA1 eda22e90e602c260834303bdf7a3c77ab38477d0
- SHA512 e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f
- SSDEEP 1536:IzXz7Bgrj7FUHfuwtvm8hbvwyhIvtVx7SywqLZ:kXzVMFOfuiRhbvwyhIvtVxiqt
- TLSH
  T1A3838C92B3A495B5F05BB27985B10357E371BD0D03A093AFB794822F2F03B816D6536E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  _internal/_cffi_backend.cp310-win_amd64.pyd
- Size 175KB
- SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
- MD5 04fd1a452e91605545a267cb04cdd78f
- SHA1 482d3bc8b0059d7c755cff695c0366be402c86ba
- SHA512 12549b3a03e869998cc808079da1ca13e00949efa7c15ba97aa510feca2e481bdc74eefa12ab1f6a08d9cca06957a6d4769aa67e9973b59ad4fb9ef04a95b37b
- SSDEEP 3072:1X9Iup1Rz9vapoU+EX+QRhbUvpzLcmIXPpSfJ0KN3kS7ORSTL7K3gqFb2HF:1jL0poIFRhbUvpncmIUGDRSTLOwU2H
- TLSH
  T140046C5A329C10B6D6A6513886579B53E3B3B430174197CF0160C7B52F1BBEABA7FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  _internal/_ctypes.pyd
- Size 117KB
- SHA256 b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
- MD5 3fc444a146f7d667169dcb4f48760f49
- SHA1 350a1300abc33aa7ca077daba5a883878a3bca19
- SHA512 1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8
- SSDEEP 3072:sW66GKh4hqyIVQoavMSutRSfrSd4etFx3FIvQPVv96:T6QKtkSu3SfrS3xr4
- TLSH
  T114C35A1B235400AAEA67507CC5B35E47DB71B859572083CF02A4C69E2F67BE36E3E706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  _internal/_decimal.pyd
- Size 242KB
- SHA256 4f1ecc777c30df39cd70600cd0c9dc411adb622af86287b612f78be2a23b352c
- MD5 8a2530a8d7e3b443d2a9409923eb1cba
- SHA1 cfa173219983c0c14d16f3fd21ea02c4dbb6c5bf
- SHA512 310831ce8bd56b0299536c2059748207d774ac965001b394a16e2dfeeb532be0362e0810f2a1f10dcffffdb0f523a5c592cb3f9bfe56fa766a4c409a2a052388
- SSDEEP 6144:IlUrIgCTez5owfMkgAj6irZD2TGLiOHy9qWMa3pLW1A2Pqil4LT3f97:IIIgiu5LUkgGnqGPY0m3f97
- TLSH
  T14E346C26A2490CA5DE778078C8975B57FBB278840360D38F43A4C9A73F576A327BE744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  _internal/_elementtree.pyd
- Size 122KB
- SHA256 fecc11695287d3972ab854530fc83445eee323f82074e2bef7f86ab4949b6497
- MD5 48bb37c91df6f86179885582dabd1c4c
- SHA1 94f50a9a2a401dc0aa2fb3dde03e05fb887a40ee
- SHA512 bdecf79bcdb692d887593ebc3d8280458709b53b728b6c641fbf113738a552aedf05513a41a9a23c4971a428b7a3028f9e02dbf12d774e0e510e13e435f8132e
- SSDEEP 3072:rd5cohq7BSOEpSHOIS+CgSenCODxN9MJ8MJTMJ4MJ7nH750wgEuRIv1fN+c:rY7BSOAjIS+yEVDb97IDab50Cu2
- TLSH
  T130C34A6B6265C0BFE4A2003CA2664F06D7B2FCA40A4183CF6254F6AD5F337563EA9355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  _internal/_hashlib.pyd
- Size 60KB
- SHA256 9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
- MD5 0d75220cf4691af4f97ebcbd9a481c62
- SHA1 dadc3d5476c83668a715750ed80176dbbb536ec7
- SHA512 c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112
- SSDEEP 1536:J7ejSMEDZN4ghT1mjWvfJ3ZIv5Ihp7Syif:J7ejrE/Tp1mjWHJ3ZIv5I3Af
- TLSH
  T10B537C06A74440A5C57383B8D9930FABE672F5845311A7EF5364C28E2F237C367BA791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32