6582257b116dc9396ce34c0bccacf01115877432f730048c594420d360448455

Sharing

Copy URL Twitter E-mail

General

Target
aStarterH.rar
Size 85.4MB
Sample260620-jkn1vsdy9n
SHA256 6582257b116dc9396ce34c0bccacf01115877432f730048c594420d360448455
MD5 50803b9287c3c36ff5809eabb4aa1682
SHA1 ffb9ae8012a1da509751856c79f9c7586892668e
SHA512 530bd1ed09496f8534559943caa996b2c615db5412a3c1721d335bb94319a49d75822088aa7715384b8729ef1c10c016d8cf2f9b2a55f4943d1fa82caa4e451b
SSDEEP 1572864:Z26nOhD5MFwSxhWacN/CtYcSuwoKZiTrLPEhWFTozyMpTngSn0eaKPIHJU:hID5MFLxhWBKTKqvPEQMfPIq
TLSH
T1F91833355C344BD1C242386A37F21B0322F2870B5B6065ADF367A7B4A73F5D16AE9368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Tasks UI/Bypa66er/fiuyty/data/Decision/CUESDK.x64_2015.dll
- Size 299KB
- SHA256 6a7fe2b27cb7b5d440dfb29ccb0276c28bc40cf2a96720185300bb100b528949
- MD5 1424ee0f94a1d3b38ab3cc48786f1508
- SHA1 ba8175df831c080601cc72afc503eb034627ffc4
- SHA512 646a3bedcbadb96d0b0be43bb9069e622e7cda26240538c864ebaad658e684771b675c303058116168c6f65738c70cbda9b2217e162be57008105e0682d57fd3
- SSDEEP 3072:7tj899Mb6v5rMT4d+CqwilMURXI96GTRdH+Grp:7aZv5Q4IjwzUGTT+Grp
- TLSH
  T11354082ABF148D62D56791BD8983CA49E7B278114FB0D7CB61C1932F2F33AD15E3A121
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Tasks UI/Bypa66er/fiuyty/nvngx_dlss.dll
- Size 42.5MB
- SHA256 ad3e9c07ee864e9702032459a59c6825166766c2cb75bd0318d5626595693bdb
- MD5 117595d4839dcab18501249cbeee9b7a
- SHA1 7dcf6b8f8573851f1ccd05e09657dd22758076fd
- SHA512 d90a8ea861347648e9fbab1b24bbc8430e78701f30a2ac289ab20fd2d7f5b93b9b641a2e2b8f4193597e62a5ffe4c717df9f1a912338acc5ac3011fcb1300e2c
- SSDEEP 786432:FKOJxTs/ma1q3KOJxTs/va1qiF1kowvTibaLs0saBHhXtjf+/AkOL8SLeCy9ekHW:gOJls/ma0aOJls/va063wvTibqbsEhdl
- TLSH
  T1FDA7E0D96282C9DFC6CD4F78888BCFB8D4ADA00B003556D74AD81D6F2D57BF84D2A942
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Tasks UI/Scripte/D3ED2CE4-AF6D-48C3-A912-13D29FC1C575.dll
- Size 93KB
- SHA256 18fed89e6eef3b8d89a3edb7454aeac47b92163419b1b46aa6c75627420c5daa
- MD5 9789a52ed94537d27190f2380bfe38b1
- SHA1 9fa251f70a1cb2c97d272035a5a68632c374e4f3
- SHA512 fe6c4153a77c3f6010054250b968a5767909f5b10491729f6224dafaf5181eecb702e9043da5972a9ea0004182a9456a5fc8a2aed996c99f848106c8f569713f
- SSDEEP 1536:SqXFdL3+AcL8y51ZtWMccfWyWChZ7y5Jz+8U0Dqo6Z/mI3PxDo72XUx6Vzo1PV7N:7FdLuL8KZtWMcAWyWNQ02o6Znhe2XUMo
- TLSH
  T162939E11B60A8431D6DE813D69A8AF7F537F63718FA204C3E790579AC9206D37E30A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Tasks UI/Scripte/D652FD4F-C88B-4185-974D-5FDD1E789925.dll
- Size 91KB
- SHA256 a8bd4ac257e022253185cc1bd491f864dc7c9c0381c8e903079d2302976ed5bc
- MD5 397d11ef6e82098894a09c69673accc2
- SHA1 9555ff908bfbc1f46f29e12b84005aa462f71e72
- SHA512 e25caf2575509a1a084b89354612ca2c248b735f5e0bccc169b32672581a75208be4edefd255c0d44f25525607791bed381c737dc793d31c2fc8d6a0a9f0f92a
- SSDEEP 1536:QW7dj+aYp4LTBQQ2SJmHRzPWq2ioPfnTeVaW0NFY5Mgr+GFaixFrY72XUU6VzM8W:QW7d+E2SSRzOqAWN5Pr+GPFru2XU7VzW
- TLSH
  T1DC938D11B64A8431CACD827DA978AFBB537F63709FA205C3B7546759C8206D27E30A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Tasks UI/Scripte/D7DB125D-DFAA-4CCF-BB17-80A467153001.dll
- Size 211KB
- SHA256 d7781beebf438339b82085e9140609fbdd549d573617c8d71134754afeb58f8b
- MD5 52347e9dbaa2953f9114777676c26021
- SHA1 578caf4c74fef94231268a8b08b9d3323405d632
- SHA512 f7eae9d8f5d1176b329719ccf221c26374773fab37a1cbfa0490d42bc182966b0844917dc0f0433a3f6494f9bbb2df47e1a06be0465c44543accd2d4c4f7c945
- SSDEEP 6144:Ht+yqaQEeGHh6lp8CSiKgJKBZ1kgmwj2wdQWkS:N+yq9GBJZiKgUB8To2QkS
- TLSH
  T1D8246D32350EC03ED69F12B16D7EDF6B517C6A600BB644C7B7D8AE2999704C22631A37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Tasks UI/Scripte/D9BCAB19-28D0-43DF-B8C8-E6F2D46BBBA0.dll
- Size 119KB
- SHA256 7c51938bcaedaff9feab721e7f2677dc8c2cb40d8d0747a549d4f74a97fb373f
- MD5 ca92d9813930e1400cb6990e3985dc95
- SHA1 fd07b76195c02281f4d22f74402473d04c567e05
- SHA512 3ad0a8c8fc979794695810129f4a9576acc802cff020fc2040b094f9f8b99cb2b1bc5eb612f57a01ad6e4d3ee8e6d31d254952b52e248c21b037099d1c0b6958
- SSDEEP 3072:1ySjpNARKco3b1Xh1s3pHR0tWH53jqO21Xx7tQ/2lcwMBovXJ:3dNLRJ66kBjql1XRgwMBKZ
- TLSH
  T136C36C223A098175E1D9117D19B8AB7F833F76B2CF7185C3A3A4A65A0E309C26F31757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Tasks UI/Scripte/DDA99449-F4B3-4C82-93A2-1BB97D34737E.dll
- Size 154KB
- SHA256 b72a4412667b42123632555ea3eea65999ad3848cc413829c801e8318852e4dc
- MD5 4c53d5603d85632da9658ac165d70c62
- SHA1 d71e2019078a146664a61938eb3e3c89bf5faf34
- SHA512 7fc3a0a9167dac7c870d3874955af0973f5e4eaa3d0a57cf9914126f16a424a35f33c46ff324d452678f4545616feb09931181448c0b924ac3e086ec8d48ec53
- SSDEEP 3072:H6xWgSl33mzqycPWTZsaoniAQvZsMWO5ClM2nUYpWKh7MX:f/lXPWTZsarZNW/XUYpWK7K
- TLSH
  T153F36B12760A8476E68E123D7AB85FBB437F76708F3502C3A7949F1D58205D2BE70A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Tasks UI/Scripte/DECA94FC-5917-4D16-85C1-AB498BCC8467.dll
- Size 90KB
- SHA256 00e0e36eb7d65723ad9dd5ca82b570e6ba10dd8194cb97f3763b2955503aa9f8
- MD5 5a19c7aed26189eb6f199e5b18845f4a
- SHA1 89cfa22a1f059ae23139b5349568555808f968b8
- SHA512 f28f8a35d3b77c85ce4557dde0eea701d4b0d00495ecd27f8d82b1ab5a4b5fa9023fcf5f40e49b7dbd76e1e14c01565e1a1f643149bbf01f1c5bba6770f2fa49
- SSDEEP 1536:8/gds5ga6I0DlaMYKtZ92njG7wzFPy8gXJauLJu2KVe0Y72XUU61zKDsU2N72mDk:8/gi0DljYKH9gjqJ9LJuHu2XU71zKd2I
- TLSH
  T157939D11BA069036C64D423575A8AF7F63BDA3719FA201C3A3966F5E8D301D37E70A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Tasks UI/Scripte/MessageBus.dll
- Size 5.4MB
- SHA256 a92f762078ec06563481387528ac8548ebbe99793cc86f7cbf0f8448b6fefe64
- MD5 c9edcdbb26a8c972686133f605590b4c
- SHA1 dc6dc1e155bb418c78dd84b35b16a997c76d9fb7
- SHA512 702e590f709526c10822b862395ac34de1859645b34cd0b78ebf4960ac9bfd41e92387914c8c14a69015ee548a925c4e41a4c0708f8b8fc1a5197d5832db1e8c
- SSDEEP 98304:sOOD636bH+GgafsZP/adWhgg7anyhBhSlHmvpa8+0yh3bGsNq5zL:sb6KbH+GgafslCwuG+0u3bGQq5H
- TLSH
  T12F46BE217B47C471EA8E8276047EA7BFC57A96088B3145C793982F3E9E341D31F36686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Tasks UI/Scripte/NvMessageBus.dll
- Size 2.8MB
- SHA256 3764b8477e46f7048d00f583e7ad128ca4b603b59e01e19fa57181e527c925c9
- MD5 5b124cc3deb549b87c1e631f918fccfa
- SHA1 23842633a946d9619bc1540d480b38ac99a4fb4d
- SHA512 3fe4f40323609e0de5de7cac3b0698901fbefaacf9e8f32b791d7d99c0a68c5bdb74b43d604fd6d5acd8d7ae8d38c1bf53d858dd1485c7d2722390d3fb1ca09d
- SSDEEP 49152:idaCEkIuI/WjU6rxu7bYJzRxBng3ycj3ZSNygqxjygzP4XUcMMNs2lR051Jig0V:icCYW/2ygzP4Xskd9
- TLSH
  T179D57E303757C836D68B6276496EA67F579CA7500F2104D3A39C2B2FEA346C31F32996
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Tasks UI/Scripte/cpprest140_2_9.dll
- Size 4.5MB
- SHA256 fa60ae65da98ce7f0c1257477b858fbb5af442d1a1c2c80148db580205cfd130
- MD5 851346032fa12fb2cc44db55190ac35f
- SHA1 8579fc2fefcc590ffee7c03cb79bc549f6a5f7c8
- SHA512 5fc77341ddc9716455f5addb989ddf13b68d9bc212a66f145c5cfcf279191fdf1bd18a8dd8dc4d97f714acfbcdd57a581baf8f7c2ee3352dbc91a6f9e68127cf
- SSDEEP 49152:ttl5ptszIrNXLsXwTTRRZ9xTKj31CzYTraPr8LvwpiuGwI9VquvJn:ttNrNXLsATTRn9xOj31Pfl
- TLSH
  T1FA262C707F12CA79EACE01B69D7CAE3F9819CB850B7809D7C5AC19193E615D20F358A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Tasks UI/Scripte/nvngx_dlssg.dll
- Size 7.3MB
- SHA256 907b036e714a674aa53dba1ecbb251802a684cb684d1ac2d11da85742f2ea906
- MD5 11ecc4bf7fe5cefcf4a737e95b6752ff
- SHA1 6b86a13666299c69d103ac3780ec7daa42ac0c1d
- SHA512 2268a1833aeea3f089c63ea78257edb0137fbc8f718fc64dd2870ef65841fad1f7606c067aaebda578b2845685e511cf5885c61de9f2e14b64f2bea72ad2f921
- SSDEEP 98304:K987yHuh33Ui1QH35lJLa70+FBv7VHkjz:K987Uuh7+H5h4VEH
- TLSH
  T19E76E14DB185E65BC246063D85ABE795E6FFB803022856CFAB8057FB3E63BF50931910
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Tasks UI/dstoragecore.dll
- Size 1.4MB
- SHA256 77c7b3acf5b5a9acec6ad3ed7aa3c33e1ad43e73116b437adfcd26965a079b2b
- MD5 32aa634143aaa6d4e9f57243784e61b2
- SHA1 14ff1f82dcbfba05326d19dbdae0d3509df1640c
- SHA512 9c657b8b21f7f53bbe027ce0f562dcaaf33060f58984bad63902f630b0045f6ed95af93f9edff2dc97b238f659369480e41e27df5902f3032a0d3b433523c9ac
- SSDEEP 24576:cf+Otoo2yGCcUjJ/4JZp4ZpvoqzAwy+KbP/b6m0edJanB:cf+O0yGCFF/6Wlowe+9TYanB
- TLSH
  T15D65AE43516254E1F6AAF27FC8A991C1EBBB7C100B16CAEF41E1413A6B377D46C386E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Tasks UI/dxilconv7.dll
- Size 1.4MB
- SHA256 20099a4aa1207f557a14cc8bab795a84c479a318929fc8c4ca1fc9deaef7fd3e
- MD5 cf0ae82deafd5f795c654156aa79d493
- SHA1 de0f014a89dba080768321cc9b46c96a1e299657
- SHA512 2a4d1c3605294d99ca42b0cd5fa06c863b20685c8f1f16618aaa18d406d0b45a448ca084518aae8e300a46e921483b214326ec87d39bac91728370874824922b
- SSDEEP 24576:qsmC4ESpiqYkfyKBpS1GqzBFrwCLCwEApL1/aT6mTdD6lo3BTfjB:q1CpSp8kfAJzrkwE6LUFTdDtTfjB
- TLSH
  T12A658D2A269841B5D1BBE17CCA96C94BE7F2B00507709ADF03B0065E1F27BF5593E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Tasks UI/msvcr110.dll
- Size 854KB
- SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
- MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
- SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
- SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
- SSDEEP 12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
- TLSH
  T19A15BE12B6D2C0B2C57200701628E772597FBA72547999BBAFD98E0E1DB06C0F71B772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  Tasks UI/msvcr120.dll
- Size 948KB
- SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
- MD5 034ccadc1c073e4216e9466b720f9849
- SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
- SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
- SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
- TLSH
  T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  Tasks UI/opencv_core220.dll
- Size 1.9MB
- SHA256 17c4ee5bf988b1ffcaa4f26f48c0b7e999a342084fec120fcb03a472badd58d2
- MD5 a18710c4ffe33ad7d45eb64f2dc39953
- SHA1 e6648c9e7137bdea3b9dce32da33ad46bdba424d
- SHA512 c6add7eae6c819f83a82a741dc242c4742db62e5664ef7dada6f0e87228a3c06795aa50b120f402bd112724b74ca8e7d262fe8c8dffeec7d56bca3f1f62bd2a6
- SSDEEP 49152:nNj3hivukQ2hYS+NqFlHR5XIvO/21EEt/GfjN2RN3PdyGcxlK6CIr1TsexMZS:nNj+lQ2r+NqFlHRBMz1EEt/GfjN2RN3M
- TLSH
  T1C295BF73D701E126F4DB80F6535DAB5F98284235071258E3F38C5EA7ADB4AEA9E3410B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32