9395981b714f0f561d0163a1f8ab16c7be8ae70ee5356e49939d4843beb3f2d7

Sharing

Copy URL Twitter E-mail

General

Target
z
Size 15.6MB
Sample260620-wt2pjagv6q
SHA256 9395981b714f0f561d0163a1f8ab16c7be8ae70ee5356e49939d4843beb3f2d7
MD5 07d13253b53e6b2f6d6a30808148bda0
SHA1 7cfff2cdd7f3a98b5548bc068b88e5e412a0a66c
SHA512 d6e69a12eafb712dba3f17ce9d4cc607ed2ca2fb26ccc6d050ae028d3a05c48dfd1f8ea3bbe30bdf37a41181b17ec111265157a1a2554b415ecb976b8c366d68
SSDEEP 98304:LVKTmWTTWTsACPwaxuTcjcHCh5Nr0Trcp7cnuSwu5l4Ce7/ZTmIZv9lX9QZ:Qy4aIACPwaxu64u7QfS7cxTuXhZ9C
TLSH
T1ADF65C67B94F4976720084B0524FB414AB818AAB25341C65FBDDA37C3F15ABA60BF3F4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  z
- Size 15.6MB
- SHA256 9395981b714f0f561d0163a1f8ab16c7be8ae70ee5356e49939d4843beb3f2d7
- MD5 07d13253b53e6b2f6d6a30808148bda0
- SHA1 7cfff2cdd7f3a98b5548bc068b88e5e412a0a66c
- SHA512 d6e69a12eafb712dba3f17ce9d4cc607ed2ca2fb26ccc6d050ae028d3a05c48dfd1f8ea3bbe30bdf37a41181b17ec111265157a1a2554b415ecb976b8c366d68
- SSDEEP 98304:LVKTmWTTWTsACPwaxuTcjcHCh5Nr0Trcp7cnuSwu5l4Ce7/ZTmIZv9lX9QZ:Qy4aIACPwaxu64u7QfS7cxTuXhZ9C
- TLSH
  T1ADF65C67B94F4976720084B0524FB414AB818AAB25341C65FBDDA37C3F15ABA60BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  xform_test/auto/install-sh
- Size 13KB
- SHA256 608b76d735bb2ec2bcb1271644c3d5e7a428fb8d2338e114e8a48ebf91ccfd23
- MD5 6e5fe73723cd40a28adc5b7b5650c8d1
- SHA1 664bbfb27be6eb13791003c4114d95a9c3d51ea1
- SHA512 2e1d26568645091977785de2e17ccf4ad25d425d9c7295d34397346527f330ff0f60390a473408b481f4f4fd2a7203d9cc09d468306cfe84f68990ce3090c43c
- SSDEEP 384:cdj/jrwNhZgfUnuAV6vhUMqRAJ5RkTpswaJHsvT93F:cl78NhZgfeuAV6pUleJ5RkdswwuVF
- TLSH
  T19452D78DB3882B30344282791B8DC091972A811F19B5692CB9DFD1DC7FB2638A5F7B75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  xform_test/auto/ltmain.sh
- Size 276KB
- SHA256 0d404f35780a8e2d9d82a9a34b122f0b26c8c423a2f8bf066fa5a28d1feb83ff
- MD5 fddd00ca15b3cc3caa3b3f6d367a2daf
- SHA1 1951c7cc2365881ffa2322c9d2a594a1e1bb65a7
- SHA512 98b8eeb918779fa02fde0c3d80eb528c9b194f4bfcf27dbb50b69c3c355dd06bf7853e545a11831eca7302d649d5203f933742f678f1a437d757df8b4db97df9
- SSDEEP 6144:KYVLkDuGa87Q+VdRaG+Ba5IjdTz7HLVFTuMJ4pVHJlUsfclfrII+ELDpRgtmbLzz:vQjySrwy8
- TLSH
  T188540715F7AC55B47296526EDACBB44A9774823727244D10F8CCF18D3B2382C72FA29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  xform_test/autom4te.cache/output.0
- Size 267KB
- SHA256 6d503c68fccc53af40d4b1bce183d2b69c5057ec52d67876a5efcce85c173c70
- MD5 78fccf1ba0911df7d4cb7f0c79585cc7
- SHA1 289695e537060fb953728653269491866e7456d1
- SHA512 958498f121903fce3d0786185a7be77a0d72989bfc292c9a7fef148788614c090df300c3a8f318d6e232af596b19055d33359ce9f9125eed00020104742c4a8b
- SSDEEP 6144:OUx9sTzhkAmDIQ4bMZyQ8QPTxoToVqy/8Hd0bKXfvSFrhOZ8Q+pDK6TvKwziCQG2:y8OuJNy+8nV
- TLSH
  T17C44FAB37947887A2210C9F0129F7051B6859A972A711C96BBDC63783F146F6E0AF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  xform_test/autom4te.cache/output.1
- Size 679KB
- SHA256 f3251a740ff53011fbb5fb44c7d929104562cec04ca9ae0f54ae9dde6f0ebea8
- MD5 9364cf86e7a3caa8669a02ad4bd2eef7
- SHA1 192009d0dac9452b3fe1d5a6a2cf12303327986d
- SHA512 1743b66f1d0865aac5e72053c6fda76384dd681de8a5b481dd11b155d6fd50c820f7cd89aa6c6dedc918b4cf22f35c1c5f180e65f54d3b9b1c690b26ab21b2ec
- SSDEEP 6144:OUx9sTzhkAmMIQ4bMZwQ8QPTxoToVqyNO8Hd0b+69WUvSFrhOZ8Q+pDK6TvKwziV:5k1O6b6PIohSIzTI4ONysP6JnV
- TLSH
  T18FE42966790F483A3250C5B0569FB414A7818AA729315CA5FBCDA33C3F156B6A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  xform_test/autom4te.cache/output.10
- Size 677KB
- SHA256 bb0d53a8becb2a926535d4c6102e9ac61c2264fb671fb278bf80449409c4b03f
- MD5 0850328821f246f932f4e5b581d76ac9
- SHA1 35e54a1eacbf86cc9ff27b77a6d04430407cdd7d
- SHA512 22afa88512317f731d053a806628720a2202a02e71a020bf0142d491e92c259a0f8b610a3c34492106854ee5522d4290b8fc1bb1e2afdc7e96747e9608ae6ade
- SSDEEP 6144:OUx9sTzhkAmMIQ4bMZXQ8QPTxoToVqRxJ8Hd0b+69WUvSFrhOZ8Q+pDKvTvKJziO:5gQO3NkWishHuo8iavtygtwYxP
- TLSH
  T1A3E43A67794B5839324085B0569FB415A7818AA729301CA5FBCDA33C3F196B6B0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  xform_test/autom4te.cache/output.11
- Size 663KB
- SHA256 9d81dafa602429fb3e0f3be9f6ddac33ba7551bb4f74893c60c552a119f6e258
- MD5 0d45ac6456909847cc0e190026b8baec
- SHA1 88e6bd6c9787110702b7be68272be8aa182819f5
- SHA512 06399311bacee42ed6b6006a2c1c5b13755fc0e07b104c8699cf4424781fdd53968040b33cfb50ea2b7dea9a1b32c7bb6f745f02e62b1aedebc8aa490d65165e
- SSDEEP 6144:OUx9sTzhkAmMIQ4bMZiQ8QPTxoToVqRxe8Hd0b+69WUvSFrhOZ8Q+pDKvTvKJziw:5VTO3NkWishHuo8iUtygtwYxP
- TLSH
  T14DE43A67790B5839324085B0565FB419A7818AA729305CA5FBCDA33C3F196B6B0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  xform_test/autom4te.cache/output.12
- Size 663KB
- SHA256 3df22545f0d5ac766dc0a0401c9023f7d33e38f78a9362dba23496e574527e63
- MD5 afbabf5a4270837948a5d506e2259fc8
- SHA1 dbf04eb8667f3ecc3401e2450ff23b64d078ec18
- SHA512 2e8f5046381d2b1fd196635e6556f9e5b13fc17b98fecd805853a6b18f16b0260f77ae5ffc890b3f1f23f22540cc4f246b4cb0384b3737cbbbb55d98c675d8cf
- SSDEEP 6144:OUx9sTzhkAmMIQ4bMZiQ8QPTxoToVqRxe8Hd0b+69WUvSFrhOZ8Q+pDKvTvKJzi2:5VTO3NkWishHuo8iUtyyzwYxP
- TLSH
  T191E43A67790B5839324085B0565FB419A7818AA729305CA5FBCDA33C3F196B6B0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  xform_test/autom4te.cache/output.13
- Size 703KB
- SHA256 2bb2d37cae969aed8d28087d33ce530f91f314ef6e8626e5772b76e3882ea41c
- MD5 72a831370ae85af809492eda35e780aa
- SHA1 00e2840d90a602d0ad9f28135e17472757335ff1
- SHA512 874c5ce622c028c169fdc90afb66af9cb0654c55a88602fe8e2a10c069239bd1ef2300f331275f88f78a74f119b0f668a8df5fc57de343e71d1d4649b36ff5cc
- SSDEEP 12288:5VTO3NkWishHuo8iU+2Gg+mUmAqIQiOE0U46Ew0iC4gySKk0i0jOAxMyGL6hwE8z:rcibiUDxP
- TLSH
  T144E419B7794B587A324485B0125FB414A7858A672A301C65FBCDA3383F15AB7A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  xform_test/autom4te.cache/output.14
- Size 703KB
- SHA256 c17abc4bc4e937048282de7e757697ad04a058441ac2c19b5d700cea4687fff6
- MD5 0da2c4330066092108f851f7f4c0cf4e
- SHA1 250e1c6f33a3b8fb250ccf7a7a5e83bc4cb3c518
- SHA512 30e91a383b5b1cc1f8505434c0796acf39254386ea0317f6f4ced2e371da245ea5edfc56078e3f97a313dbf09f087bd0bf657a4a7630bf09940c10e29c2d556b
- SSDEEP 12288:5VTO3NkWishHuo8iU+2Gg+mUmAqIQiOE0U46Ew0iC4gySKk0i0jOAxMyGL6hwE88:rcibiUkxP
- TLSH
  T1D7E419B7794B587A324485B0125FB414A7858A672A301C65FBCDA3383F15AB7A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  xform_test/autom4te.cache/output.15
- Size 781KB
- SHA256 3be186b60d8b51d303b4f4f082c42c97fe35976a2236e39750125ec1ca9af557
- MD5 98fb088b444e1f4bf5f4989e48235687
- SHA1 3aa1ff73eeb2dfcfdec50286e7a4493e6087989c
- SHA512 91433fe87de06d6529db93f2130a887ffc58a29c2690c55ea6ae65828ef2e8d59ef0518cd8be6161ff6ec71e36c4d642a1498f1bff72fc0ca704b8bf5802c046
- SSDEEP 12288:d3WO3NkWishH4o8iiQS+2Gg+mUmAqIQiOE0U46Ew0iC4gySKk0i0jOAxMyGL6hw/:Jjipi5STnV
- TLSH
  T1F0052AB7794B487A324085B0525FB414A79589A729310C66FBCDA3383F15AB7A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  xform_test/autom4te.cache/output.2
- Size 755KB
- SHA256 745ae6cf3f18f87ed079af8a2af327c84213da1ff129ade5c43bd0a5b85463cf
- MD5 52966d6316c423c451bfab7d247da0a3
- SHA1 45b02423906cfe51abad4b4545790fd9dcbc92fa
- SHA512 c2ada43e7f9f1b4d288d424526283eaf5e09a6ac786065ee46f8f71f8449aaecd4dcc6a88eb74558857f4c0bf73d7591976a6515f80ac05a888c671b0405f49d
- SSDEEP 12288:54ZO6d66IDhSIn3IGI//ZO2Gg+mUmAqIQiOE0U46Ew0iC4gySKk0i0jOAxMyGL6G:q3IvIF//ZbnV
- TLSH
  T102F42976794B487A3250C5B0125FB424A79589A72A310C65FBCDA3383F15AB7A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  xform_test/autom4te.cache/output.3
- Size 790KB
- SHA256 3bf3e65d0e3699f89b4645bf581fe9c3916ef35156eaaa8526bfa6aaeb054baa
- MD5 8f17ab7023928b817e5a92517b8e290a
- SHA1 a11ee04d67c1c27161e9f151cf1f21a095caf96c
- SHA512 f48083d6fec36492d19d244a83703debf44f75be46687fe58571a98b1060b809c5b28ebb65a9fcedc011727d9b5718c006390ea0b01fd167c151e3d5f3c1b498
- SSDEEP 12288:5AtOHd66IDhSqVn3IkIH+2Gg+mUmAqIQiOE0U46Ew0iC4gySKk0i0jOAxMyGL6h5:yoI/InHinV
- TLSH
  T18C052977794B487A325085B0165FB424A79489A72A310C65FBCDA3383F15AB7A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  xform_test/autom4te.cache/output.4
- Size 702KB
- SHA256 9d1d1c1af52fbf870670fcb080c6fa090e0d7e66d0928154c8737e0b429e8a4a
- MD5 12cd0407028022c2898b24ba79410710
- SHA1 a5635b3a6464ed60c7d22bd553cbc859957a2c7a
- SHA512 fbe49e9ae7cdf9466cd20fd3d58983a5ef6f07f664efdff36ec76e80dac0cbc12ace69c863b443818fc962cd847ee220e9bd9d7974551e2ab5a747c80e02ff6e
- SSDEEP 6144:OUx9sTzhkAmMIQ4bMZ6Q8QPTxoToVqRxD8Hd0b+69WUvSFrhOZ8Q+pDKvTvKkziw:5d9OHb6PIohSqVzTI+DtyvW6YnV
- TLSH
  T13AE43966790F583A3240C5B0169FB414A7918AA729315CA5FBCDA33C3F156B6A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  xform_test/autom4te.cache/output.5
- Size 774KB
- SHA256 f1291b356697517ca271795c7f4a3aa8e90418e325f0350d947b053f741353a8
- MD5 8719f3f20fa84e4629ffa102257a0bad
- SHA1 797826d7709b1a38edb6222c1095017f56ec5f6f
- SHA512 c6fec3eadad593666ff423609a452f4ea32f5e988f2d34f0b71f49264f63c4825d400977a1876cd74a7f310dc55d396ec50000ecebe5ad5124a5686238a57553
- SSDEEP 12288:5o1OHd66IDhSegn3IcIOIZO2Gg+mUmAqIQiOE0U46Ew0iC4gySKk0i0jOAxMyGLb:6MIUIvOIZTnV
- TLSH
  T1FEF42976794B487A3240C5B0165FB424A79589A72A310C65FBCDA3383F15AB7A0BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32