c0e32c10667dc0318db195e7aff8d0bea9e35ae70ed69ff6dda53b2c9e28f471

Sharing

Copy URL Twitter E-mail

General

Target
geany-plugins-2.1_setup.exe
Size 11.3MB
Sample260621-ephbnact7y
SHA256 c0e32c10667dc0318db195e7aff8d0bea9e35ae70ed69ff6dda53b2c9e28f471
MD5 4c631682c35df710195b12d45d66d72f
SHA1 b0fd8e88df6fd46a9bf34275632365851609ce0e
SHA512 d00b63ae25d6ec5a41eb3880d6ac09a8c44d464b5f7bd101272a9fcda2f75415328bfeb002198a8e24aa1c4c97e589eff959acec0eba4e0cc6479d0f5eaf03be
SSDEEP 196608:pFX0tNagfRowREbpHRlUq8B/8N4KufJeXEH4YzOkWm6KdnktmzYDhzoT3hF20f:pd4uwgFvUj8N47kUHfqkHNS5Dhs3hQw
TLSH
T147C633259B7808E6C44D9EB13EF38A7207B17F764429B1EF0A88427EFB64714DD63285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  geany-plugins-2.1_setup.exe
- Size 11.3MB
- SHA256 c0e32c10667dc0318db195e7aff8d0bea9e35ae70ed69ff6dda53b2c9e28f471
- MD5 4c631682c35df710195b12d45d66d72f
- SHA1 b0fd8e88df6fd46a9bf34275632365851609ce0e
- SHA512 d00b63ae25d6ec5a41eb3880d6ac09a8c44d464b5f7bd101272a9fcda2f75415328bfeb002198a8e24aa1c4c97e589eff959acec0eba4e0cc6479d0f5eaf03be
- SSDEEP 196608:pFX0tNagfRowREbpHRlUq8B/8N4KufJeXEH4YzOkWm6KdnktmzYDhzoT3hF20f:pd4uwgFvUj8N47kUHfqkHNS5Dhs3hQw
- TLSH
  T147C633259B7808E6C44D9EB13EF38A7207B17F764429B1EF0A88427EFB64714DD63285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral1 behavioral2
- Target
  share/geany-plugins/geanygendoc/filetypes/c.conf
- Size 4KB
- SHA256 fc34dbb23da22f4a6b847360f1cab46edda685fd4b9fec4b7dde0cde4ed716d7
- MD5 b1e29b82adf0c962067511e8fdb1e1d9
- SHA1 b8d48244504388804702c6e3a40245a996fa83c3
- SHA512 38096a50272b75280a4a0081e4425af398fe417ff6e6d9530091babf6945a93bf977587299c1017a51cdfe733014d0a9e0d8112e670f9ebaedd0b7dc6509aee1
- SSDEEP 48:Fdd+lJ9d7vGwpCndgvn/Xjm8hDDlkit6tTX5pAXEo/49RSKmRSKvXr1XxebOQ5:Fv+pdy0Cnd6/KgDDRWTrS9SL
- TLSH
  T13AA1DC662051E15B46B1533ABDC2458EFF22E2177A10900DB6CEA3644F7321B83BEFE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  share/geany-plugins/geanygendoc/filetypes/vala.conf
- Size 1KB
- SHA256 ffc8eabf62b352ec9b3fd3ffb101436e06ef558dfa4d750dcf38a4c9c11ab3e5
- MD5 ae4d110dcb99b9fe60e1e527ee45fb5e
- SHA1 dab6bfdd9e67058aa67bfdca7ecc0562c3a2a583
- SHA512 fd43e1a02725d07865b8fcab8332813b0ccfd8f9aed82a4919077a608923a5e4775aa873d4b0004f15f33eb97b01b63ad51508603477cef48f056eb5b0f1cf94
- TLSH
  T17B311F527095B10F42F0632D7DCBCACBAB58D388AA00860DB9AFD2144F5351F93BEA74
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  share/geany-plugins/geanylua/dialogs/basic-dialogs.lua
- Size 647B
- SHA256 e8c64c40b3bc2c58fe16ffa88049b3473b35ea57d900532beccc6fcef40376ca
- MD5 1504a2f6f1692cb32b7695dd0c8acd55
- SHA1 e3a46ca38fdb0d5ed3e7b1a23e58fa8a6e26ee82
- SHA512 c959a9cea1874e6c4271f64e6835385cb3f5b54e5780bdbd1169b83137a2f8d19cf40f4f08da47a2582344b58ead5a68222052c37ab492aa79450ff972403d3d
- TLSH
  T1BEF09910F69E1D7749FF2825340630D9D012106A89D1B6EE300A3071AF7C3586181FFC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  share/geany-plugins/geanylua/dialogs/complex-dialog.lua
- Size 1KB
- SHA256 69db9e0ea6e418f6bfcd81c9a34045b9ee2756fa0f5beb3dac5ce0d8537a0567
- MD5 c75c3510cbf7b12be2e7e669d294ee4b
- SHA1 a65d55fad232ecae9e750dfb312c79a1d83be59a
- SHA512 3a3045680d8af011a10bc85ab2e14b00ef8e7b44c25d0876b28c3bdb5dd23a5492a8fc0718d681a2e9ca3784d0ae4d62c7e2470c22bfebb8d977b72e6e5b0310
- TLSH
  T1A93120D49B0B531202C360D1BA061C12F75D4239C17A2C65BA1AD6BE3B6CBB966CA3DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  share/geany-plugins/geanylua/edit/calculator.lua
- Size 1KB
- SHA256 decb7059e14e5d005bd6b0ddf01ba0fa940ccab32789d6d4c34d577c0f56fcf6
- MD5 4acf227c27b631bdbd20ba98cf265238
- SHA1 7c7e3b9299f593901536b59cbe1bfa323802ebc8
- SHA512 b3f5e446fbf89d754ff1f4e1d672bc5e8eceeae77e09c67bb0657054001632aa9629d710d702f170b6844e9bc4f1b48d50c714d89c2c55cd0c1c1439637e637e
- TLSH
  T14F31125D700BAB7048737503705B68D2F925C86EB270B2D1F57C61A92B680ADE2B366F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  share/geany-plugins/geanylua/edit/lua-replace.lua
- Size 927B
- SHA256 f1c7efe3295fc80d2db15204a1990c69eb93cd7abef8c53b4f8648bae3a54de2
- MD5 3176265d7cf21ef958a521fb4747d841
- SHA1 803c62bc6f8ccd337ad629c31ae77a1f59508863
- SHA512 95bd36693dbf38585b18903eb3a7b0b37bd681d1921883b5495166069eeb8fd00eca2e41d7ee185aa154036b370f651d30e26953749f1708640dcc2e6f0709e5
- TLSH
  T1A4112394320B2EE2D4B369167CC71815D331638792B4546C7C7C58CF2B7C56C8139DAE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  share/geany-plugins/geanylua/edit/proper-case.lua
- Size 433B
- SHA256 84d0da44fe93af7677e62ab707e2b90cf4864ccbb218f0b7269dfe537613bc66
- MD5 20814b764ab9e7e010efa1fda39cb904
- SHA1 dd0c67303e61324aab82fa80d0283f8cc632924f
- SHA512 3d882d49d5c40f996a6caff824597d60fff57e4e9e500d219c26206363c08a30e18e8ca4328040708d8380822dd756cc148f5b7cc912fc383b91f150b40a1df2
- TLSH
  T16EE0550D701FA6A866B332A0898B84C090511244807BE6F8B6E486C029182FCC6FB96D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  share/geany-plugins/geanylua/edit/reverse.lua
- Size 279B
- SHA256 7b57f73ba1cd02b14e0da422d9ef88c05da6e722bdac8ba357a417e78c3bdaab
- MD5 7fbc7c60057b2ee6d0de5d25a224ad0c
- SHA1 c42b80fa3f5ae24c9545be723fe7eb21087b615e
- SHA512 fba44f33bf3a30192c3c74638b1b1d40ad4c6e1929955d893eea4532bd1159af443380e95ad9c34a43841782ab4b8b1332d583eb036b76c04d7fb815ee3bfcd0
- TLSH
  T1D0D0C249710E57B2A43724514CA740C8D2326165547970A970D460903D29ADD45A3D9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  share/geany-plugins/geanylua/edit/right-trim.lua
- Size 267B
- SHA256 de5e4873013cb355eaa8b9c860f673bace117d616c4d1334160a73bb38818920
- MD5 6a2385ec507807ef3af1c29653d0d5cf
- SHA1 518dc7790450e7ed30e309eabbf22cd1d802041d
- SHA512 637cbe6f277eef9c5cde633b245863814ef8ddeb8d2db16b0b955b8c8fd509b3e751c145b6e0d96d14328fa5b09a935a8941043a9591e10197eca5568ef0419b
- TLSH
  T131D02B2D238B2996A12111F1F85999D468522064967AB0F5A8498005D2585596878D8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  share/geany-plugins/geanylua/edit/select-block.lua
- Size 489B
- SHA256 227767a320fad2bff21268ea287a828da75d3631cadfc88502f3e2ad78100f41
- MD5 f9eb1ad565dae9b72dc823c3ae261703
- SHA1 f93dc1cba758593469dd3a6865fcfdface98da87
- SHA512 e7af093ae9bb4949dd0a03844d0eb38705d8f82bc2d772a30c7f6bdb110fdb5da20fb43f30cce277f652f7280b2dc7434b55fe9a11b0231669741a22da80786d
- TLSH
  T183F054F27063486034F4A4D2C84F3840C8A324289E6324C4F4A8F090339A3BD84F37AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  share/geany-plugins/geanylua/info/about.lua
- Size 68B
- SHA256 72d69a2d96cdd44e0a8e3c9fec9d5cc7b176f90b338e0818dbe0670ac52bd070
- MD5 a3b69971748f3b8617bdd16920613282
- SHA1 94156161d67d214109bee5a0101dac0811e50d90
- SHA512 133029fef90e648d30d2c85216a961fac362175f15f1b47ff1a8210d3342e7795d7bbe9040dc090685e474949fbbe472cb6a34161f0756b808246788e59959e1
- TLSH
  T1E4A022202CCC8C20203A000AF00020C0230000C0C8C8F0F3A0B238203882A302C8C302
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  share/geany-plugins/geanylua/info/app-information.lua
- Size 452B
- SHA256 1b123b38604398f0aab17e06db1a001c2c92bc7da812105507d211d01ad981a3
- MD5 d14591d5f550a8e88b33725ebaa0df24
- SHA1 d1c4fe6bf18a241d86168b8c54b69615140e8841
- SHA512 c4a231926c1734b25d57f1a81d75fc9cb818c5d5829d00127c961961247f2834449e68898ae3dce3d6ff1dd3b48a424cf888af5fb390df598d7e1584e790cd84
- TLSH
  T171F0A3865753B91374B1D45020571815F521A15159EEC2B3384CC1D29F5056AE3B9F3F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  share/geany-plugins/geanylua/info/file-information.lua
- Size 295B
- SHA256 ad4bdf4cd51a4f5e36fc567a80d72c7fb9a6292434e1fe0f04c37ecf8199cee0
- MD5 206b356b1075f31b7c01cd18b73d22b8
- SHA1 2b58a42ff1c23843b8a9ed3658cac9f216a8a7d3
- SHA512 6b15f5e9096b547c78990445deaa43e8a2a12e928dff6f42036887ffbe6c6ba8fd33c29709e16539596fb47acd5283a094df2c7a9018714e7fb253e9b8664784
- TLSH
  T132E072C21A86E903A0208090308B2C28392021643AF8FAA1B8AC82018140E2982EAE3E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  share/geany-plugins/geanylua/info/list-open-files.lua
- Size 649B
- SHA256 8ab9b4f494f618bcdcf4af6b56e88a110b105b4b56e8731882d1e33c78e5a9d3
- MD5 c09f3a0d79a8d0b86ff3483fc7ad3cc5
- SHA1 ec8ea56d6a33c9fa864783a6281fce47529e1093
- SHA512 ab7c6177a291bd82ab1351370afac50e555d1b50e8cb61ebee22ea3e6348e18f6c6619f23bd7324f9f1eb6f213872d4e234fe2a49693d82d8ae44512a04938ad
- TLSH
  T15FF07D129C4E189530B376F6545B1005FA14918EA9F621A679EC60503B749D4E1ECFFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  share/geany-plugins/geanylua/info/show-filename.lua
- Size 303B
- SHA256 646d587c7d497f51b17af6cc3094880445f5035cae0951d307161ed6e59cd4bf
- MD5 390a234729baf43da328cf3a3e23b2aa
- SHA1 d6eddb38224d33da7c56dbde845d1c4f7d49ea0c
- SHA512 cce65d9acc20f576d7f1828dc75f5417e177f1b51e79549c84c389ba6f91e52829b26d99dcca33f1a5653e3c5fc5b0fe099f6aaea2d3472b370454a6f4cc58c7
- TLSH
  T1AAE08C8E2E8987B6E32528512B492198A711806C7553B2AA64C84608A764AA5F8F5BC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32