3733927b527f95202437dfe7e58d12c153f1e6d3e9d8a3738420ddbf68defe2e

Sharing

Copy URL Twitter E-mail

General

Target
Hell-Copter_Win_IT-ES-NL_ISO-Version.zip
Size 489.6MB
Sample260622-c9ltgagx2n
SHA256 3733927b527f95202437dfe7e58d12c153f1e6d3e9d8a3738420ddbf68defe2e
MD5 cba80738e33efe12573b3c943543efb5
SHA1 297d721900cb648d3c0310c6e5b8a7a8b0b9a341
SHA512 377463404716b52abc58c89a02e0119318823268a2f155720aa68e71d170ce21d5fe1d8d1aece0a09ef70045456ee6979f38e1d054bf571f2784a0c2deb6f3f9
SSDEEP 12582912:LwYLymueIkfb+rVFZgauNraIlL5DbTmgA7LuxygaVIG1DqQt0eB+8xKYJfTD:kGyJenT8VFYFaIlmfux92IGthwEJfTD
TLSH
T1873933C0D2F36E87722CC5729AA13C4016AE111AA51390CEF26EA3F4895B7D7875F4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DirectX6/directx/drivers/dut/mmmixer.dll
- Size 5KB
- SHA256 4d21d8d02f5df7c2edb4949a4f3dda14fca336da0b17ef584e7bb9d3a1cc70d2
- MD5 7386435853ba7f02d0cafd7b15ac5639
- SHA1 ef90b4183bbf355a3f28571042fe9a00daa7b378
- SHA512 8c4a7e3ac50c132bcae2af87f578904e0aacc91315c115ecf8291180e4eb1b6dda3bf4bb7c074aa9da6ef5b11dde8254e4720eec3792961075137f4d2d56b0c4
- SSDEEP 96:Y9EjX0d9xS7zljWT2cSRIhQTYaiXAI/WXfU9xjCDHDl2:pIdXOIQ0aiXAaWXfU1
- TLSH
  T175B1944320D4E982CA9E4EF26BA7EBC357EC47386395701764C9605EBDCE1F8421BC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DirectX6/directx/drivers/eng/ati_d3d.dll
- Size 165KB
- SHA256 7ccd24576e221e9425163934ff8fdec8fc0d6b456d9db556aa574f535072153e
- MD5 daec6ea5a32e4f8121c195ee473264d9
- SHA1 2974b4cd18deef816213e448e491ae2c6d789922
- SHA512 c53bedc4fc09452c696ed4da9be27345492cbe243e81522ed3af06581512a6fdfe4929dcd4aa096adc91fc2d80bea00f00a48090224f92935aafedc2b36705f1
- SSDEEP 3072:1iQV+gf9bAzNWC+vTdGpQeMWJzzrJTAcFOwOH0:AbMcd+BkjMWpHdA0
- TLSH
  T1F0F32952E93350F3EE266A749B68E7645E2D17843308B1CB2354D2B258333E15ABF877
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  DirectX6/directx/drivers/eng/ati_dd16.dll
- Size 10KB
- SHA256 b58cce587431db12416e0dcb2aa49c98140e65023405388455e1a2cdc9e705c1
- MD5 088e88821fc4d96550239648baa51381
- SHA1 abbf56d383154bd861da5b2b2608a1730481ada0
- SHA512 01a1676d9ccb63769c3ca313b306bfd59654582e643881726f487e237f50a4377e362a5be22c5e96b649d24f4caf8b869e66cdc186b779278b110d299a177251
- SSDEEP 192:OUuYxrgmuDL60aNN0I5KxfzIwEVsjuM7dLJKFpSPCTWcwEFMsDCFytiej7:Xrpa604N2L7jb7NJKmCTW5EFMscytien
- TLSH
  T1AF324BAE1181A099C67DEB39DB86E3AB6B9FFF0943D267675610317B2F300724236118
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  DirectX6/directx/drivers/eng/ati_dd32.dll
- Size 327KB
- SHA256 47171e1b0d10782065fb499dfc5ede7e2e1c257a2634e714d21f5ea8f838cb56
- MD5 6c7fc613a221ff9eba55b98e8e26e5e6
- SHA1 f8004ad3d85541fa5dc7e83b6ea4900fc79ec042
- SHA512 a8b07439339eefe794e0e8b3b22aa75005df2e68781f6e5b009672e31ea117f5933c05477e91a8cac50204a80dc62cdee462577399effde63e0fc53ce08227ac
- SSDEEP 3072:QvNE1X+WWE+T+OYVCkrjIMV8shcJXkrJp:QFEHWTYgkgMVP
- TLSH
  T115645CC1C757101FC88662BA3BE069ED106D996D0B12ECFFE6342CB4F722591189FE5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  DirectX6/directx/drivers/eng/ati_hal.dll
- Size 83KB
- SHA256 c40746a1d9dac7b266724ca1a5fb749d9e16f699e034f3a57cf2be61786d7af5
- MD5 2c29487498365ebfabc2a0172733081d
- SHA1 f6e24be572502ef3caba23fb3be55c17407a5b90
- SHA512 9c561b9bdab02ca2b2c0dc4b22a664a1448a12e444f58d01c4b73d30d78e6838dd077d9a9115045991875b136a760758de00fa8d86e79a659e577fc279ef61a1
- SSDEEP 1536:i6TNiqL69U6Iyws1wqrVd0r98ji8MjL0gn0XConG:icNiqL69bdwEf9MjLLn0
- TLSH
  T15E8319312AAF90EDC607C2F494BF50A6F116C982AB913DD176F591FCDE0498CA34B729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  DirectX6/directx/drivers/eng/ati_vpe.dll
- Size 18KB
- SHA256 1b2606626b565cf0266bd367a2608c52a762b1a1566eac8782bb498a3fac218a
- MD5 60fc1d928deeeef4476f033a27ffdf4a
- SHA1 7eb7a5e4caa153051a4c05a274f24b3b593213d8
- SHA512 77a8115ca0125bb86dd35bdc7413aad092fb536b71d2a4ddaec244b15e714d286023f424717e50d360ffb2b96c8280ac98c0543ad366ee9cc70a6f532e19a110
- SSDEEP 192:LhadMaV9igFhJwjn9Oi6SN8zfW2UipjHkbG3TjlvE6RYhBqZzHC9WYfNZWXoWj0:L4d9IOhMwioW/g/33zYh0ZmW4ZWXoWj
- TLSH
  T11A82C611FFE6C07AEDCD323E3D115D79AA36AD1C42B61421A55E0C7CEC128B0EB29792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  DirectX6/directx/drivers/eng/atim32.dll
- Size 10KB
- SHA256 f4693779f2a98ccdad3fc441ce339b5d230d4d01fd8974f46a6759e786d584cd
- MD5 1f08215c2c01335ea9a12bf049fade67
- SHA1 b80b38c9c744f054b5b57377b903ae97545a1d48
- SHA512 3d9dee287b944f891b26ae6c7d4f2a9f874567c6a50398fb4679a0842931fbb96cd001f406549169560d0ed68553d15880cd83bee95217ff46640a7e82c746ef
- SSDEEP 192:7he4yiVFXoz33sralVdwrGiDcs9XWYb++WbYWuj:7he4t0ELKiDjtbLWbYWuj
- TLSH
  T16E22A70379BAF41EE6E64136456EE802B8396D6D458E4A6FDC8414BF28F14320F5BAF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  DirectX6/directx/drivers/eng/atim64.dll
- Size 18KB
- SHA256 178a55609de60873cf3139e1dde0f599b4c575dd4adafbabe36d7365dd98def4
- MD5 3625979d8ff2df1cb06a5b59830ccb5c
- SHA1 cce927cac80debe248ae9879818935aa44a4759f
- SHA512 b56ae7071f08e82a3149917819c6c2a8d32d6a6e31d1f8ba5e66ee9333a0bc6e8453738239c00e614ee0d140a1f4c8e0e4c24bebda3b2ea5fd881d966dbe345f
- SSDEEP 384:m+n9bmRWdvwV/qenOOHyMmOdSk4zXJesXo0XTCbW27W1:L9bmRgvwQuyOAk4VeyoKiu
- TLSH
  T12182FA13FAA610CBD5575E3421A61337563D41FE0C1A8BF316249AF03DA783229A9F76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  DirectX6/directx/drivers/eng/chipmm.dll
- Size 13KB
- SHA256 ca51c73f53b00cca336c8bafce901ef23b9b73ea0c767b3c7ce5012c3838c11e
- MD5 2445ca262dde7a0abc29d10c3fa99863
- SHA1 4246632117c10d342543b6822b67e4ec5827b425
- SHA512 45b8cf777abf9aa7be21842801a21205f716a46bd0b5aa4372496d61c7a8ccc0437ed415cee4caa08a9d1428f219a5c01dc2d763b9c90955ca04e6c2c12b7585
- SSDEEP 192:5g5akL1VC1PIT2shPmrZyVU8EiLeQqDaOzG5P9RFrUp0YaBenBUzSUltWHqWo:5gEK10QT2soEVctI27j7ktWHqW
- TLSH
  T16E52F980EBEAE4DAF58B5F3092EFE62B7D3A660008D85BB7C11205F12DFD461012D675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  DirectX6/directx/drivers/eng/chips.dll
- Size 9KB
- SHA256 0e4e9a4984699e29b9067322764528b7d500fd5982edcba6ef305843859563ee
- MD5 13b09ce13f21531feab6947b648ca3bb
- SHA1 67f144d356d05270f7b6095e3131bc38a7d9c7f6
- SHA512 155e223f7c2fbb51fa01f510c0a86d7c3a892feb76230ad052ad0240d553009d79fecf448581a3ffcf79558f85cf74f8dbf1fe62acad30206b11f5d40c336dc1
- SSDEEP 192:GWwownFc7sChw5IEZ55/tsntlrl1j5aYWCIW:GWwoQy5nxt5rWCIW
- TLSH
  T15012FA45EF759446D0BE5E3001EBCB32BC3A7A30841457778AA26EFE3CB464D8524BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  DirectX6/directx/drivers/eng/cirrusmm.dll
- Size 45KB
- SHA256 64be695bf09fad4b8fa75bbf305a78f820518b6edef0ac306eddb8d65ffdeb10
- MD5 1e774506f073f380e4781bdf22a9bacc
- SHA1 244e7e041f3b1c521504ab58563ffac740f7a0cd
- SHA512 fdccd0d8e596c3bc6937f383452fa88ad95bedb0df9e30637b2503001a7ddbad94e887eb54ea0f102868bb6d16c58cb3a3627fee4e4b4793d212823a2ed94e70
- SSDEEP 768:3qhCgOyvGK3a6fCiwUVUpTGvxv0OViaakZD74OfMFqnA90A:3qAbyvvxiUqtG6OViQ74OfMFZ9B
- TLSH
  T194233A40EDDBF3E2E1850E7112E6B11729754F14003FAEF78C0939B22DB79214A29A7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  DirectX6/directx/drivers/eng/cld3d.dll
- Size 393KB
- SHA256 1ade0e940f71d4ba7fe740f71698be0a59bbbe2a4a902582ba713267f64c9c46
- MD5 279eaf73c1f3285115ee3d95e15ddbd7
- SHA1 2243316d24adac92c72720904700ab143707befa
- SHA512 57a69d15468e3d63a362b79816b81fa2fda98131f6f2195fefb4302e0c31550807018088a43478544771ac0e0a2b3494422a07dbc37f2898fcf72ca4690afb1f
- SSDEEP 384:L6LSwomVY6oxCuZJLUsdKd69XBqJ2xvwBh0xavWckWur3+S:LXmVYT9HKd6KJ2xvsh0w87+
- TLSH
  T1D5844C01D2F76291C9A716B84177F61DE8254F4890BC5AB6CF2C6A3F2D62F30806778A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  DirectX6/directx/drivers/eng/cpq_bb.dll
- Size 3KB
- SHA256 ca3a4b3ba62c5cfa0dc8846275fa37428b45c9f2f9d31551d3d97657edadc236
- MD5 0265f7add160e2a4448581be173da826
- SHA1 6bcd7af711fb219201409dfcc1f40d53a2ea67ec
- SHA512 f8dbb43d1b4ee3dadcfcecede557f763e9050184640bf7982b4e41657bf3c2ac6fcac854dd7ca7097ee6343fa6b6a68ab0f336e38dec2c4ada5d49cbd9f80214
- TLSH
  T16271F9C722E4D459C92D7A71AE8FE3DFB1EFCF1E009647577440A65769801720B2A24D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  DirectX6/directx/drivers/eng/cspman.dll
- Size 18KB
- SHA256 09cecdf18d6f6d7bfc05b29e43404768d956480fc416177e72e04c920ebcc132
- MD5 27d095f202028cc0ea9ebe6dad46d6fb
- SHA1 ccd7ce5a7d147a98a170563beb30fbfcfbf52c1f
- SHA512 655c9936117f060611178021827c53a09399657db026016ca77fa3f4490abf42a35e377ef27780568c7c34b6695a90881c24d47cf9dedf2a499b48a6da40fd67
- SSDEEP 384:Su/vMxkD9jC8VmIcrFMo09zK22BAsC8ftgotE:dN9+8VerGo3pBAF8lgoi
- TLSH
  T1DA826D0A3666E9B8D2DF88F45313D7AAA16EC98DDA64321743F41C7F0F68B6D174003A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  DirectX6/directx/drivers/eng/ct_65550.dll
- Size 3KB
- SHA256 3df2c14883418baf4eb436d115619c2be5651191774b355e7a79aa5556f25d52
- MD5 c6977612a0e82a862b9fa833d74ec551
- SHA1 0381735aba6597ab4f292e43f7bcc90a84cff6c5
- SHA512 2039cdfc6e02dd4d04a00717317868422491a1934325b288b48cb81a95e831ab23e190083b106e770c2a8aad7a8fb943ac131ac45f08a628229bb19832c42656
- TLSH
  T15A71F98722A0D419C52DBBB19E8FE7DBB0EFCF5E0492575BB054A5577C400720F2A25D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  DirectX6/directx/drivers/eng/cwbpcple.dll
- Size 38KB
- SHA256 903c8203e3cd76485dd4853eb914600270284c4adf8f1d847a7b425ece24e259
- MD5 12e0e3af74efa15b2db3b617352f1747
- SHA1 10afe9ff7470e5154e4c8be4f0a93d1b7465190b
- SHA512 5c69a55722f92a1722b296754aa21545f1b6700aeea95b3a65c1e587df1ba03bf5658b642e64be426ff4d7d58d1e21e251ba5cc41dfb44b92afd802760937aa7
- SSDEEP 768:xEjFCch3+0M27OdsLSdG6g8vRz4IdDSsEl:xE5RuG7OiSdUaRz4yEl
- TLSH
  T1FD033A1367D681F2D1AA427C22F63B6B94336E2153FA98C3CB9228BC19735D0913535F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32