dbe0ca1c9d7292fc7c10397469883d9982e2f7c9cf747f4d536bc869def116ab

Sharing

Copy URL Twitter E-mail

General

Target
Kainite Permanent Spoofer.zip
Size 14.5MB
Sample260622-23a6tshs7v
SHA256 dbe0ca1c9d7292fc7c10397469883d9982e2f7c9cf747f4d536bc869def116ab
MD5 3c80291e850a518b1df6b7774eb1fef8
SHA1 0b106f7c75a519877c4964fe7fce79a309fbfbf8
SHA512 521501c4d077a50134b4e6e39bb31f64f0c2e6f346ad3ef684e7afbd00fe348f311f8910572886158614ddab1512c6cff3ace9704f90d8c07c5e5d60778ed748
SSDEEP 393216:t4qoxSHIvavJgA3eOTBhBq/878Wr2ZTf5uBjR:eqkmsaSA3eOTsy8WiVf5uBd
TLSH
T1B0E63390A42284BAB89A86B002FE2754DF884F2065455DD2B915C9F8CDC3E6B3FCD5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Kainite Permanent Spoofer.zip
- Size 14.5MB
- SHA256 dbe0ca1c9d7292fc7c10397469883d9982e2f7c9cf747f4d536bc869def116ab
- MD5 3c80291e850a518b1df6b7774eb1fef8
- SHA1 0b106f7c75a519877c4964fe7fce79a309fbfbf8
- SHA512 521501c4d077a50134b4e6e39bb31f64f0c2e6f346ad3ef684e7afbd00fe348f311f8910572886158614ddab1512c6cff3ace9704f90d8c07c5e5d60778ed748
- SSDEEP 393216:t4qoxSHIvavJgA3eOTBhBq/878Wr2ZTf5uBjR:eqkmsaSA3eOTsy8WiVf5uBd
- TLSH
  T1B0E63390A42284BAB89A86B002FE2754DF884F2065455DD2B915C9F8CDC3E6B3FCD5FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FlagFix.exe
- Size 62KB
- SHA256 e4e9bb81df55e62056857f322a8e17a71b0a79d76d915eaa7cfd5af6021ea6d6
- MD5 8f9ba4a261bfa6a4c388747e958d8a74
- SHA1 022e80c117b9bea055bfecba208e6c6a4245f1f5
- SHA512 7a542b5395a34d163f1c4f93d709f4e4747b3344c83fbcb9f6f17eeab3aea3c0dc00cc8d222967a3c3927575db3799e181d6e641e1197686c56a862028ccab8d
- SSDEEP 384:cQRa359BOdSY790HsdHeTGyc3yxoIWr4GEfVwdms/gbTQfB17ysJAQ9XMr:cQM3LTUFyOaKeg/gGBgsJAQ9c
- TLSH
  T16153F68AB39520F7D57AC23D9AC51329FAB07071132657CF5110097A9FA06EC7D3E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Invoke-RunAsSystem.ps1
- Size 5KB
- SHA256 bb74af58225bc3a54a77c6b8fa0ee94f508fee8d3095a0d354631ed091bb2abc
- MD5 9ef72508b7a152ea4276825a3cca7653
- SHA1 b4bb4e93a80415ba25c683edf8ac30f143ae3774
- SHA512 a47c10fd5723f4fe2f702c0eebfa7acbe4d0d3667c71a6b4bb1dcdc917e5c044765cee5da1ca9d29dd7ded2d7c28000cf3b4f7e8f42980859989af37a3bdf2a8
- SSDEEP 96:mebBvEt7FlT286l5X5H3NjO9CpTh9ki8rro/axTPP+pj1F/Rcz27:7byeX5H3NjYCpvki8rro/0TPmpj7/RcM
- TLSH
  T121B17525FB8ED1EF8BC113829537E0858D6DE174313B9C92FAE8EC65B090CC952B99D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion execution privilege_escalation
behavioral5 behavioral6
- Target
  Kainite Permanent Spoofer.exe
- Size 20.5MB
- SHA256 656e7bc87e5f55328509488b64a17ecb2de9abbde18a97f9d3bcf2a8a609e2a9
- MD5 9696e66aa41e85f198183e46cb59ca61
- SHA1 e79910bdcf46cf0638cbfc953da31053dbfd1c8c
- SHA512 1a3b733ca13aa4fb5b3566cc682bdf93942fedebe07f13da0e0f7eb3e32f13bf153f0dafb6c28618a88379b2a70aa9ebb63bee982c4fb1e6ca21108adf1ab356
- SSDEEP 196608:b0NCtNRkfSNCt6Rk1aNCtURkuzNCtXRkL:bqCg4CTwCqBCE
- TLSH
  T1EF2749E88E5D49FC7711B638A65B629777F27F4E76A0DEFA2AC08CA3780F414B120154
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7 behavioral8
- Target
  USB/ChgLogo.efi
- Size 97KB
- SHA256 22d51e96cfa49ab4e784a30ecdb9d660f7b638978a1acacad4024ac857de05a1
- MD5 0e628b208e9ca8e30009bf2a03342a9f
- SHA1 f0420cf439c679ab6f4d777e13198d2065f636aa
- SHA512 f4fb61085ab7c4905372b9fee446f6758b34c1373c3cffcb45b278d92327c75f0e2d572c3cae770656d13edbeb38ca971664798430821fe36e5916780126736f
- SSDEEP 1536:+EZGqR5IbbyXhn1de5oPl587wCkQvdQ/R+vDtk8MQ9dNHgj:+o+mFeoPlS7wCkAMSCQxgj
- TLSH
  T16AA39D2D7698107AD082D231C9566757D7F374062160934AA3ECCAFB6F737622E1E32B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  USB/Compress.efi
- Size 105KB
- SHA256 dcbe235a3c3c1c0985959a6a018fcdad1580678f4c8293923bf458ce24c7843e
- MD5 c1d2b5bad6ddfcff70cf46f72c341330
- SHA1 70eb19af13493449c2cb5d7963db4952a5fddddc
- SHA512 750fca339ba2a3779d6d48c936462f4af2cf93031316afd5d1110cae55d5e9ef08351fd3167859a2d40eda6be28a0233bfde2b4d0e245fe2b5da01a5ec895852
- SSDEEP 1536:aCCwItFwQgyAA0BDW8fywq4Xd7vFXeujg22E/lPplXmdOr:ODTL8fmG7vFuL22E/lPPXtr
- TLSH
  T1CDB37E2EE3981078D193C1B3CA35575BDBB378196060936917E8CBF66F23661AF1E306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  USB/afuefix64.efi
- Size 672KB
- SHA256 5f2d9eb4aae0be5c0ba04a5258358468154cd77de81adc38450e3ea188485c72
- MD5 93334bb43e13ff69e3668e59a0f05ae8
- SHA1 4200831d2737605edee1ea21dd8b6fa3feb320e4
- SHA512 96eb7d0090730c90c121cb1e4ed2a192fda0a671713fe84e9751f67c41597247a3ff2ed05d6e1624d068ffaf9fc216e9ecccef1d773f08b45e8ac987bf46c8cb
- SSDEEP 12288:WA7lM1lxMeG61uFdeg2TKZV0M3UmezZ5KXjRwf0M8B:W6lM1lxMeG61uFdeg2T8f36dKjRwf
- TLSH
  T182E4194AEAE761E4D4BAD0398553312AF8F078688335ABD3E7455E164B32BF4E53E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  USB/amideefix64.efi
- Size 357KB
- SHA256 c5550562e3daaf88863d99d32ac52c885ccc4d7ca5d7b63633e8c4cfde4cbf52
- MD5 4dc739a578c4a2b4358464f6314939c5
- SHA1 8b2f0e2840fde38223505c8df55427d7f045f51b
- SHA512 b5d6e60af2f6c818c069c417e52425f47812beb91aa81100ac4c87ee294e1d2d26bcc1decc0f863848bec0047368b094cec4334d329821bb4f1d21ddcf2f21f0
- SSDEEP 3072:vVIG+WG0MDvGqA/9SEiXYHszWQxwCxluuy7vJ1YrxBHuPu:v6G6RDvS9TQpfy7jY
- TLSH
  T1CE746D56E62500B8D496C771C87213DBEFF2B4BC8225836933AC85A95F53398AF1F361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  USB/efi/boot/BOOTX64.efi
- Size 941KB
- SHA256 38d461a6debcda499a0660d11d051a68cc32fe459d4f370f77123b809a9286d3
- MD5 4692305d884feeaac0c22cb2fb94aa72
- SHA1 ff64c8245e9d775d76f0b0ff26c8ec548ff07a00
- SHA512 40e0a4521f3fe7698ef24a64eda1ac1ecef78afcb69f4a0fbcf24641db95d7faf110c6afcabb955bc4078acabb5d9ca8dc35ada57f1f125eb6300f9aee672a04
- SSDEEP 12288:3ZMUTrc8WmOKIPk6n0W4jH2qD/tFA3o+3cBKNz:3ZMUTSmePk6n0PjH2e/tFvUNz
- TLSH
  T125252D0263FA4148F0F7BA759DB641769BB77C89A938C60C029CA15E1FF3E109D24B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  USB/efi/boot/startup.nsh
- Size 818B
- SHA256 f744528bce0e3ccbeb1cac3bd88623e09a4b94d83151e39fe1b70f050fdfbff3
- MD5 a14e3a329b3702f97e2121d257807bde
- SHA1 17f32b98a2631ccb21c0afeccb2cc368b2b9821b
- SHA512 81b6f7134868d704869ba150401f9570b7180bba471d0a19e2b3bb5a59a544c3f668e05a0bdf78112d5faf6bd61be4cbd86f7e4b88dc350fa15840cda52ea03c
- TLSH
  T13A015E14A146E3061E8DC48392A5DB7FFD53C51FA0EC6BE88EC244085A87D7C2360FCA
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  USB/flash2.efi
- Size 133KB
- SHA256 9f267058f4e00e5bac3b09211bff9488ecdd94d1cf4baed8340a33df70db5093
- MD5 5a9c7b4844c5a34515d9750031d5916c
- SHA1 6ef4bc5ee4085dffbf7a9c01be302e17de3440b9
- SHA512 6c247426a8eeede81a018cfa8efa5c54a1860daa9478b11b072127440a850451cc901f9b664d77d2dfc2f38331fefc156b9fc772be18f48a40c0e3a4b5d3bf7b
- SSDEEP 1536:43r4eHzWPSnZFZ4tXTNkzoquEzAN/x/86tgGnvLm/Rx9KjLA/jbMQ9dWdsNK:4Eg7CBEovzx/8ggGvgr0LbQPK
- TLSH
  T1F3D39E2973A41079D1D2D331C9525617D7F274422250939AABFCC6BA2F33761BE2F32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  USB/imageM1U.ROM
- Size 12.0MB
- SHA256 fdfa31874f3de4e7a7f75cfb79ac6e8b1b2ce5eea2ed5bac28d98d65792ab007
- MD5 dec8d0095956b5e43b388d41634e5b8e
- SHA1 057a55b74b8a5a4e41f7a537ab61ec59cab6b0d2
- SHA512 0b7cb2357a19365eaf09c723d9934ee37a417a2895016ea669fef4f1a6f74d3e055eba64870c3219f238f6c82094d540a590911539dfeb9b60784d5a8970e634
- SSDEEP 98304:YOp2hld/TVeA9Q286t1bMK0WiHUETpRJiis7K3a2ote2WAa0sLIzJuhPZcVIrcu0:72/B863fhbEbJFs57E26houhPGLmX/f2
- TLSH
  T1E7C62322BB91C273C49A02B005D1D7666F3EBC7027208ADB27D43EDA5D765C2B93671B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  USB/logo.nsh
- Size 431B
- SHA256 77f39add48b918c41450440355a0a9dbca20475aae666e68ba5ee15954498d7c
- MD5 11c82414f63075c4c3a29bd17e8d4600
- SHA1 8158a3206faa9bf150425134d19481e11afc0a95
- SHA512 6188dc916a117b6b287bb5594f021a5bb759696ef798256a9af1685a4cdd7cca09a4d2bfcc68a1449a8a57949617ec098349a0f28bd99d122b23c6edd824f364
- TLSH
  T135E02B55300742DFDE71BC41CB02B949D24530CB6BF923A4FEE4D4E263292BE88C042C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  ges326.exe
- Size 1.6MB
- SHA256 0131fe30c779e2f37d4fbab24e6c56625d94d8ece8c35070903836fa432ca2d7
- MD5 639e568c04c35d13c4fc00e933511f76
- SHA1 4d1b21382697f870c4781332574fcb9a3ad98a17
- SHA512 7480e8e4f9ee766cd2f4b5e90700c326c913c9d7588a3e9331b5f1d6b2526b41282ffd80b16a134439f662d196ed244af800b96d138bb58569df9720da4a8d91
- SSDEEP 24576:zMCp6kaBlmh5O1YQfZLrs0grxcjdnQBJAQcr3i7QdwMbZSgpyiYxjYVi:zOHyO1YQdsjcjo0aQdwMbZjY
- TLSH
  T114759D5BB2B000DDD59BD178CA464A07E775741503206FDB1BA88A667F63EE26B3F320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28