9463dd54b4839594e3a45bc0cf18098f47d8374d93edc90f691a6a8df6eee3ba

Sharing

Copy URL Twitter E-mail

General

Target
Win32dasm.zip
Size 1.8MB
Sample260621-ejkjtsct6y
SHA256 9463dd54b4839594e3a45bc0cf18098f47d8374d93edc90f691a6a8df6eee3ba
MD5 cc0b32eb0b04dd9fa94535e063ed61e1
SHA1 dfb457dbafeee933bc771596fc79c24b012cba88
SHA512 ba214e7e2a74c54194d5ceea8b7d9b803c8c56f2956ce82b427468057ecbd473f081a66e9b66a7a8e6030e6920f537be7cc73668beea8ae60812916946a960ae
SSDEEP 49152:BZOSgXXui8Tns4y5/zmijfa0ZHLvPXFj6taD+wvy5A/7Ft/mO:EnFIsxyi20NvPXFuYpy58Rt/mO
TLSH
T107853396906E4CCBDF3B72F13616B134BC803E92614B38717E1B589F18615CF6AAD2C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Win32dasm/BIDS50F.DLL
- Size 76KB
- SHA256 2650b4e9a3884fe8f4c0b46bfaccf05e73639029bb700a8148ca31e064d41b00
- MD5 3c2f3b1f63082adb07202afa8c84abd6
- SHA1 f593b6c1f60208b227dfba1f72618640da3acc72
- SHA512 06b309893053a0ebc09d2006fb486c8017555c3f5625667a0618d4d63db73fdf2a90ba5b80c2965ca7bf222aeb00b8ee45987578401dbb29bddabfb76c88843e
- SSDEEP 768:xzTWN+0u5gLQIHNdAWOow5LjeXnhr28g/2Em4Przn2ux/k7fncUZSXdHZLteYktm:z5sHUxlhk7ILcvU1jlPX7wvnvH4N
- TLSH
  T122734A13B880C462C65186F39C72DF730DFF7C2E5D25962BB794AA9E8E315408A4629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Win32dasm/CW3220.DLL
- Size 224KB
- SHA256 c5b10d9baabb2db1ec0446118eb1b3dc2ca9fad3f8b99256e9c9806cf203268d
- MD5 9b456af70247a25135066abafd44ce33
- SHA1 16031b196dfb70d9b86a852bb4ee2814f5a7abce
- SHA512 2942ce5fc80e8d0307be247332bbcae13fb481b822c0191117ba02eab1c7f0d59e14d84a0fdcdc10101119f977a098d6bbd32d7ac92c949785bb77d33cb44bcc
- SSDEEP 3072:fQveOwOWbWkiQePrFBxbNXDz2fJf/g2cKTDbvZyL3nri5gt41CCwqngQVVdADgt4:fAwOWikibFBxlyf5zTvhyL3MIJ3
- TLSH
  T1A4246B237850CC34C5A30FFE9CB3DB3779ACAD6A0754A15B7BF2615A9EB81806613217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Win32dasm/IMAGEHLP.DLL
- Size 97KB
- SHA256 eeaf7f78a0659861af25ff8e0aa3e4f89fd6c6c1f99b8b5e0322c2f01ee80c3b
- MD5 fa481ee9dde8c5cc3829c279b401e8ee
- SHA1 a9ab6cfaf3d5f5904003ca4770c77db5ae79cec9
- SHA512 bba9aec5c8641d5e7e5db76b005dbb3d105f18d6e0e02271744d40388cbcf08c9730983948cff0aa1604ff93f19f29983639cda2be2ae4b3cd7122fda77a1f6a
- SSDEEP 1536:kir//HA/qmqw4D2066a5+wPTj846V6zxQV0hfkug07O:ky/veK6X+wnHxQV+fkuJ7O
- TLSH
  T165A3AE52F2908077D6F557301A697B5F27BB8A2033647AC367194E6C3C73992AB2C327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Win32dasm/OWL50F.DLL
- Size 782KB
- SHA256 2372394b51e4c8de1025c4692ab36dc19e88d2ad83ece980c620b1dc3a2de3dd
- MD5 86f5013e128ad9aaf7217d4cdafbeddb
- SHA1 3b10ed92660589fc21a0c46b3bf63f9429dd39ea
- SHA512 61ea644a07bd87b90dfa376fdc03624d079db934d6730b7e222b3b08971956251f6a5341632e3beb0bfd5db9c3ab225f9846c85c04300f7704941856b6f43c05
- SSDEEP 12288:tPDtTHyLHHDecKqvpQjfz68YTso4VAGpTlyGsufvX0LxitVgdnuerq29qNWIr4W7:hDtTH8HHDe70i6sospTIGsufvELxitR7
- TLSH
  T1A7056D13BDA2C95EE1B205F35C36EF792EEE3D899909EC2766885B0D9D32980150533F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Win32dasm/PSAPI.DLL
- Size 15KB
- SHA256 001a44f810ef114e0903300ba79d87f4dbe2947d1a503785906576439996526a
- MD5 8c690db2c58b64b0a8540892354d55e3
- SHA1 bc11c7213649bcae45aa7309cbdb97e103e51525
- SHA512 6a57d4400c61fb03124424d930d0bade13116bf0776973a666b8595b9d19667ca5e1831206d6602f89e4c30dab788a3442e4a14fab1867d8baab452a726b6278
- SSDEEP 384:QmrIEBQCn+l3nKzvGTpQ4WMSInlglWZCSWX1gs:QtqvcQuPlgBL1gs
- TLSH
  T1A6623A1082A5483FD1E50F7645BD3B76D539AC3426FEAECA025CEF6E58B1A50B358332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Win32dasm/W32DSM89.EXE
- Size 761KB
- SHA256 99840f02913d2f81294a9741606c97ac8fa24f02fb6e485ac5da547e2a36fad5
- MD5 3fe70c93c7ae0065e9b31596a62c9f82
- SHA1 bea2153187f3a3710435c33ea3f840a2994cc0e7
- SHA512 884334cd2b3f81e6aa4500290e3639cd1fb1fee2b9ee6f52828f104330322d518b1b38398b5d5b9690ac0d1b94422c4286c29cfd603162473f66a7a9440b75c9
- SSDEEP 12288:PVn286kALuEgWV1z70MI+82naINQg9V0uPKnvkcSxbC/KUEgL/vca5KcUVd:Bl6mEgWQMI+82nOgEPH06p/vcJ
- TLSH
  T174F44C62A1E39441D85800B0B61D97763CAFF358461BCEDF6274E97D5B26AC08AB073F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  Bids50f.dll
- Size 76KB
- SHA256 2650b4e9a3884fe8f4c0b46bfaccf05e73639029bb700a8148ca31e064d41b00
- MD5 3c2f3b1f63082adb07202afa8c84abd6
- SHA1 f593b6c1f60208b227dfba1f72618640da3acc72
- SHA512 06b309893053a0ebc09d2006fb486c8017555c3f5625667a0618d4d63db73fdf2a90ba5b80c2965ca7bf222aeb00b8ee45987578401dbb29bddabfb76c88843e
- SSDEEP 768:xzTWN+0u5gLQIHNdAWOow5LjeXnhr28g/2Em4Przn2ux/k7fncUZSXdHZLteYktm:z5sHUxlhk7ILcvU1jlPX7wvnvH4N
- TLSH
  T122734A13B880C462C65186F39C72DF730DFF7C2E5D25962BB794AA9E8E315408A4629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Cw3220.dll
- Size 224KB
- SHA256 c5b10d9baabb2db1ec0446118eb1b3dc2ca9fad3f8b99256e9c9806cf203268d
- MD5 9b456af70247a25135066abafd44ce33
- SHA1 16031b196dfb70d9b86a852bb4ee2814f5a7abce
- SHA512 2942ce5fc80e8d0307be247332bbcae13fb481b822c0191117ba02eab1c7f0d59e14d84a0fdcdc10101119f977a098d6bbd32d7ac92c949785bb77d33cb44bcc
- SSDEEP 3072:fQveOwOWbWkiQePrFBxbNXDz2fJf/g2cKTDbvZyL3nri5gt41CCwqngQVVdADgt4:fAwOWikibFBxlyf5zTvhyL3MIJ3
- TLSH
  T1A4246B237850CC34C5A30FFE9CB3DB3779ACAD6A0754A15B7BF2615A9EB81806613217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Imagehlp.dll
- Size 97KB
- SHA256 eeaf7f78a0659861af25ff8e0aa3e4f89fd6c6c1f99b8b5e0322c2f01ee80c3b
- MD5 fa481ee9dde8c5cc3829c279b401e8ee
- SHA1 a9ab6cfaf3d5f5904003ca4770c77db5ae79cec9
- SHA512 bba9aec5c8641d5e7e5db76b005dbb3d105f18d6e0e02271744d40388cbcf08c9730983948cff0aa1604ff93f19f29983639cda2be2ae4b3cd7122fda77a1f6a
- SSDEEP 1536:kir//HA/qmqw4D2066a5+wPTj846V6zxQV0hfkug07O:ky/veK6X+wnHxQV+fkuJ7O
- TLSH
  T165A3AE52F2908077D6F557301A697B5F27BB8A2033647AC367194E6C3C73992AB2C327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Owl50f.dll
- Size 782KB
- SHA256 2372394b51e4c8de1025c4692ab36dc19e88d2ad83ece980c620b1dc3a2de3dd
- MD5 86f5013e128ad9aaf7217d4cdafbeddb
- SHA1 3b10ed92660589fc21a0c46b3bf63f9429dd39ea
- SHA512 61ea644a07bd87b90dfa376fdc03624d079db934d6730b7e222b3b08971956251f6a5341632e3beb0bfd5db9c3ab225f9846c85c04300f7704941856b6f43c05
- SSDEEP 12288:tPDtTHyLHHDecKqvpQjfz68YTso4VAGpTlyGsufvX0LxitVgdnuerq29qNWIr4W7:hDtTH8HHDe70i6sospTIGsufvELxitR7
- TLSH
  T1A7056D13BDA2C95EE1B205F35C36EF792EEE3D899909EC2766885B0D9D32980150533F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Psapi.dll
- Size 15KB
- SHA256 001a44f810ef114e0903300ba79d87f4dbe2947d1a503785906576439996526a
- MD5 8c690db2c58b64b0a8540892354d55e3
- SHA1 bc11c7213649bcae45aa7309cbdb97e103e51525
- SHA512 6a57d4400c61fb03124424d930d0bade13116bf0776973a666b8595b9d19667ca5e1831206d6602f89e4c30dab788a3442e4a14fab1867d8baab452a726b6278
- SSDEEP 384:QmrIEBQCn+l3nKzvGTpQ4WMSInlglWZCSWX1gs:QtqvcQuPlgBL1gs
- TLSH
  T1A6623A1082A5483FD1E50F7645BD3B76D539AC3426FEAECA025CEF6E58B1A50B358332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  W32dsm87.exe
- Size 783KB
- SHA256 42afe53fae8933722cc18b04254809782b278bffaf55574b3604fd513dd55eef
- MD5 00dbc6bd21e792406c18953b8419cab7
- SHA1 61016502648bb7e5763a6a1bcea4052e1ca850aa
- SHA512 5d90060c2e28d2bdbb5ffc0c8fc18c97cb89db91be797c0646e259b9a3c9dd7987afc55a2e9d287cbdde76ac75771b74cc2c0b913058604cf2249044d2b8cc02
- SSDEEP 12288:e3/xOGHFsLcFUaY6VU4tfsFId4yKd8cIGp4GBvd0GQWMX+/rv:i/sGHFMcFUQsFIdx68cJhBvdzQWFb
- TLSH
  T189055C6256F3D44EC9281170EB58CB761CBD7364123BCE9E7364B919CB62D9082B4B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24