f9dc32e45b191fca3b297fcee6cb26ab50f4ecb43aec11cdc549ccaab14a156b

Sharing

Copy URL Twitter E-mail

General

Target
Winslop.1.03.zip
Size 46.1MB
Sample260620-j548ksdz5k
SHA256 f9dc32e45b191fca3b297fcee6cb26ab50f4ecb43aec11cdc549ccaab14a156b
MD5 d75580fab27ca9a8436abc09db96db0f
SHA1 efcebc0e4b55b6a987d717319c1f4dc500cbb879
SHA512 7d040048a6323749ceea2da439708f85acaa0a941eb39de6634b76603e6054383c1a6955e7a3f067843b5f9a76fa3b64fd1ca6987d1154902ff94105882cd506
SSDEEP 786432:lxmARJdV0GEliX+GIrCj6VUp7Cu0pRGNqZkoA/nWNgPVcxFZ4AWViLQDDttKa:zmEDVsl2y2HsJRGN3sUQqAeDtUa
TLSH
T1FFB733603576C205DA27937BEC22BD4DA6325328DF42AC5A79BC8AB9FD8F2C05F70151
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1

Extracted

Language

Source

URLs

exe.dropper
https://www.microsoft.com/software-download/windows11
exe.dropper
https://go.microsoft.com/fwlink/?linkid=2156295
exe.dropper
https://github.com/pbatard/rufus/releases/download/v4.12/rufus-4.12p.exe
exe.dropper
https://github.com/pbatard/rufus/releases/download/v4.12/rufus-4.12.exe
exe.dropper
https://github.com/pbatard/rufus/releases

Targets

- Target
  Winslop.1.03.zip
- Size 46.1MB
- SHA256 f9dc32e45b191fca3b297fcee6cb26ab50f4ecb43aec11cdc549ccaab14a156b
- MD5 d75580fab27ca9a8436abc09db96db0f
- SHA1 efcebc0e4b55b6a987d717319c1f4dc500cbb879
- SHA512 7d040048a6323749ceea2da439708f85acaa0a941eb39de6634b76603e6054383c1a6955e7a3f067843b5f9a76fa3b64fd1ca6987d1154902ff94105882cd506
- SSDEEP 786432:lxmARJdV0GEliX+GIrCj6VUp7Cu0pRGNqZkoA/nWNgPVcxFZ4AWViLQDDttKa:zmEDVsl2y2HsJRGN3sUQqAeDtUa
- TLSH
  T1FFB733603576C205DA27937BEC22BD4DA6325328DF42AC5A79BC8AB9FD8F2C05F70151
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Winslop 1.03/System.ComponentModel.TypeConverter.dll
- Size 750KB
- SHA256 d6007b1c4d3fa9ec3b461ca99d0c1f46cc7eea5a55ba6a87a190e92ab124982b
- MD5 90f5086d07ce2c8ee3004ca41b043501
- SHA1 0fc6307754509098b2a41ca4313122f6b9eaba33
- SHA512 fb374225e76ea58dfb59d5a76df236cc0745f01e21c45d2176ed5b52ad0920f4ac96205525fed6ce7d34a5db9324f36f3239b0b53b5d1604be586ec24de51442
- SSDEEP 12288:pMYOiXNSumgcfyTKlIxwfvtuuP7D4Tq0Wbe2ym54K+4rBvq+IGY4XilgW1g:JNhmNfgKfvtuuP3mq0WbY4rBvnYBOj
- TLSH
  T1FDF47B18ABCC2931DB7EC2BEC6274602D171DA83A375C6CB2695DD851FC37C0A6B1762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Winslop 1.03/System.ComponentModel.dll
- Size 30KB
- SHA256 1774db8382c8cdc2cbc2c2f97d00db1db6b459412bfbed9189562630827f2546
- MD5 30551ee29b4255814f484052b0d4a022
- SHA1 7892125962f8e02b44fa39feace4af57f596f924
- SHA512 998ea976f1be0fd35b64498a24135fb78d77a158de4e9b90eb0f7c8ae8fe01dbca08aaa2839f39887cabc9c09f6bcbcb50f7c7a708766382fdc553aa4325d157
- SSDEEP 384:IW4O1W0B0H26+l4cY8/hljHRN7tiwGOrjR9zhkhHJ:L1BN68DjUwGOrF9z2hp
- TLSH
  T1BCD24CE28B684703ED6B1E70ABF8E6437D7C67C69A41865702C1F6491D933C4AB3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Winslop 1.03/System.Configuration.dll
- Size 19KB
- SHA256 8c528dbc9205284edfd2c74a0ed38b9b2d91590f251483b75fa6306d98cb43ef
- MD5 ab3d230e5c7aec8f0e739b6bba4720a4
- SHA1 1db4fc87b5758fd1380c76fca6abe8ef6764c3cf
- SHA512 cedc8e1500504783e6128d7da4abdc6f5be090355449eb8930a74a567a18f25c49bb6503278ae2f25e4fcd4b9d25a08c76ee91b96aedbcffae8b02358bf4ef24
- SSDEEP 384:xMXTSv/fUNRvGZYdf3zyP/wexmldBCCWvGNW2cPDHRN7/kIGTYAsR9zq7ug9:QQxsdZAaMj9zmug
- TLSH
  T14A9208AAD7584E13CE9B1B7295D7C5C26FB81F869831462DD1BBF404085B3C89B3132E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Winslop 1.03/System.Console.dll
- Size 166KB
- SHA256 9137783fef33827b89b1ef63713bbdd70dad8da959be2749fce7e4495078f8a9
- MD5 13449ec8b97924193a7d7b1adde69131
- SHA1 bd5dc73a289f9d0ce9b21bbcd6b37c0c3828aa8a
- SHA512 1bd9ca5d63fb41ca14f1c777503fbe903689313eedd4b8bda1fe2dc4e04a6c4ea379b240710789babe63d2afecdec8a4840aee4e3d5142ed4a68eae15cc317b6
- SSDEEP 3072:T5+c7pvm8u+ukY2u8f43/7v9QJlJxRc47UL:NH48uOuQakK
- TLSH
  T1E4F36D2A97DC2417DB7F86B889A34301DB3768961707F6EB518184C81F63BC2FB355A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Winslop 1.03/System.Core.dll
- Size 23KB
- SHA256 761a1b74fb66052b37b2bdc042a780a4635bd1c2bfe05b22138c85841fddac48
- MD5 36327395bb1d67a692d3c52347903818
- SHA1 0438a3d514b63e661645e51556933092bbf7a4a0
- SHA512 df2564146f78d2a2d97d775ce96cf01e7686a87c22df6d67231d75388c548c186c30896c189c7742e24a0deaabc4750d7d772a3ffca221831fd2e05cf6d43b69
- SSDEEP 384:OT5wIGUpx1zHnOXrxIg+smWf2ucK7XGk9lxkrW1rU1ZXtYpBD+OWXD2WB/hljHRG:OT5wIGUpx1zHOXrxIg+shf2ucK72k9NR
- TLSH
  T1CFB23AA09A8C45B3DC9A5FB19BBBCD8E39F553C79070986E218DE9451C933908F3678C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Winslop 1.03/System.Data.Common.dll
- Size 2.6MB
- SHA256 757a1a89a28c051cac1c22ed68d38f03ebefb87f399b72a72627a8b9e25e33a6
- MD5 642a3bf01ee14185314a915f3cbd5276
- SHA1 afcb21369d394bb5987c4b7805be7f6b0dd6608b
- SHA512 3904c3aac1ed67592b2080e21daa3c76d70b03c2b5bb6d6a4c0a09aed5854872692802a62b88a7d5bf88ef4fd527a1e9977eb3157e860482f86eb13628abd3dc
- SSDEEP 49152:n15hvAnC0nUe6tVFwf7abBK3tycWM5TBiw4:nVxwnC
- TLSH
  T187D57C1663DC0607D23E867C93668312E6F1B4621312D6CF0458EEDA2FD7FC25A7A5A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Winslop 1.03/System.Data.DataSetExtensions.dll
- Size 15KB
- SHA256 1e1f9dfd45ff8e76980cd16e206e6d5427b8346a3033946398f4ae719589f689
- MD5 7dc80ebad3bc48f0b03220b63a1e191a
- SHA1 21e3f30f5e2dce41ea628dc73d34cee0e7c70eb8
- SHA512 ddbb5bd179ad27046ccba36712af69531e619eed0596951bf3b6650749844d09ca632c1893c131974cca9e5b12dc3aa2cf042fee7b1139625802adbcc57e8372
- SSDEEP 192:jXocF/MSbWaM7Wq/ZWQhFJtvUmmnoHnhWgN7acWONaCCGZBX01k9z3AjwJk3r:jo5SbWaM7Wq//hljHRN75aGR9zo93r
- TLSH
  T1FD723AA18B6C8203DDB75D30A7EDD8973D7C67C65950A62A14C2F6482CA3780EF35739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Winslop 1.03/System.Data.dll
- Size 25KB
- SHA256 2d8a4b4361f7f66620d14618df8f6fe9fb98683a665531838a1b4f2a97e11842
- MD5 b833aed60dfa822193abe591a2f2ac12
- SHA1 76028c036d6840cc880372d4ce934af4f32cf10a
- SHA512 218c90ed08bce4b6973916d0a6986d7306c74d31466194729f2f17a0dbf34a81ed4a94efc8b1ecfe50d328384e7a63bec56da202891171ca186b3f9fcaddcacc
- SSDEEP 384:j3/AadfemM82SuxDAnQsENWiOFW8/hljHRN7ylwGOrjR9zh9hwAQ:Loadfem0DmQsfVDjCwGOrF9zHhBQ
- TLSH
  T106C228569628AB23CC4B0BF4B2A7D5033DFF13CEA6B062621594F75558A3341AB3532E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Winslop 1.03/System.Diagnostics.Contracts.dll
- Size 16KB
- SHA256 0fac7904780529f575ffe9f194ad351e034f5f38cbd328b10865e36d827fa0ac
- MD5 6eafbc184fd6663252b305ac407315bb
- SHA1 a4fbb1173db09a0f242bba5d7ab58012acf57313
- SHA512 ae4ffeb6aafbeebe68ac2d693b2e38e42c5b4dad2f0611ea59ab9ec35893feede1973e956b89c27098805904c978d495eac6fe4c45bd62fa8a77e9ccef7916ed
- SSDEEP 384:7SOpteOW6z2WTtM/hljHRN7Q/P3U0R9zeHa4:7zze27tMDjQ049zya4
- TLSH
  T100725BB2C7AC4357ED671E3096B8D9833D7C6BD22A94912A1691F60A1C973C0EF3163D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Winslop 1.03/System.Diagnostics.Debug.dll
- Size 15KB
- SHA256 cddcfd9d0d18f5ec9a5359eee558b96ca7e559509ec7f5e361198b2f076e68bf
- MD5 2336d8f21a688b0445fde19362521abf
- SHA1 c75c924af468d575e12cf6f3b7f0448381c0c528
- SHA512 517eacf768648eb3c28f247aa4ea40e1ef28b85f9d6b23d4470458ffa6261ce715185ab3ce0fadf13659849d082bbdc24d3fac660ae406eb9214892be1711e2d
- SSDEEP 192:4GW5x9nTW2zmWfZWQhFJtvUmmnoHnhWgN7acWEQuzlgnKug8X01k9z3AJJNEBa:7w9nTW2zmWf/hljHRN7sAl8BR9zGJSa
- TLSH
  T171724AA29BAC4203EDA71EB093B8D9937C3DA3C75D109A6B05E1FA461C13744EF3562C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Winslop 1.03/System.Diagnostics.DiagnosticSource.dll
- Size 490KB
- SHA256 1427839d9766080a175041f0fffc7b864dfbd9f64417bc0ae32e58fccdb80378
- MD5 42080c3fcc129233c2803884eea0cadd
- SHA1 ca7ccb659fbf4c4e8a0f1646bf357b816ba51846
- SHA512 dbd9bffcf1886ed3f27825a44942771ab0947cb399864ca4247f058ff304526118d37b9f074a2df323285916e5ff1b45897dd48a3d79eecd68277a1fdc80a4eb
- SSDEEP 6144:FclJ47CNjs3c8vmDqk0fx1TMg7BbJKA8BRg9LxzuO0hUts7gHudM:04eNo3tvmW7TMAbJABG0KJOS
- TLSH
  T1D2B47C1A63D84F11DA6EAE7DC2534802C3F2B6426B54D7DB8445DE9A1F63FC0BE36221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Winslop 1.03/System.Diagnostics.FileVersionInfo.dll
- Size 46KB
- SHA256 2b212da1a5c3ff374383965244cf5ef1c4a7b265239760ea73e73925df67228e
- MD5 42cb36821515348c72c69577e9b4a0ca
- SHA1 b4e64b0ef3b15fe1f943b0e7a368ce0984baddce
- SHA512 272d147b6617ad5a44505358845843e02c9898d8c554873f4623f7e48e1a93b47341890152085cadbded017aa4d0a4537162836c6d4e7ed8add7d7e23a7cc409
- SSDEEP 768:KuCJvtc5kzPq/tDKPivBV7H17thl90W09zr:KuCJvtc5kzPq/lKPiZVL17thl90Wczr
- TLSH
  T143236B08B7E4811BEF6F473899B68903BAB67B8A1360C5FF41C594080FB77C69931679
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Winslop 1.03/System.Diagnostics.Process.dll
- Size 322KB
- SHA256 ea51de08264f67cb31a6b1aa9cf00dd23bfbc38bd3355804fbbb21b0a766aa3b
- MD5 7912f29b45619dfee6efe0ede4bef00f
- SHA1 44fcb9b66bdc3bb5b3d6b54db926de5182657439
- SHA512 3e962d8435dda526bf29d1543c89775522460f8225fb920acceebb8718a6ab97a2686bcf3a77b6bb277727b974ad76590bac2c707a0d36b974edf4aa0910ee68
- SSDEEP 6144:eSqd9G+Lyi03hlS+LeRqJvlv9jb3bG1PjdlTO+Vv1v:eVTGM103hYqeRUiNzv1v
- TLSH
  T1BE649E24AB880509FF6E537C8053D402E27DB4927385EBCB4250D9992FEB7C2D77A267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Winslop 1.03/System.Diagnostics.StackTrace.dll
- Size 46KB
- SHA256 6420dc004ac4839597e1ecf325ed0e7d9e004d46e3247e9da0fd14b08ade340b
- MD5 6ad688bd9c9692e53aceae72a6ccf3b6
- SHA1 46f302346f3dd31fbccc5efd9b874a4f263defe3
- SHA512 4e03401d434c1648c8d019e330b3bed6ca99b60a4c76c1ae52b22137b4524178a6f9a8555a7d8ae45161ff3fdce6d8163cfd0181a5d4e26e4781d8ab728855cd
- SSDEEP 768:j2xWsix2BYH+lBZTTdzE1Cbo4mlFIMaDjiOwGOrF9z6h6:CIs5BYH+zZTTdI1h4mYZiOyLzk6
- TLSH
  T13E236D71D798E127FCEA0478BAA2E9414479DA8517D2AFD70688EF0E9CD37C0B630139
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Winslop 1.03/System.Diagnostics.TextWriterTraceListener.dll
- Size 66KB
- SHA256 26215390a611b90e8aaefe6d92869ed3b0f4223244754bcaba65b682fe8b8a52
- MD5 ceef038870fbbbc88d101f3b83251635
- SHA1 37bc328bdb0399895ab2415745913a72d8830850
- SHA512 2c9b194a7c0c877c72b3ff14337dee308810417ac0c0f4a5d3232a4235739fa6c4a8ceb9dc829add138a84d5cfb4091275956e809811630ea5a0a3019194d852
- SSDEEP 768:+H/udp1ujqeF0cstH2eA8cNtGWRlKoiUUxeLgVtmNn4EVwk0+79ihNroK46DjO9g:+fudp4F5stGHSC8+YhDKzBi
- TLSH
  T1CC634B1663D4420FDBBE95BD86628609E972F69B1311E5DF8989F85C0F8B3C0EF30466
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32