fcaf6e19052504fd2e2ed1bbd42d94f4540bc3ee34aae897f60c7f15a50dd4ee

Sharing

Copy URL Twitter E-mail

General

Target
3.zip
Size 609KB
Sample260620-pgqceaey8p
SHA256 fcaf6e19052504fd2e2ed1bbd42d94f4540bc3ee34aae897f60c7f15a50dd4ee
MD5 a9a607bfffd8712cb58ac359ac517c4e
SHA1 113f83bb5c895fd855aa3c3fc286abf1ae4f2047
SHA512 27d7d883624aeff492eb497ee5e9a592ac45d0a574a052488c09c945eb637ac03b7ce9156bea64bc70d59edd0ea078ec184f472f8669a289f2a8843beb05664b
SSDEEP 12288:XidUGF5TRRPfvSWyRPHfnUZViVNuqba4blseN37Weed:YF59RPnSFR37DLqK7Led
TLSH
T1EAD43302D0BA8847C6D901B521AADC1BB087072D79B466468237152CB9EDF47EFEF97C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ICSharpCode.SharpZipLib.dll
- Size 252KB
- SHA256 32ea2d0ce3512e74f1c7ad82591fe67e6b8939d76a8a4ff9c93ead030131e71c
- MD5 900bf2b7812788efb97eb6b1b63814a0
- SHA1 f77f5a3f19f1ea332384517400684e5c2365e14a
- SHA512 35d93d9281ad8eb191217dc78b84418a4a4d862c4ba43f27eb5e89a1f9273f008cbea08c87c72b3439eb7d9b51dbc8106a361b53d94ee7a877267cbb69678ad5
- SSDEEP 6144:lA/WW316O2rkD3xTxVmLiJyTve+ewWotaDEimWkfzRVtyu5u:dW3ND3xT+LiJy7rewWZDtkfzR+A
- TLSH
  T1DA442A1477EC4E16F6EF9BB9D472528583F6B996252FE7CE5C4890EE2C027A18C00363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  loder.exe
- Size 93KB
- SHA256 25a27f35dcaebd10543b4f41ba0f36822696f1694e89021f3c975967cfb0cb54
- MD5 18fd3df9b673ab74b54603032538ea7e
- SHA1 7387f854fc5a0a9b3c5b370c4ed3071a28a2fa83
- SHA512 03c7c7fa2800c106b73688f3200536737a1b70fed319d33d78b103ad4051692a375639af34e0b49294d8842ecce9b202edfa9a8923e9ed9e16700f5f395dac4f
- SSDEEP 768:C4eX9IbjGnuh1uDJTlNunB6R8ifMyDbDh04i/fzB9xqNAA49:C4eX9IbIuuTu23bt0J/bB9xV
- TLSH
  T1DF93F82AB39520B7D5B2C17D99C20326F6B2702503322AEF4185C5B95F216EC7D3EF96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  zip.dll
- Size 8KB
- SHA256 a962398d6d29a2261ba2f2e799e9ad7e13662eeafe26c5bbcfd19d4f1afcaf77
- MD5 8502954156cbefaf79aaf1b82c02614c
- SHA1 623571ddd4733d0a738ef05b84d3cb6b1f6447cf
- SHA512 0d48bc5b52ef27c216855c5c0c5d4307135fb3da67fdeb1588e593f03f7c292c08c2ee6eceada1b42e16b05dfaa6349a30083b99e255efe80f124c1019275ef5
- SSDEEP 96:PZu9uMAtbqY/Iei0ckac5vxajoWL50hgSlKTDdng2ebtrdxFGzNt:Ps91AtmY/IeiiBxasWL+hKTDdnwtFA
- TLSH
  T1C4F11898F3D05627E4EE0F74DC6287105779E65B895A97AE3CC9A20F1C627000B36BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  zip.exe
- Size 148KB
- SHA256 8cc48575f3143a965f899210cb6a59528298f542007043414f082f1e257862c4
- MD5 90df17e142644b33e6ca6be1419269fa
- SHA1 191e80995f1839582bfd229e927aa0cd062f2302
- SHA512 d774d7de400d63564d331559d9ab21012c6dbeec10355619d068955141b99e31e1bf43c91bc21b643eaa9a6570c1f983ef7305229fd40e00952ba941d967bc75
- SSDEEP 3072:uqeXA/4yIg9vkNPNu6H6xCYOixUE265RJ7:uvgvkNFNaxmVExJ
- TLSH
  T11CE33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8