9463dd54b4839594e3a45bc0cf18098f47d8374d93edc90f691a6a8df6eee3ba

Sharing

Copy URL Twitter E-mail

General

Target
Win32dasm.zip
Size 1.8MB
Sample260621-ej2s4sbs7q
SHA256 9463dd54b4839594e3a45bc0cf18098f47d8374d93edc90f691a6a8df6eee3ba
MD5 cc0b32eb0b04dd9fa94535e063ed61e1
SHA1 dfb457dbafeee933bc771596fc79c24b012cba88
SHA512 ba214e7e2a74c54194d5ceea8b7d9b803c8c56f2956ce82b427468057ecbd473f081a66e9b66a7a8e6030e6920f537be7cc73668beea8ae60812916946a960ae
SSDEEP 49152:BZOSgXXui8Tns4y5/zmijfa0ZHLvPXFj6taD+wvy5A/7Ft/mO:EnFIsxyi20NvPXFuYpy58Rt/mO
TLSH
T107853396906E4CCBDF3B72F13616B134BC803E92614B38717E1B589F18615CF6AAD2C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Win32dasm.zip
- Size 1.8MB
- SHA256 9463dd54b4839594e3a45bc0cf18098f47d8374d93edc90f691a6a8df6eee3ba
- MD5 cc0b32eb0b04dd9fa94535e063ed61e1
- SHA1 dfb457dbafeee933bc771596fc79c24b012cba88
- SHA512 ba214e7e2a74c54194d5ceea8b7d9b803c8c56f2956ce82b427468057ecbd473f081a66e9b66a7a8e6030e6920f537be7cc73668beea8ae60812916946a960ae
- SSDEEP 49152:BZOSgXXui8Tns4y5/zmijfa0ZHLvPXFj6taD+wvy5A/7Ft/mO:EnFIsxyi20NvPXFuYpy58Rt/mO
- TLSH
  T107853396906E4CCBDF3B72F13616B134BC803E92614B38717E1B589F18615CF6AAD2C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Win32dasm/BIDS50F.DLL
- Size 76KB
- SHA256 2650b4e9a3884fe8f4c0b46bfaccf05e73639029bb700a8148ca31e064d41b00
- MD5 3c2f3b1f63082adb07202afa8c84abd6
- SHA1 f593b6c1f60208b227dfba1f72618640da3acc72
- SHA512 06b309893053a0ebc09d2006fb486c8017555c3f5625667a0618d4d63db73fdf2a90ba5b80c2965ca7bf222aeb00b8ee45987578401dbb29bddabfb76c88843e
- SSDEEP 768:xzTWN+0u5gLQIHNdAWOow5LjeXnhr28g/2Em4Przn2ux/k7fncUZSXdHZLteYktm:z5sHUxlhk7ILcvU1jlPX7wvnvH4N
- TLSH
  T122734A13B880C462C65186F39C72DF730DFF7C2E5D25962BB794AA9E8E315408A4629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Win32dasm/CW3220.DLL
- Size 224KB
- SHA256 c5b10d9baabb2db1ec0446118eb1b3dc2ca9fad3f8b99256e9c9806cf203268d
- MD5 9b456af70247a25135066abafd44ce33
- SHA1 16031b196dfb70d9b86a852bb4ee2814f5a7abce
- SHA512 2942ce5fc80e8d0307be247332bbcae13fb481b822c0191117ba02eab1c7f0d59e14d84a0fdcdc10101119f977a098d6bbd32d7ac92c949785bb77d33cb44bcc
- SSDEEP 3072:fQveOwOWbWkiQePrFBxbNXDz2fJf/g2cKTDbvZyL3nri5gt41CCwqngQVVdADgt4:fAwOWikibFBxlyf5zTvhyL3MIJ3
- TLSH
  T1A4246B237850CC34C5A30FFE9CB3DB3779ACAD6A0754A15B7BF2615A9EB81806613217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Win32dasm/IMAGEHLP.DLL
- Size 97KB
- SHA256 eeaf7f78a0659861af25ff8e0aa3e4f89fd6c6c1f99b8b5e0322c2f01ee80c3b
- MD5 fa481ee9dde8c5cc3829c279b401e8ee
- SHA1 a9ab6cfaf3d5f5904003ca4770c77db5ae79cec9
- SHA512 bba9aec5c8641d5e7e5db76b005dbb3d105f18d6e0e02271744d40388cbcf08c9730983948cff0aa1604ff93f19f29983639cda2be2ae4b3cd7122fda77a1f6a
- SSDEEP 1536:kir//HA/qmqw4D2066a5+wPTj846V6zxQV0hfkug07O:ky/veK6X+wnHxQV+fkuJ7O
- TLSH
  T165A3AE52F2908077D6F557301A697B5F27BB8A2033647AC367194E6C3C73992AB2C327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Win32dasm/INSTALL.TXT
- Size 2KB
- SHA256 e9ccba2afd6a7a12e701ed08bb514ca94f1dd330fae5c601494164b0cdfac012
- MD5 8d67155e21daa3aa03455c50c672de81
- SHA1 7d4fe75cf5e446d485f097987f582ec0d95be8e8
- SHA512 47c08a56db92915ba38bfa8b184b3f8ce4c39b2104d3fd6b25dc610f4aa5efc7f7dca39caecf64b6e07430e79f666c1031beda944ab5dbfd6b30a59445a5d596
- TLSH
  T1B551959F7A2F63762D760298626AE341F77DC0B5225C8125322C855C37B193347974EE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Win32dasm/OWL50F.DLL
- Size 782KB
- SHA256 2372394b51e4c8de1025c4692ab36dc19e88d2ad83ece980c620b1dc3a2de3dd
- MD5 86f5013e128ad9aaf7217d4cdafbeddb
- SHA1 3b10ed92660589fc21a0c46b3bf63f9429dd39ea
- SHA512 61ea644a07bd87b90dfa376fdc03624d079db934d6730b7e222b3b08971956251f6a5341632e3beb0bfd5db9c3ab225f9846c85c04300f7704941856b6f43c05
- SSDEEP 12288:tPDtTHyLHHDecKqvpQjfz68YTso4VAGpTlyGsufvX0LxitVgdnuerq29qNWIr4W7:hDtTH8HHDe70i6sospTIGsufvELxitR7
- TLSH
  T1A7056D13BDA2C95EE1B205F35C36EF792EEE3D899909EC2766885B0D9D32980150533F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Win32dasm/PSAPI.DLL
- Size 15KB
- SHA256 001a44f810ef114e0903300ba79d87f4dbe2947d1a503785906576439996526a
- MD5 8c690db2c58b64b0a8540892354d55e3
- SHA1 bc11c7213649bcae45aa7309cbdb97e103e51525
- SHA512 6a57d4400c61fb03124424d930d0bade13116bf0776973a666b8595b9d19667ca5e1831206d6602f89e4c30dab788a3442e4a14fab1867d8baab452a726b6278
- SSDEEP 384:QmrIEBQCn+l3nKzvGTpQ4WMSInlglWZCSWX1gs:QtqvcQuPlgBL1gs
- TLSH
  T1A6623A1082A5483FD1E50F7645BD3B76D539AC3426FEAECA025CEF6E58B1A50B358332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Win32dasm/W32DAPI.LUP
- Size 30KB
- SHA256 802508288291f5ab74024e3673b618c33254918a81c33a793cea3545e6a0bd3f
- MD5 24cdae8f0492bfb3a54f1778e89f2019
- SHA1 983f533f6114a553a36f0cdbcb8676b30500b4d1
- SHA512 60f41db078804f4d5aa0643fd956665061a04e2ae59a29ec8c68919580ba1d38dfbb57ee2f48bfc2bb6c144e8fd51cec71258b18700bc7d3cf61552294c992e8
- SSDEEP 768:LF6jeLtjJmXky3WKT6/khdqL5Y9uX/DKuBRhZw1lvyE:Aw4Xky3/hdqtY3uDylvyE
- TLSH
  T13EE21817342C257B0EBE25897973E966C351C9C54C3D734ABD88CE0DEA8F2CA44B6396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Win32dasm/W32DASM8.GID
- Size 8KB
- SHA256 14f114d97f1f76a0c6a37dfb35f65304812b82799d4c989cd1c7f93859692493
- MD5 a037dcc9d03c122fa2bca2555cb8e15c
- SHA1 a47f0eb15f3176ae148257d163a65caaa3cc35aa
- SHA512 879a926ea7cc860f36c7d05157baa3fe752575f58a8af62abd215b001e3270a24a2bc360c8d93db78a17e4f9bcde2be8202d56b8f0a13e76da6fe1f42ea8fb3a
- SSDEEP 12:TpaibVDl1zc4U213sN381WnJwyVrfnJwy2epd:TL5513BatJ1rfJb
- TLSH
  T1D902D801F200D2BBD03654F142AC5BD4A264A4042F9B5A8E1E14529D9C363D56F0D1A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Win32dasm/W32DASM8.HLP
- Size 189KB
- SHA256 4482e69d3fe2969d0d9405d911a7f893ec0f1115a294e5867260170cffd23f03
- MD5 4646ecc793b9f072dc8d1b260074ac67
- SHA1 7d93d908ca3641888476d3371ba3078e9175d7a6
- SHA512 32da5b4d6b92306ad575204e50fdb1149f64ec6c03716e90f32ef00fd252ffaa63f59d4d3922cbcdd37a21b9795752da47b738219a363824212fd4f5ea56d931
- SSDEEP 3072:uxh5cb3now4zMSStGYOhNzF38zG7SGgG6ZLgIWNzW5lGd6oI0te614kCZt:k5cbow2MSStDCN2q7mLLgIWNzW5lGYkq
- TLSH
  T1B514F11A356086A2CE0B0B36D4579FB0A5A2BD56DF44830772B9FF5EFCB27829D0244D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  Win32dasm/W32DSM89.EXE
- Size 761KB
- SHA256 99840f02913d2f81294a9741606c97ac8fa24f02fb6e485ac5da547e2a36fad5
- MD5 3fe70c93c7ae0065e9b31596a62c9f82
- SHA1 bea2153187f3a3710435c33ea3f840a2994cc0e7
- SHA512 884334cd2b3f81e6aa4500290e3639cd1fb1fee2b9ee6f52828f104330322d518b1b38398b5d5b9690ac0d1b94422c4286c29cfd603162473f66a7a9440b75c9
- SSDEEP 12288:PVn286kALuEgWV1z70MI+82naINQg9V0uPKnvkcSxbC/KUEgL/vca5KcUVd:Bl6mEgWQMI+82nOgEPH06p/vcJ
- TLSH
  T174F44C62A1E39441D85800B0B61D97763CAFF358461BCEDF6274E97D5B26AC08AB073F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  Win32dasm/w32dsm87.zip
- Size 915KB
- SHA256 cae2355551ecb1fbe7a646a72aa252b778dea2aee99f735ce3bf97245bce586b
- MD5 d14384b8714ae512c260eb7c5eaff4b3
- SHA1 69800840a98ca207734557f715a0c84f55be53ad
- SHA512 eafd5b29909261cca4de48555be0a4b5fb20ccccf5025569d7506857ed5f50162d5bc235f278488f072db149a0ac697fc79c793b9da3f3c9d4b40697fdb22285
- SSDEEP 24576:r2BafvMAKzZtk6GBDkMO/zaWCxKttaj6cax5UJVyR/vQ:h3MAyZF3WGaj6cax5UJVyhQ
- TLSH
  T13F1523EA39B6458EEFC719E2DB08B1D758D389A12D0423546C815A070C9D3DBDF1AB8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Bids50f.dll
- Size 76KB
- SHA256 2650b4e9a3884fe8f4c0b46bfaccf05e73639029bb700a8148ca31e064d41b00
- MD5 3c2f3b1f63082adb07202afa8c84abd6
- SHA1 f593b6c1f60208b227dfba1f72618640da3acc72
- SHA512 06b309893053a0ebc09d2006fb486c8017555c3f5625667a0618d4d63db73fdf2a90ba5b80c2965ca7bf222aeb00b8ee45987578401dbb29bddabfb76c88843e
- SSDEEP 768:xzTWN+0u5gLQIHNdAWOow5LjeXnhr28g/2Em4Przn2ux/k7fncUZSXdHZLteYktm:z5sHUxlhk7ILcvU1jlPX7wvnvH4N
- TLSH
  T122734A13B880C462C65186F39C72DF730DFF7C2E5D25962BB794AA9E8E315408A4629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Cw3220.dll
- Size 224KB
- SHA256 c5b10d9baabb2db1ec0446118eb1b3dc2ca9fad3f8b99256e9c9806cf203268d
- MD5 9b456af70247a25135066abafd44ce33
- SHA1 16031b196dfb70d9b86a852bb4ee2814f5a7abce
- SHA512 2942ce5fc80e8d0307be247332bbcae13fb481b822c0191117ba02eab1c7f0d59e14d84a0fdcdc10101119f977a098d6bbd32d7ac92c949785bb77d33cb44bcc
- SSDEEP 3072:fQveOwOWbWkiQePrFBxbNXDz2fJf/g2cKTDbvZyL3nri5gt41CCwqngQVVdADgt4:fAwOWikibFBxlyf5zTvhyL3MIJ3
- TLSH
  T1A4246B237850CC34C5A30FFE9CB3DB3779ACAD6A0754A15B7BF2615A9EB81806613217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Imagehlp.dll
- Size 97KB
- SHA256 eeaf7f78a0659861af25ff8e0aa3e4f89fd6c6c1f99b8b5e0322c2f01ee80c3b
- MD5 fa481ee9dde8c5cc3829c279b401e8ee
- SHA1 a9ab6cfaf3d5f5904003ca4770c77db5ae79cec9
- SHA512 bba9aec5c8641d5e7e5db76b005dbb3d105f18d6e0e02271744d40388cbcf08c9730983948cff0aa1604ff93f19f29983639cda2be2ae4b3cd7122fda77a1f6a
- SSDEEP 1536:kir//HA/qmqw4D2066a5+wPTj846V6zxQV0hfkug07O:ky/veK6X+wnHxQV+fkuJ7O
- TLSH
  T165A3AE52F2908077D6F557301A697B5F27BB8A2033647AC367194E6C3C73992AB2C327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Install.txt
- Size 3KB
- SHA256 0d0196b7e2435e0ff30c7410e0030a6026b96f712b32f580216dcc6581b59340
- MD5 86db6678b4533d2f1a47141fe8d0a624
- SHA1 a24c44ba82d62a22cdffc1353f72d21ad53233b2
- SHA512 f228e0b40cd85c8c42bda59f2f4cf7504736f65737ff3557dcff43e87e7e5bb49b44bd798815c791c4fb4cc305d5ca3aac339a8b9482322e212865011e32cb27
- TLSH
  T13E61B757BA6E73656DB302A4A516F601A63EC0B4331DC121321CC0AC77A152A07AB6AE
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32