336bec7b2b6684d1a264aeb8f7b9e372b2a951c2a4fa371fc131f5ddaba7306c

Sharing

Copy URL Twitter E-mail

General

Target
larp-exodus-main.zip
Size 2.3MB
Sample260620-ydw58ag18j
SHA256 336bec7b2b6684d1a264aeb8f7b9e372b2a951c2a4fa371fc131f5ddaba7306c
MD5 6dee97c458d603259cd1eaeb18f7d56b
SHA1 93b5aec07e433f5c3b243c962b859cc89b34add0
SHA512 023e62a5ac319c16e832d87a214cece14a78410191ea2f3422a95544e282e49f91f0bf147b5b6ed80d95211edda167de4df3eb56fd73aab85949ed2d8f3317c4
SSDEEP 49152:wbFdSYZESHVYa57uVu4otu4aw8QRse1qbHqo0QjVYE/+lWbAVS6l4o2D:whPZES1Y+7uRiu88oj0qoHjV9/GLmn
TLSH
T17DB533A6D5517B32C21996FFF2CF0C52DBFCD08F81548D1589F8BC3845EB8296A4A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  larp-exodus-main.zip
- Size 2.3MB
- SHA256 336bec7b2b6684d1a264aeb8f7b9e372b2a951c2a4fa371fc131f5ddaba7306c
- MD5 6dee97c458d603259cd1eaeb18f7d56b
- SHA1 93b5aec07e433f5c3b243c962b859cc89b34add0
- SHA512 023e62a5ac319c16e832d87a214cece14a78410191ea2f3422a95544e282e49f91f0bf147b5b6ed80d95211edda167de4df3eb56fd73aab85949ed2d8f3317c4
- SSDEEP 49152:wbFdSYZESHVYa57uVu4otu4aw8QRse1qbHqo0QjVYE/+lWbAVS6l4o2D:whPZES1Y+7uRiu88oj0qoHjV9/GLmn
- TLSH
  T17DB533A6D5517B32C21996FFF2CF0C52DBFCD08F81548D1589F8BC3845EB8296A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  larp-exodus-main/CompositionScroll/CompositionScrollContentPresenter.cs
- Size 38KB
- SHA256 d629d7d758107e69e1cf5135e6415663827471fc457384602e6d1da4c6a3114d
- MD5 099e4695b92b8098bd501672cb59b845
- SHA1 58b5c278090b07c92ed25bbc6253df34c158459c
- SHA512 beaae2db06fdb0ba5ce20baf774918529e9b28ec84efd5441dc0dc3ca698e954abaa1f1a962d0137858df2bf5ff25a8ef51a5c1a65add827bd9474be09ec8e07
- SSDEEP 192:vFDpnFh/K8GNona0cYdJS6korFj4Hw88i62LyiE0DC6qTe213uBuw6Gu5xruSzte:vpJGNohc1wniE0GRDr8YwkDk
- TLSH
  T1DF03425AE1AB09320ACB9179CBCB24509E38845351FCDE543ACC37248FD15745FEABEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  larp-exodus-main/CompositionScroll/Interactions/Factory.cs
- Size 784B
- SHA256 d5f6f11a0ffdc829e9f208201797d6937900dce0d32189573f7ac43946bfcc6d
- MD5 ff9a4e70768a8b4bee73bbe23e878979
- SHA1 5e73f50d5cb673fc153e81b8354e304a7a3db27a
- SHA512 37726b99be2bedca2f0e007b73e958cdad71431789075f52d3e6cbcdbc01eac2e18f87cc6ee92197d7cc30c17bbd3c44fa17034f004f1771cd2a31513c95ef76
- TLSH
  T14B018440B6EFA430237B6648A3338164AE6E085341DF4490BE1C28218FDF0D59AAA7AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  larp-exodus-main/CompositionScroll/Interactions/InteractionSource.cs
- Size 6KB
- SHA256 70b8efa632b10b28bbaeaaa352ad0b913869df935c64a63c4d31e2d146d452d3
- MD5 dc274fddf20802d8f58f083ac2c77896
- SHA1 94b9e7041d6be55073bf70bd425f461f376debc1
- SHA512 91b46e8524d2160709627407523b323a136aeefe8ed42fd3cd3eb2f8ec06caec0c2402fe9c337ac53884be8c9f6fdc329648f3fb921d339f73451ae88e4a503d
- SSDEEP 96:t01aBXFiVi67Df3UC0ljO7IGgxc7yb6fOYRlFiF9cb:eSszjYjlpp6f7lFiFmb
- TLSH
  T118D1EF1A24D30C70166BA139EA97C1262D6848CB429DD8653ECD7580DFDA170EFFCBE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  larp-exodus-main/CompositionScroll/Interactions/InteractionTracker.cs
- Size 7KB
- SHA256 e7d2cf3a53aafc830b295ebc76960f9e037cb2b55fe08f052cfc4de12685b69a
- MD5 5de38fef328d8904bf5d8455b474c313
- SHA1 5bf7d767aa6f44f1adafdaa27bd9a3ed1ba43565
- SHA512 3e353068c3c585a3786ebadc20576e4c4933820083e6d451a3235d48e9fc11a26aa373233d6a3cd43b2222bc175162c636cca4b8bbdddfeeb16e7715c3900e6b
- SSDEEP 96:Cj4YVSxtTS+3YX96xUtcWV2mr5Sqykj5+Aicur7luZ5wCZ5H2S:t0Sxr3YXysseP
- TLSH
  T171F1B99771DB24A4B22BA129CB9BD2311974A05336CDC4763E8D11718FEF1D0CABA7D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  larp-exodus-main/CompositionScroll/Interactions/ScrollPropertiesSource.cs
- Size 1KB
- SHA256 d9bdbe655a7a9b81763a75878a1c9c2250aa3c4a14ac9dcc8179671cad94cc46
- MD5 41ebd0a04997bceabc308a3851f4513e
- SHA1 7347c25293e394ce8cccca5071a09bfb1315328b
- SHA512 5a42392fb4975644d747862775cb45e5ff3ea6f0589962bbb0f6fa791ea2f3195db32185d59b83cf805d76d5d69ad916cd939ca48971511816b4538d35217c7a
- TLSH
  T1EE11272190D70B1513AFB338BB56406AEBBC040346DF80ABBB1C14339FEB0D5A245F98
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  larp-exodus-main/CompositionScroll/Interactions/Server/Scroller.cs
- Size 5KB
- SHA256 8cda5f7ed732ec526fb3db2307e127338d6cf0fdbd58d73b06849f38a8c15f90
- MD5 45a88924d051df3bfc29186260894587
- SHA1 74400d863660de7999333559c9d7feb8f9bef2e1
- SHA512 965c80bc61348f6a5797f43330bcab60f53b407fd8a77c0a4971623f24761d9078222694d4aaffe68cdf932284ed50bdbff060b00bb374150d97d97f63e9e781
- SSDEEP 96:tKcA1mtc/3PDRAp3n6s10MI1N9R1PX6S9R1Plud1P/BTw9qTb:JAAi/3LRA56mnI1Nt6IfABBEATb
- TLSH
  T14AB17A6512C348102B23B16FDFCA41726FBD145B184ED9487ACF4200DFBB1609F96EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  larp-exodus-main/CompositionScroll/Interactions/Server/ServerInteractionTracker.cs
- Size 9KB
- SHA256 e0f20e50406dd48426e988ab6514905f2e99b8bd490d5553d6392a7c5e7d4b07
- MD5 5b150d9fc2cf842c57cd39f296069b9b
- SHA1 727d12dc5d29656ce90a5ba6f182a5697ceb92e9
- SHA512 ffe2d6277c711a2072f4b0d072a99882d0d41350f1a2ae1197c4927da52b8737272e7cbd0c3addc67a3bb06d152511e14ca5ee9966698d417ffe68856fc39ffd
- SSDEEP 192:TIuZqN5ohUHCyMdKXSsjizh/C56acb9jTQ7Tb:CL3/
- TLSH
  T19012771161D318219667B278DBCFD1302EBDA007686EC45C3F8E9225DF9B09145ABFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  larp-exodus-main/CompositionScroll/Interactions/Server/ServerScrollPropertiesSource.cs
- Size 2KB
- SHA256 b07a192d4db49adb46117574169d10ea95f58c4b7969896b8c859406e672e2b3
- MD5 ef8cd31a940d2bffbbd26cee16f788c4
- SHA1 7a8d6eed332a84053383124523cd2e1f180b2e14
- SHA512 658ee0e5f61639176084661040037cbe1bfd02c67b2dd52e2a22898520cae502b663fa227802e7f8cffafaef3858c6c5bca80e5a471f47484558f7928b77fddd
- TLSH
  T11051CD3562930D202257F2B97BEAA0405BBD1497297FD86DBB6C12214FCF4104B66FBA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  larp-exodus-main/CompositionScroll/VirtualizingStackPanel.cs
- Size 34KB
- SHA256 9cc7a1d052ccaeab7b6e676fc099b7d991e11bc1cfcd38da9796df4c5338d694
- MD5 51d8f6ec5c7c114aae3b066f6bb78d7d
- SHA1 11b41d08c2d1abd5e332e36336cc7bbb09a9f553
- SHA512 07274d95d9cac6a5e1cfc04b7a4c9a58deb8ab5f6d96d785aa52a092b5591f6d663e9a0d27523f207eabb87cfb189c74e541565c0fd7f07fcd557b46d358eaca
- SSDEEP 768:trJZcwkS+8h4AedgUHPAJd1rZNp79GrAtx2bmANfB+GbWIw4LRQoPXMGjkwTbd+0:JJZcwkL8h4AedgUHPAJd1rZNp79GrAtu
- TLSH
  T126F2B509B99204319DD6613FE79B28D6AF6104538968ED003D8CC710AFE4EF855FDBE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  larp-exodus-main/Exodus/Assets/Resources/Icons/Icons.axaml
- Size 9KB
- SHA256 45e48092227e1808b64fa242cc8cbcc0659b712a86390cbf38ef53797368c91b
- MD5 1c6fbed36d345e97aad4abc694818654
- SHA1 7ba42c2045385166929912744c8aa19e46551d70
- SHA512 18fd39251ec0668d89f8044a304c9376c0d601bf8c22ac9b880fa196900ee5168bcded191dacc17cbbf89a3ad728b25b2d8267d784db4a860e377f03ca61f028
- SSDEEP 192:ccqMpHDgZBMO20/dN7P4Cpces/b42Ft468x5+N7IwPW:tqMpK2MNz5snt3FC
- TLSH
  T1FC1282D90374A2ACF6CABD3A6F3854143B0DB8BFB635858075DE8B69DB4B591D0CAC10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  larp-exodus-main/Exodus/Exodus.csproj
- Size 12KB
- SHA256 148bb453c44c68cfe554428aa888d6edd948afe5c233f85c704c0e8bbf93be5e
- MD5 51fdaf9290761b579ac703ddbb8641ec
- SHA1 f5516caac65f58248177c3f2e911f279e72b0249
- SHA512 1cc56a5748df862c6a3865d0284907e5f61bfca5a4ffdc0d18ed4848c3037f01737663f24b7cacb60047a0ffbb44fa8d67479ea760e3c3801b38bf6feb8871b6
- SSDEEP 192:j58EElonf+jLNDfTtC0dZAnZVrpse3su8KxA9hioKBJSVuP:j5Vf+phC3JVc/BhGSVuP
- TLSH
  T19B42075660B737FA11DC68A38A6E97C5AFBB1B77315E0BC5716E0CC25D9088C0E5390B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  larp-exodus-main/Exodus/Helpers/UrlUtils.cs
- Size 1KB
- SHA256 39819f7476ac267bf96bc4e1039f72e10adf4d4c8c3d81395b5e51fde7633a39
- MD5 e2d5ef59ad52f93040e66d98c6074054
- SHA1 7f9753e4ad8b8c80e3b7aae3bc4156444e1b2027
- SHA512 e70c83468e83eab52d33d227d460c2a279b16c5e54fdc8826a8c69b38cb9da7a85c948eff7bc42979324ed533f359dd481af53f8fd91e944e8bda510b30876df
- TLSH
  T12F215949F4B71D264A6F102752FB13921E621103491ACC18B91D110C6F2C77347B77BF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  larp-exodus-main/Exodus/Models/Transaction.cs
- Size 3KB
- SHA256 d0c915d7fd3175c216820eb6bfac4eceda83802661cc46611adcef822f677164
- MD5 a858f2e999476d5488d01fe401837cfa
- SHA1 a769e6539ae5d6917a3b1fad647c812e3b112e01
- SHA512 2491ac1a0df9999a5d017fafaa5520adf15491741030c8196e1bace94880a1024cc4c0da95d47b4bda485d599f3216d9c64f73cd054b89b442959466cd2502cf
- TLSH
  T1AA710B5ABB122534892B14B1BBDBA08311B3A6CB067ED4657F5F12428FD088D1436BBF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  larp-exodus-main/Exodus/Services/DataBaseService.cs
- Size 3KB
- SHA256 b9ad7b36e241aae60e5bbbc864a7c095d7aa196d0a8912fcac583ff7666bd279
- MD5 b2956052716ce161703322e8c87a2983
- SHA1 2b6d72eb6568d27651e23cfb4dc3ce65ba729f0d
- SHA512 ecc124003a4cff72324323ff50120b876e8ea0aba806d6e6a1a3519cf7c098288c645f6258a037a47f400b63c06f17887622dd5e0bc080196de84a64599c41e6
- TLSH
  T13C81F2022A9279B0355BF03A8E4F12455E3946DF1D6A9C227E4D44840F9CD58D4FAF9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  larp-exodus-main/Exodus/Services/TransactionService.cs
- Size 3KB
- SHA256 f5f19e88a4d085f0e649c774b1d3c363a7f5b03e53cbc23889df2cbfbae48046
- MD5 7b5fe1d555adef106763794160aa21aa
- SHA1 23f51199f90a3e2c071cc379f23c21168151b108
- SHA512 834c99ad7537a2aa19f8fe3d10a50404d8363f1517f1230e469194be89a3350e2e2399cc38b2001e900399e9716985e853b434b0b9839faacd283e70441a7126
- TLSH
  T133611F14B7535970162F2478EBC395572A330AC7250EDCA2BE8E0D418FE621C997EA6E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32