09a9f699487c1e115ed30082f4443982fa1648a475aa9d982183996cb9289fae

Sharing

Copy URL Twitter E-mail

General

Target
NovaTools_8C15+.rar
Size 668KB
Sample260621-phgrnaes2y
SHA256 09a9f699487c1e115ed30082f4443982fa1648a475aa9d982183996cb9289fae
MD5 594e6550bde959c782ccbe534237d384
SHA1 d689b0f14450c4d592ef3c67b2881d4715422def
SHA512 11a2e29d8a8249c94832885cd4c22d7bf29807591b99cdc2039f5ce41be4af1ad376f9d1235653c8b35f928dd159120ecaccdac1fc561cb880bf64569527db07
SSDEEP 12288:atTR8zsCS/Csf86RVFT28GZqKmM2Ntn1IzIsZYP49lhDZLttYShtUaE:aBR8zsCg48Ej2N11wIsZRttTFE
TLSH
T1DEE433737693D82D6C9CBB6FF5249B8B921FDECE3DFA610E07B036A2018546C175A504
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Common.dll
- Size 10KB
- SHA256 10757a2b90b6600c0e9e21777fb2c1b5ad05b7daf7dab134ffc4d81b9a41d3c1
- MD5 a242637885b1aa79bc479ebb349ce362
- SHA1 3f11be618fc55c331754602e8e95b21e1b9b8e73
- SHA512 40423069ca0ef66ff0fa576f104c0fe8f7867fbb6fc8fa225800e94ca230d845faab674f2c54ae5660b13f1a19aaade0c0e877917a041eaf393c478e73119bcf
- SSDEEP 192:nUHGDk7kGLF6rn3+pgt9FEC3ZPfA6llNaBFG7:jDk7hLY+pK9iCZA6LoBw
- TLSH
  T18322FC4A977CC63FC8190B7AA8A30F0217B0D708E6115B9B4F70AC1ABC6FB1596617F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Installer.exe
- Size 5KB
- SHA256 e38574982597964f8cc20e42ea954a84530a963f6f84ea8c3f43041240fe7665
- MD5 cc03b2e5e12dd12d1b36011c79cf3341
- SHA1 fc1004afcbc9993c0f96cbdc09569d68b6c618c1
- SHA512 d9365707c2191ae621cab6cbd02569e9b19aca78ded5b2e8b4ba597f6bcb70795a18494e88e8d3852cbed0acd3d7297cfd63ad9544d4d07444de718ab200c5a8
- SSDEEP 48:6+E/Jokq88gNRzH2rBJEQ4khvj0BfcO6g+Wi+f3eqcGBhHOuljXiqspfbNtm:E68DNR64U0SOhiBSPxXuzNt
- TLSH
  T10DC1550197F4536AF1BB9B30BDF302610A70BA52AD369B6D2A44115F6D22B508DB2F73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery defense_evasion
behavioral3 behavioral4
- Target
  NovaTools.dll
- Size 1.4MB
- SHA256 736669751c1e886f066be12a7c3ec7321add7bf158e7ccb0892750e990002417
- MD5 beecc117a090aed23a5694cb1063b75a
- SHA1 c91960f44c53bf2067ea01ccd6eb0ed2814929ac
- SHA512 f98a205642fae7ce37df1c11997eee05a18d9ca67bda5bd394109e6ecd7dc33c872ea0937711250035ff5b3d7a128ca82514a071aac60ead18308c68cbc06080
- SSDEEP 24576:2kphdsnnVxgpkthVktsB9Uwn46VmhtYsa2D3Zw5ufcdJJXoxh0lhSMXlIiWbb3XP:ThM9tvMsBCwn4/Y0w0oX1l83X
- TLSH
  T1E865B012FAC581B2E18C01B0B17E7B7F0A391959172544C7B3D46DA499702E36BBFB8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Uninstaller.exe
- Size 5KB
- SHA256 ae08ab2eb7bf7d173f97abfa10327bf4e8aee962c1cbe74ded4f7f8b1e76dc0b
- MD5 228defbdd16c7a7001f45a0d39f31720
- SHA1 446c4cb735469f70ca81f3e4a4dbd2b51b4265b2
- SHA512 9ac9087cffc48244c30d07b7677208079cf98f6f6b095ed6500fc0474bf1ea0c165115031e6a69424052cf6abd55be72e97c2400d0661ec4714e53d022fe2dba
- SSDEEP 96:XCvI2aN5l1CnAr450WcOCDQy6uEANR3hE97xzNt:XCv/c1kArZYlaEANRIX
- TLSH
  T1A8C1970293F4976AF1B78B30BDF302510A71BA115D36DB5D2A80151FAD62B148DA3FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery defense_evasion
behavioral7 behavioral8
- Target
  input.vbs
- Size 973B
- SHA256 ad490366496cd4a24b1068c75a21d77e25771d573f577bab27e5de1ed9634e61
- MD5 dfd0db5ef77293170f030c6e9c8e1876
- SHA1 9c02298e861aec18f5c35904f076c6a1d6513c8f
- SHA512 294810f08566dc0def9828d16b4fa32f5ce1b0c6ccc4e74ec0fa96b20e88f95635ec02c344b0759716ac413c56109b33b4e4b1a275ed90249733b88aa3d7dd7a
- TLSH
  T1FC11E1662E4EF1A392B0865A53F3C298E34BC1783225D1C47C24C0403B18A9F4DF3D7A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10