693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c

Sharing

Copy URL Twitter E-mail

General

Target
spoofer.7z
Size 716KB
Sample260622-csskpaht4y
SHA256 693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c
MD5 11f3fe1a16d72c441965f836db3be5e9
SHA1 c778f88c5ebf777d30efcaad6686afd95a7f1d48
SHA512 30178ece8805df527117820e74c0f42e99dc70c44253656de854e77bbdd0d71f9a0426807d67881228f3637a4df8dfbf5e26b980aa7b2855e7f361dd7de6062b
SSDEEP 12288:LDzMbHGPnKlMirOwpA5X1hEb264ZPG0H8PnK3MJrOgpz5X1hEjZ:fEHnrOwpi1eVM/KrOgpl1ejZ
TLSH
T143F423974E138FCDA79D043583A97A61E60EF73EF64F3F41F0152A81190C0A99991FB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  bin/Debug/net10.0-windows/AMIDEWIN.EXE
- Size 148KB
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH
  T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  bin/Debug/net10.0-windows/AMIDEWINx64.EXE
- Size 453KB
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH
  T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/Debug/net10.0-windows/System.Management.dll
- Size 72KB
- SHA256 0df38202fc81fac3017d9510cfc22b488f2989a7bec6ab9f88aae1cc739dcde5
- MD5 fd048963edc0e0a2fe8a9ef488ee8a44
- SHA1 524d556e01abe3c078fcd1ee07fb1e2cb3a1917e
- SHA512 9178cf14c68934818cf84e22ded998e917d9ffca7e8c88d3ef6c382413b7ce988d25d04dda687cfa6e4d6872e4f306124eaf938b6f18500e02fc431ca150c437
- SSDEEP 768:h3d7FaaAo2k+jsRaRF1S9h6VkVFxGooZOkiSLJKdbjf3AU+9zVCB:hN7FaaAFk7aRFy6edvoZOxS9yPfV6zIB
- TLSH
  T11E73A4005FE8571FCAE70672F4B84234EB74B6C72C11DA4B2A3B511D4876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  bin/Debug/net10.0-windows/amifldrv64.sys
- Size 18KB
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH
  T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  AMIDEWIN.EXE
- Size 148KB
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH
  T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  AMIDEWINx64.EXE
- Size 453KB
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH
  T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  System.Management.dll
- Size 72KB
- SHA256 0df38202fc81fac3017d9510cfc22b488f2989a7bec6ab9f88aae1cc739dcde5
- MD5 fd048963edc0e0a2fe8a9ef488ee8a44
- SHA1 524d556e01abe3c078fcd1ee07fb1e2cb3a1917e
- SHA512 9178cf14c68934818cf84e22ded998e917d9ffca7e8c88d3ef6c382413b7ce988d25d04dda687cfa6e4d6872e4f306124eaf938b6f18500e02fc431ca150c437
- SSDEEP 768:h3d7FaaAo2k+jsRaRF1S9h6VkVFxGooZOkiSLJKdbjf3AU+9zVCB:hN7FaaAFk7aRFy6edvoZOxS9yPfV6zIB
- TLSH
  T11E73A4005FE8571FCAE70672F4B84234EB74B6C72C11DA4B2A3B511D4876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  amifldrv64.sys
- Size 18KB
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH
  T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  runtimes/win/lib/net10.0/System.Management.dll
- Size 306KB
- SHA256 6a266b7a856baced0e757caf7c2e71649999f1321e7e6ff5df5bdee477d32a2e
- MD5 6d7348721c70a6121bd9361f8e794b9e
- SHA1 13353b674eb95006dc57034bef7167c6a521ea38
- SHA512 ab6b7d4aee822c0e79a41aeddbad8f4ced132c6fceb800c9278a4ec211ab769901bc86a56135e30098087fe6053eb23b58e1f02084d2e9926e7730170ebecc99
- SSDEEP 6144:WSZQ2/bmbrBsj0G2OkLYOgHynXjmxZtwFs:WSq2/bmbrB8RkLYOgcKxZj
- TLSH
  T13464061133F84645E5BF1FBAA4B060A5CFB2B7672D2ED75C0C9168ED18B2780A61335B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  spoofer.dll
- Size 36KB
- SHA256 815ae5c45d45f5817bb8b5d6e593c5186b4dabc07063745be370d43b12175e3e
- MD5 f080e8b923d33efcaf4fa4d2e24d1e3a
- SHA1 78b972031129170254f5d30207fad49160490778
- SHA512 224c4a59623a51338eb991258f180b635221f7fab5e6b46ba3eaa29bb3e74b9f2b0a35c3df69c81af8378cf558597ad85e68b03e13d5481218c5492ede946c29
- SSDEEP 768:0MMOLM7vsP/ft1+W4NtcND1ahhS6kB+J:7t1N4oRAhS6m+J
- TLSH
  T17EF2F80432F98732E4F88BF5CAB190110BFA792A5D62D70D2DDA30EE1A62F544991F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  spoofer.exe
- Size 159KB
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH
  T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  AMIDEWIN.EXE
- Size 148KB
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH
  T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  AMIDEWINx64.EXE
- Size 453KB
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH
  T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  System.Management.dll
- Size 72KB
- SHA256 0df38202fc81fac3017d9510cfc22b488f2989a7bec6ab9f88aae1cc739dcde5
- MD5 fd048963edc0e0a2fe8a9ef488ee8a44
- SHA1 524d556e01abe3c078fcd1ee07fb1e2cb3a1917e
- SHA512 9178cf14c68934818cf84e22ded998e917d9ffca7e8c88d3ef6c382413b7ce988d25d04dda687cfa6e4d6872e4f306124eaf938b6f18500e02fc431ca150c437
- SSDEEP 768:h3d7FaaAo2k+jsRaRF1S9h6VkVFxGooZOkiSLJKdbjf3AU+9zVCB:hN7FaaAFk7aRFy6edvoZOxS9yPfV6zIB
- TLSH
  T11E73A4005FE8571FCAE70672F4B84234EB74B6C72C11DA4B2A3B511D4876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  amifldrv64.sys
- Size 18KB
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH
  T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  AMIDEWIN.EXE
- Size 148KB
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH
  T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32