25439ab0e8f95c286648b0fe51fff836a7293f7c1b04262d6ea41ebe57eef011

Sharing

Copy URL Twitter E-mail

General

Target
iOS_Indexing_Checker_Windows_NoPython.zip
Size 26.8MB
Sample260622-sd87wsdw8n
SHA256 25439ab0e8f95c286648b0fe51fff836a7293f7c1b04262d6ea41ebe57eef011
MD5 25258851ff745ad7bfb9a407ca8decf9
SHA1 af0301999ce4fc9f902fbdfa88a6b0ddf76991cb
SHA512 e8bae193b151911904a2350fd492d42022b73e06f0f40e1d895ed4a696041fb9c8f10c29a0f7f2d51ca10d13b2c0a6062cf92d6a23cfc9234d1b5aaf73b5e4c1
SSDEEP 786432:lg+yaLoGLlNB2NWEYbtaRD2cuj4pIWDoqvFOqR:lfyCusbt+2cujgIWDxvFOqR
TLSH
T1EC573382721D5E0AEAE6D49AD0110B794F8827D7E4AD4156BF0BB7279C44E23C8F721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  iOS_Indexing_Checker_Windows_NoPython.zip
- Size 26.8MB
- SHA256 25439ab0e8f95c286648b0fe51fff836a7293f7c1b04262d6ea41ebe57eef011
- MD5 25258851ff745ad7bfb9a407ca8decf9
- SHA1 af0301999ce4fc9f902fbdfa88a6b0ddf76991cb
- SHA512 e8bae193b151911904a2350fd492d42022b73e06f0f40e1d895ed4a696041fb9c8f10c29a0f7f2d51ca10d13b2c0a6062cf92d6a23cfc9234d1b5aaf73b5e4c1
- SSDEEP 786432:lg+yaLoGLlNB2NWEYbtaRD2cuj4pIWDoqvFOqR:lfyCusbt+2cujgIWDxvFOqR
- TLSH
  T1EC573382721D5E0AEAE6D49AD0110B794F8827D7E4AD4156BF0BB7279C44E23C8F721F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  IosIndexingProgress.exe
- Size 27.6MB
- SHA256 34f2c591eea6cfced272c48b0f5f7368a3d173870514e11ce6add51f56112c2d
- MD5 9e376a2f47ec44a85dbf00704aa9ccfe
- SHA1 9d272aa713c5363e3f4ece3bfed901f8e8fe84ec
- SHA512 1c2272b8d749690302e592bf4df8b87a0d2b6fafaff174dc09b28ec57b1d7dd40361abd068e96b193790bf02d4204496016995b82315f4d85d7ad4a0e30f5fee
- SSDEEP 786432:5Y7I7yZdgZA5tq8QCt/AEyVmdjNNaf78boe7wGJpY:5Y7nW0QOiEyVQjNNafooe7rJpY
- TLSH
  T1AB57237563201A7BF291FE7ED480F730A65E79027AB364C76B462632284ED9B5FE1700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral3 behavioral4
- Target
  IosIndexingProgress.pyc
- Size 8KB
- SHA256 6449a03fafc886c6713abd7de4d3c7e10dc3c1547355a66960b5673d4231b3d5
- MD5 aa3aaaee23b422aa3dd3074a6b97e1cb
- SHA1 927813c06e17c69fa3ed00d0b62da82bd83b7306
- SHA512 0b6ffc0681b499147a3dadef7e46151c6676d20bfcf9607c6a871bed10096af4bf55b57788e37a505f2a84c44c061f4587b4a5cc79ebaf3fed7922343710b9a0
- SSDEEP 192:QNmFsPMbDgTR2ottYnR5FQ2fRvXnMH6w8y6XGVb:myIqkdJtWR5TfhXnMLaYb
- TLSH
  T182125C443A088663FCABF0FD550483282D71162C6B9855E39A4F83EEEF85790683D3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  README_OneClick_Distribution.txt
- Size 1KB
- SHA256 596b2f14442bb1bf38195f6961ee60701d74fc7545d8f111e2a271d25a22b305
- MD5 9e24fa97404e28dd2e15703e935d9856
- SHA1 17ceb796e5391727d54b30a608722729910533a8
- SHA512 aa25d3f874d8c96e51a34f571d57ec7bf6424c3ed9d08a35389606d6404b2987afc883eb8489c3bb86d36613b7d6ca788769430d2f0a416b06f5af6ea59f9814
- TLSH
  T1E3215418431AA611EB381DC21B4CE9A57165B9A55F3DC8EFC58BC261ADCC999D033AE0
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  Start-iOS-Indexing-Checker.cmd
- Size 348B
- SHA256 f922c179fbef251b66fb1f4f4a845065367dc62fa83d0dd9e334cce128e07ede
- MD5 cb5aec0b0a347df6524f33efd5c7a728
- SHA1 6e2bb1899567bf0c1f171f63d26225353a5b699c
- SHA512 592e7bc9802580b19e2f5e1081686fd6394deb045a3cdd9d3b000836785cddd4ab939502e317709b5a0cb2188af557236d1cc9b20d58f3a6faebf52ff42299fe
- TLSH
  T17AE0C02947850780367B0AC0504C2A6D647E4686EB14DEC022AB017F1C4C4CFD06F3C5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Start-iOS-Indexing-Checker.ps1
- Size 16KB
- SHA256 6bb62e1e60cf6654039a6631668bc3650b49c8526b4d6cd639f24c0fca7ea260
- MD5 1c8d6fe538f9f0564b00ddfd3691987d
- SHA1 7c78a5891f195225c47163cd62a82e8d6adeec71
- SHA512 28a2267b63626b261f202aea7f4d2b00880827f3c6fd7b127b7e62bdd685b77d2c651fbb77762321f261a1d62c32be438003f7aa8bad5087de738e2dbfdcc80a
- SSDEEP 192:dg7nlZChAycnjlLKqD1T5QTZiCOsHBl5iJcyimmpnwIGh4S4m7jFeaWE0Ib70tby:dg7nlpoiilixtzLVHSu
- TLSH
  T1C072A72E9DD046A21BC7257F1CDED0003295503B861C5E50B9FE4188BFC9A3E89F5BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12