acc0e4f6c29cecaf8a04d42c3b637143d183af1ea46da290f22d47b5223704a5

Sharing

Copy URL Twitter E-mail

General

Target
AimmyV2.3.0.zip
Size 82.3MB
Sample260620-xn29jsgz2p
SHA256 acc0e4f6c29cecaf8a04d42c3b637143d183af1ea46da290f22d47b5223704a5
MD5 7c5a9e8f1ded6af5635926e1ad9bc48e
SHA1 5a1f876ffb3b7570fd24251149ec2a08bc549b08
SHA512 5c05f5f4cc2ed387562b4e48410a2a364a4879c9790981e1560837635af740c116d230944ade08344862ccb35106df009935df0dac9c431e065d7c297528030b
SSDEEP 1572864:yE1+Gl9lmsNfNoAnuWjK11evDUdBpu6Pg5AbAOqXe0im3oAOqXe03riZNPY63:oGl9AMN1nuZ1svDCPUNimveZJT
TLSH
T1B01833F89EC8A093DFC60D365DB5DFD2D20C413853528AA5EB1030CB169A4947EB9B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AimmyV2.3.0.zip
- Size 82.3MB
- SHA256 acc0e4f6c29cecaf8a04d42c3b637143d183af1ea46da290f22d47b5223704a5
- MD5 7c5a9e8f1ded6af5635926e1ad9bc48e
- SHA1 5a1f876ffb3b7570fd24251149ec2a08bc549b08
- SHA512 5c05f5f4cc2ed387562b4e48410a2a364a4879c9790981e1560837635af740c116d230944ade08344862ccb35106df009935df0dac9c431e065d7c297528030b
- SSDEEP 1572864:yE1+Gl9lmsNfNoAnuWjK11evDUdBpu6Pg5AbAOqXe0im3oAOqXe03riZNPY63:oGl9AMN1nuZ1svDCPUNimveZJT
- TLSH
  T1B01833F89EC8A093DFC60D365DB5DFD2D20C413853528AA5EB1030CB169A4947EB9B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AimmyV2.3.0/Accord.dll.config
- Size 213B
- SHA256 3049e83f9b7fa9285a82fb3c7740e9c225b66a31f805d3582a9bfd34b5dd8e6e
- MD5 08a09a4c92f3b8a8ad1b1c268049bea1
- SHA1 5ad3f318e9e5470db33e3080e864f887063fcc5f
- SHA512 ebb465a0ccc5a001eb23357ee0807f86b9bb92b285340a6679dd42eb6efe15fd4b965f44a7e9c3115aaa51f777415ee37152ea9c9e73f749538c170f8b84ab64
- TLSH
  T140D022C2E8BC0F72B0D1634620DA2E9C0CF28085C40E0108982BAAE8297294ECB13ECC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  AimmyV2.3.0/AimmyLauncher.exe
- Size 161KB
- SHA256 f9b275cef715b35cd5357b881bf2e62a22a6ea01a46f917cd2c072cdd2b3a18c
- MD5 1b61edaed8b5543cd875d3d22a219947
- SHA1 45d0ded1b50b37063f3a0f328d56f676ccb0e519
- SHA512 668b3ee30fa7b2dd4a8e368f8b8eaae387f0641b2f874984e398a11141f520102568520f4fe27b6cd370b0b927f809073f9080092a413086e6f37a06de785a7b
- SSDEEP 3072:BKta93TRDiicws0MWbs2OJiKF/ODxT5CyV9u2jNI8m5:B2wX7bJ39uyNJI
- TLSH
  T1F6F33B07B2AD11F8D1B7E23889A20942F776781A437197CF1390867A0F77BD49E7A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral5 behavioral6
- Target
  AimmyV2.3.0/DirectML.dll
- Size 17.7MB
- SHA256 9c9e6d822561c6c41b90e6994b3e8857cf1d66dbfb1e0c4c799c7c89b4e92da1
- MD5 abc458767c27ab4691e8910714d47ed6
- SHA1 a9cdf72540b949520045ef11d7b44879e2181c79
- SHA512 97af8aef5fbd25e87012351d93129e8a0a64a96569c4f8f458d5389f1ffc49239f6a14d9bc99f8b0a41e915ef12ee1fd781e391fae67f9774c08311b49005131
- SSDEEP 196608:/AZfeTLx3Ohq0Ytzn7OBdzIkRnyrQAH5+sM3TKC:K80hMtz7oZIkByrQo5QTH
- TLSH
  T18A17D01A6F6415A6C17BD23D9A534A43E3B6748A43706AE706F80D311F97BE05B3F382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  AimmyV2.3.0/TotallyNotAimmyV2.deps.json
- Size 67KB
- SHA256 73de80d65c86dbe84ee586d5abe8f082d89538a0bbb55932f30efa7d88198264
- MD5 c5cf1d5dac0b739c5a7237cffe591a8d
- SHA1 f526c8b0790eb482ec944b95732d2c381c9d5154
- SHA512 1ae53a5b8126769fbe1de26cc7b6c8e85dac0868520084d570a81381ab2360d029fcb3e2018c2e5a9dc9f908397c43cd51d50a9ba1eb01e39fd8e8ba977bb275
- SSDEEP 1536:Cq69vAF78lHplYucZCYECu3KCiJXvRjVa8XDlrju5:CqilYucZCYECu3KCiJXvRjVa8XDl+5
- TLSH
  T10C63AB21DB88ADA30A766B9614308192F361832F51106DDF79FC218EDF77E8A1275F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  AimmyV2.3.0/TotallyNotAimmyV2.dll
- Size 7.6MB
- SHA256 b76a060b01e29b3ddcf3d8c0ea8d6561220a543671f9bdc352773e16959172aa
- MD5 01e9c48d8e751848631c996c26bfde2b
- SHA1 67b2861b217f82b51ad1cedf507f8e860df4eaca
- SHA512 33c98370a043bdd948b09bee9474c19c347204952ec48c3f3176baddff235637ecc2649a35c0e1c0e7055b7422197c74956e6735a87e6a76531c3746334cafce
- SSDEEP 196608:aR8cuzd4H2MBBRHsYpvrCSqO+jspY2ATxCRQiri18z:6zqKvulO+jW/FRQil
- TLSH
  T16786D0125D9D8814F2206F37F48F4FAB4D69CB59681111CABBCCB7CA9D25B35CA230DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  AimmyV2.3.0/TotallyNotAimmyV2.exe
- Size 136KB
- SHA256 f5c59a9033a11bab1dd90318875f121336d1aa820703263fb518a27c7268efde
- MD5 a8ebbf44e8e138010914bd997a2fdfed
- SHA1 8fd7b03abe2d8300b83bd54a450fb319ddcaba44
- SHA512 6b28f967bcf55963b60516afa0e103fe1a2ef0ebd47024e1036a0ab853159e2ea947769f8b2883db01f3029ef4b1e19c70fab4d60797dc1285460adce7208196
- SSDEEP 3072:J454jE83DwHBoi2r7Z9V58lmpCnblxuZmPgBZN:J454jECi2rd9V58MpmxuZmYB
- TLSH
  T169D32947B2A800FDE1BBA37889A21A05F777B819477197CF0390857A1F67BD09E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  AimmyV2.3.0/TotallyNotAimmyV2.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH
  T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  AimmyV2.3.0/bin/anti_recoil_configs/Default.cfg
- Size 105B
- SHA256 ad346cf890e24061ecb780c0ccb64c14b97a0fadc3cfbb35079370664fbdba65
- MD5 ce1699b43cac56a1db708eb47fb895ed
- SHA1 b459711e26677a97573209b48a2dfba18f5d2124
- SHA512 7a130b9f968760862945b986efea104c3a0345a1ac41e52322ff7afc566af26b9845091b9c3933ea36874ab6c389903145d280db829d457c82476fd1ef6268d8
- TLSH
  T1D9B09220301600DA28B883264A39C45260083F8084208C4336B35EC808428B28849B53
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  AimmyV2.3.0/bin/binding.cfg
- Size 297B
- SHA256 f09c52104902211505f11286600417fc975913185b6aa2113c3f8795e5265a8a
- MD5 2697f8b636a03c50399c91e06318bf48
- SHA1 207023bbb06d6160a518aba140c976005640bc78
- SHA512 ce23dff16e8a5aaba5c402ef0e5a4f5777525fb37815085ab953a143a6496ab2260dffd06331048ba6fc40c3427401906f86066fb9386884c2e88ded2e4bdce1
- TLSH
  T1C8E08C230B6C7C23197567658CF6323B3280EF9F453B2D9BB873CA9802CE4021184F59
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  AimmyV2.3.0/bin/colors.cfg
- Size 69B
- SHA256 58d719fef5af2cabfcc4c2f60dc8d98ad899e94a27fea33245e16ad4f5b400c9
- MD5 7ebcbc301ab4fbb3503b041d3fcb2df5
- SHA1 756dfe049d5f9fa102c480622a0898cae8012fba
- SHA512 4e6796d2cf8e1449d9bdd77736725dd1182066b558b512bfffdafdc7db8628812b7ad2a3bdf582b7e3c1e143bc7ac381c1ae2d422f2e734bfe35b33147631dec
- TLSH
  T1E8A002022E48393AC367458A18234490B0077A4E04E85CCE68EF509C10086BFC941F61
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  AimmyV2.3.0/bin/configs/Default.cfg
- Size 457B
- SHA256 495894c46fbe044aad85091ac56087f1ac522cf444dc81db33fc3eb89c5d7d85
- MD5 13870f27135d4843627c9c5d923bc099
- SHA1 fc53b410995672c7cf742e4977e83f86e95a9eb1
- SHA512 5c85ab6cfe0b32b34204241edcc6b5dd2a479dd2be3daeb950f3f02ffe7dadd52289caf04629bc4fb358b75fc0c126628daf50ba6981d29dfce1746e85fd86b2
- TLSH
  T1FBF0E5A3362D40ABF0BE5368552BF866F5807F1502F05E7737BB0A08C642C2B4D61314
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  AimmyV2.3.0/bin/dropdown.cfg
- Size 177B
- SHA256 5ce7933e42545ed05689419310212f04a5d31565377064777312f7b0e77298c5
- MD5 bdb12bafd47156a4f61662891d4e5d34
- SHA1 0aee19316f95e6b8c60b8337df234daf2c94d945
- SHA512 e4900017e363ac96163bdcbcde2e45dd519bea3f237c124d82e898a5c6edd2d75744d2b156de4fa67ab1f96a32d0d13d1e058dc7f3955709a145e45f3213a137
- TLSH
  T157C0803BF51A743BD4FDD7BD2561445070610F8703B13D1728724734047683D3202B28
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  AimmyV2.3.0/bin/filelocations.cfg
- Size 79B
- SHA256 82cdd247d97761fec303c591a06df278b7896c194f4375db1fc176d9e45711a1
- MD5 550f662ab7bd788c310a3feae8f216a4
- SHA1 c8b9835a4f35b8cf3f894a248863cfba77db1bce
- SHA512 3fe320d9bc542e9ce2f3b177c64d321581be45c00c36df2e2279834aff3b3eec30d64d34ac73fdf360d92b335de3987df6e6ea192e6216baced23cf40ec7f53e
- TLSH
  T1E1A001EB558C24838AB21A46BA430662A8112B6E50348F03EDBFF84A866B0641581F18
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  AimmyV2.3.0/bin/images/015d209e-8085-4c65-94a5-caef988274b7.jpg
- Size 55KB
- SHA256 d0ec55a9d22626f1750d74ce42557a43781943a759b49ec6507f5a1378ae7a6f
- MD5 830f2505d481388f097ceb1fd15dfa46
- SHA1 00abec77dae1062812fa00abead1dc8373454b5a
- SHA512 5fcb3886c75bb3d4a993432784c45c7112def43b4301abbdc581e328e674e4d8fce7fe1845d08cf2cf3d347e1fafcf1978e220e1a08482a5e3b738ebd5bcaab3
- SSDEEP 1536:t8fZ8VYb/yCVmo2ii5yzURnXX0jfGVVQoBS/kOse:eBHKgR2frRnXErieV9
- TLSH
  T1AC43F16609D4D5C33ECBA3676B17F5B115C388920AFE0942B4A390EABE91DBD8C64E41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  AimmyV2.3.0/bin/images/01f7e7ec-c889-483d-a6e5-95e2a2f37e01.jpg
- Size 52KB
- SHA256 7455e1fe46c54fa991ea666b5b73d46578e5e8e03184434afa718a886eb6a18f
- MD5 e6460f785f3df2ebd84573a530a235ce
- SHA1 667740c227e6e98837388b6ad6589561ff94cfcd
- SHA512 300f2a43173e5d8faacf2c6c8b2605ca98f49d321568760851d24c910048db3dd6b6424efc0bd65f1f3a0edd57a7a38078e001be39cd1c974035f544c5ed38f8
- SSDEEP 1536:tzdQEducj7HYF8yH5YrJOWk6HWBfyjNW7WN6XOFYR:w6f4iSaQWk62BGW7AVuR
- TLSH
  T1E33302E978092007EB853BF2BE1C29C7AB2613122F549FB61270E16E66D4DD241F7E14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32