49afd8741d6cce732ea5dcccfb80775aed67a0530dc125b5910e8ab1a9389eb2

Sharing

Copy URL Twitter E-mail

General

Target
pacnfunkin.zip
Size 260.6MB
Sample260620-jlyaxsdz2j
SHA256 49afd8741d6cce732ea5dcccfb80775aed67a0530dc125b5910e8ab1a9389eb2
MD5 776048f64f08a760219fe4b1de5062e3
SHA1 07110731feeffff3c577b8a73008d14f13a5259c
SHA512 9d9cd96c2deafde17e0e9971f3b93b8b2a88e1a516fa8cfb6f14d365638fea8c6a2901525d30bd085888323e4aeeef06f6f3015c236dabc5ec61260b52cef3ea
SSDEEP 6291456:13iqgQHay/wapnimd98DkqHcf9pcnfRYpLC5vQODMd9:dgQN/HhixlHOcfRiehvMd9
TLSH
T122D83300C6BE1E1BF244353BF5A3D5A0770D16062A63D3914AF6CA9EFDB1AE06F02539
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  plugins/access/libaccess_attachment_plugin.dll
- Size 16KB
- SHA256 a54705b08c68fa2e9a7785a58b398585d619cded11a05c3d24b59ae4021afc18
- MD5 c68f111ab0e80436100aadc721241df8
- SHA1 48f4941359a725ee1a3c82ecd1a151125b09520d
- SHA512 049fef714892c744175ed61e17cffba534ee35aead31603dce1490d2f9fa21952bef2b0c80618e019a59de2053c3f9969aec40a3f33e96c41666cd42f1d6aef7
- SSDEEP 192:BaE3GokHFK3dCXIxu9EdEFCUSuADbg25H1Y3klvwZm3wp2xTzivabcYAfacaE+/n:ZWnHwiEdWCYAI280vwZmGITDHEME0j
- TLSH
  T1DA72E93B754118E9C12FC27980EB97B2E8F6B02152A7232F2B70D7352F70875A669D19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  plugins/access/libaccess_bd_plugin.dll
- Size 102KB
- SHA256 a91051ceb9abd74191c79236782b44fa991460ec69ad92a44844680429c89b8f
- MD5 ba4cce686cdc08f99ba13d5cbe43e735
- SHA1 9aac7cf9e5b5f3f7e578ee332253b13474f373c4
- SHA512 79fffed1f398828cfa112b9a2356d175fa26ed66039ffcbadd168254c5edbefb252aad4bb2a16304c36d836eb9ca3dbc4e67ae54bc3446165538299a5c5e9c8d
- SSDEEP 1536:FMDcOW0rEnOOvDM4jfBSEGsEj3RQ3YSCpwjkHmd4ugjNlmDFejF9J5HtfRN:FMdAMonE9fpwamd4ugjNl6FEJ5Htfr
- TLSH
  T1A0A33911F1BB28ECC127D2B18A4AA0B3AFB3B4D012047DBD5578E7355E29CA1AF5674C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  plugins/access/libaccess_ftp_plugin.dll
- Size 75KB
- SHA256 9bb45f2b74d51ce76f58397e78816626a2f2d933f8d2199e7915e6c78d9ceefe
- MD5 33a3544561696eedf7054ae12f0d8a9e
- SHA1 e36da0da19379c84b93e9317a5120840d72e8097
- SHA512 7c65b5682a044c4f868aa2a7576ebc581b6b827c31dcab176f0b88b66d9c878516ae8640a7e827010374b3013474cb8287a5914a98fbe9ae6aeae83fac240fae
- SSDEEP 1536:DEgYe5cpbYdXHDlMC33PZZPMqGvSSnCfSdA5jDfscrgDLs:DmppbXC3fZZmCK2Hfscrgfs
- TLSH
  T14D731847E29354FDC61BC13846A72372EA31BC1501346F7E57A0EB352E21E60FE6E629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  plugins/access/libaccess_http_plugin.dll
- Size 119KB
- SHA256 5b4a4dc43957b9d9b3065b181085ffa4f30e699b4c94ed19c4a6da6383218504
- MD5 75649f9e558205aa48581f6c806ba86d
- SHA1 88959a7065b770db20663021fc760490acfef4fa
- SHA512 32b78944bb2a0d3c179aff21233be62bff6607623bd157c507020b5eb65c30cdf0a5360c2ab08feb024eaa3fde70046fa6f7ff746be8438b9dbfa788e99b975f
- SSDEEP 3072:IHYGj1F9NaQybeL+qh0ZRxzHZ2ASTBfMcS4:I4GFVyyWZRxAASTBUcS4
- TLSH
  T1B6C32A27F29340EDC0ABD135DAD34272B831B86446356A6F0754D7723F13A30FA6A6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  plugins/access/libaccess_imem_plugin.dll
- Size 47KB
- SHA256 028b53e9d8899ec8c0b7146b0ea5de5ea3e365b4140e3afcb0555ddb5ade3b11
- MD5 b68630b541da0c593ce5bf82daa06474
- SHA1 9bbffd5d3d51842b87200374c58357d7013e98c9
- SHA512 cd29867e4c72a5b03c33d2bbe018c0e2ec0cd83b888f3336f78b875ea1a41a319d4fb58d6454ee7ad988b3c220015d386d0f4ed13a473780c498a8a0b3818590
- SSDEEP 768:dgj7rev+PXrC7zY4dtuabI0bxYueHJoBOSDRyv:dgjIW2X3bRqaO2R2
- TLSH
  T1D523F84BF2D349B9C96FC03589B75672AE72B83102356B7F4B60DA342F20C687D59A18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  plugins/access/libaccess_mms_plugin.dll
- Size 72KB
- SHA256 f0ea6bf3a0a4f94c0430b6a2cc653786972a1d97e4b3225d3246a1acdb52cfde
- MD5 437455cddbcb251b6b23c20fa73c7dba
- SHA1 ff10fa22afa45a2c4c3772664a570742e5019947
- SHA512 ed6ff52cbb2f3c5b81895dc9d2ed621ae2fc60b2f7388bfdd00ea1eaefc3e0cbcf9f5e86307eed2498eba1d3e74709116c5f3fb448a34f90a9dc06eada67dad2
- SSDEEP 1536:TQdMN9UBgR98c5fFZa25HjpSfdl0Nvz/p:TQ6kyec3h5H1SPIzp
- TLSH
  T150732A16B2E784BCC91FC134C6965372F6B2F41112353F6F6B54DE340E20EA0AE2A99D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  plugins/access/libaccess_rar_plugin.dll
- Size 42KB
- SHA256 14452aff55ceb66c722431b8779b0e0fc4465595de3c12834227124c8cd107d7
- MD5 da2127e53b4c22f69667aa6b59568696
- SHA1 74a898c4c1f396485d2726adb9b085ec5fc87e3e
- SHA512 196a457a42b1c785636be5a067a65782e1d90d7c83dd7437873622abe2747bdfbc63bb84bb1a16966c307cf041e85fc30c1c40e7be4736ae81e8ae77f4763c89
- SSDEEP 768:n/FLAMvwqoq0kw4dtZQitD+aFgMIlo+5lahYSI:n/FcgKcDI/h5wC
- TLSH
  T1EE133B4BF29350FCC52FC03885E79772FD71B81122356B7E4B64EB312E20D65AD5AA18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  plugins/access/libaccess_realrtsp_plugin.dll
- Size 99KB
- SHA256 8f20709b4189586220b968627ed7cea5683f5f0c39443a56a2ab3bea46566c5d
- MD5 15b8ae5459056b8c7da9e98b9405742b
- SHA1 dbd7bcafedfcbeedaaa918f7c66ca8e3ada408a2
- SHA512 949ec2adeb8d95f224ea10c3d885545133a4602465efcdbbbda222224bfa124856de796f25ac607364d43741b21429dc71eb83a607d27893df272f4029142d77
- SSDEEP 1536:tNtHjtGE9ZBB/Mrzx7lnnzCNScNhaZeMzfUbSiPQpI9VjqoFh83uoyG:nBjcEPBB+zxqSc7aZtcKofW3uoyG
- TLSH
  T1F3A32A07E29751FDC51BC13446E75332EA31BC151235AF6E6B64EB312E20E60FE6AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  plugins/access/libaccess_smb_plugin.dll
- Size 40KB
- SHA256 98eac284f680296fac909637ca80819cebd089d8aaf7d15f084ed43060254938
- MD5 3d719f86ccda9672acf3ad58fabf3030
- SHA1 3af90618ed8064cec9f4d9c655ea60458bea096e
- SHA512 ca5104e76e2402202bac8eb86b181600cfb9f015c4fa2ef35241c4b14fcae168439387ac4a3ebe3207b300128c08767a73cdcf5d89a874ff3668233034caf33c
- SSDEEP 768:E4SOEaCTIwg4dtkEKsbxuFnJ+oUiZoGWG:EYudVbMJDZj
- TLSH
  T15313195BF39350FDC91BC13484A76372EE71B81122266B3F4B64EB352F20C62AE5665C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  plugins/access/libaccess_tcp_plugin.dll
- Size 16KB
- SHA256 26486b5eccae328496cbaad304f32d75a8a2fd0492c4a0e311baeba56918f905
- MD5 91113d497594afab2199b900cc1592e1
- SHA1 bb031e09413313b76d4f09813f1b546716209fac
- SHA512 4ebf9c493b2d9a7b10254b07e63925b9c5fa942710c7128f18c5e9c6ee88a79d5083c26403484cb8065f11658bbed53cdc0476541993103f523da0552d26a511
- SSDEEP 192:yCtEr53n59bt45WXEmvQxQX/FkKu2BqbG3Xnmpk/2RA/9Cui0gamWab0YA4x++/h:yHF3g9h12Bj3Wpk/2RVuibmgZr
- TLSH
  T1DA72F81FB18214E9C61BC17981EF97B2A4F67021527B172F2B74D7362F708B4967AE08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  plugins/access/libaccess_udp_plugin.dll
- Size 16KB
- SHA256 c22795a6ca8d1aea9b46bbb4d39bea7166bfc48e85f7257bf88957d672317716
- MD5 c3e90090bc22034bcdb0e8e934884349
- SHA1 d682cada7e3d19329ff8f0d948ce8d86d6c18662
- SHA512 36d9e5773daf63cd4235de2aecf9c950f9fd063623f96d13d3f1747b5a994b967c5211b2b3fe48b0ded38c4793dffc6b72872d551bf323bbddc073349630860f
- SSDEEP 192:GeNEWngqA6RhmDuETcfbgKWR0SfHnzRm0r0sZ92/qH9j9sxxAwabIYARID+/HZZS:GzIumr2cUKWR0SfzRm0r0GIxA5gZI
- TLSH
  T1AC72F81BF28218A9C21BC1B981EA57B2F5F27021517B176F2F70E7322F314786959D1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  plugins/access/libaccess_vdr_plugin.dll
- Size 76KB
- SHA256 d5d56bbd49aaca0dbe58d26d3d0f4bbbc94c9b99d9ea4d4b1c13c88b5a8ac882
- MD5 8dd03ef6886e9719c12d53ecd8e60c1e
- SHA1 547cf764eaecc8d47b2d6313d728d62c5430d589
- SHA512 eff42861c58dbfe87dcce8e351c4d9c2e0d25352d77a2255bc9f0b73676d068cfd6c72cab352c20a380cae1b91a77fb1806eb6513ef4df05739a75a46f890569
- SSDEEP 1536:wwYjGbKCTHuHSVaG/+yAMOny1dpdYpUIdNjZgHkB5N4mfDStotzj:wwYKGCTH/+yPp+pUQVtB5N44DSm5j
- TLSH
  T19073080BF29354FCC65BC13946A61272EB31BC1551346FBE57A0EB712E21E20BE5E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  plugins/access/libcdda_plugin.dll
- Size 177KB
- SHA256 71257fd67abe1fef4dbc3f37476ecd6d728a252a169018e2379bc67f073e9ab4
- MD5 523e0a73259ead3db6d363fb20050e2c
- SHA1 6a1cf69491a5b675143a87ba6121a9c113e8f566
- SHA512 16afc3b9bbdc13f94a4503e2c44d6389d2b349ada20b1a7adc60a22c56787e3b0c9093c621b9628348ebaa37f7d361c3f65498fc6b0c71b38ea91be9e3994209
- SSDEEP 3072:cOVLnZqCKaVHITjz2cRqpmSnrpOhnH7EZZ4hj4gAatpKuN2NXSYdOM:L/cSITjz2cRgwt4ZZ46qN2NXTdOM
- TLSH
  T12004E72BF2E388AEC0DBC0385B4743A3F971B8685334E15A479956313F06E746B9D6E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  plugins/video_chroma/libgrey_yuv_plugin.dll
- Size 18KB
- SHA256 f71a61b1378b971c14888d5af9df01998a83041056eaad9dc63ef3d128ecb633
- MD5 cb3c06ac428608f7523a8a3f947c4032
- SHA1 b8648467c48e884e8be415ed6b1881958441f3d6
- SHA512 845127634aadce1deae4d11577efa319cdc72d8472106339b849629d50d5ce8fe70079c25cf905d5bb1b794ea8923735885262225ccb857a04bed739aa043033
- SSDEEP 384:gVCjflAZUNxhteMaM2y9pxfjAXleKKsdf1:gwflAKNxhMMaM28pRAIKF
- TLSH
  T195823B4B78C268FDC90AD234A1D75B77FD727020113B6B6F0BA8D7B54E704708AADA09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  plugins/video_chroma/libi420_rgb_plugin.dll
- Size 37KB
- SHA256 6748430742fb7cfd6ec629e5b8746398df5ad4973334d3515900e11056a509c3
- MD5 22ea9c202ed5639567974c306470fc24
- SHA1 093e161a26a7ce1e247db4f53ad628e7f1f2188b
- SHA512 477bf22ce51bf76c4905d9cc2dd376213a6f9d6ba163b2c193a56243117a12e5d51209b5c5a7c4dbb171ebbf2eec1ab36d0fbe6e16200194304b2af0e9163ac1
- SSDEEP 768:KvxuIp1gXFoYpjuUphF1YloGgSP6iMeDr2dQJCrz:KZbUx1YloGgyrGqW
- TLSH
  T16503285BB3DF46E9E203E0B450D2A673B57630901566CD7A4FE0CA2EB9258A134DC63B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  plugins/video_chroma/libi420_yuy2_plugin.dll
- Size 21KB
- SHA256 fd58f320f3c6bd8a199d8b23983e8c5ddd40306a6ad26897792b7597a6d4047c
- MD5 6f024ee6d0f11c148d67a0d76037ad9e
- SHA1 acd229279b3b0a7044d45563dd79411bd72836fb
- SHA512 5f9abbb052773252ac6c7fc7aa7489912b2c188bd28c2120a802bbf4e6110ba58fc41cbf5c86b235c90370bf9be5a503df1ec821667867ea7b4a148807ce72a5
- SSDEEP 384:7ykYVdj1aj8JhTNMwBb4+b4ELSTwkY2Hbd6maR6aTO/vX4WRMB:EV91aaCwBblb5STwh2Hho5FW6
- TLSH
  T14FA23C17B15788ACC66BF17581DA4EB3F7FB701050216B1A0AB0DA310F72966B73DA27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32