4dbb34122db86dd416e83361f7fd3c551b1fae5e5489e0a1ecfdd937771776d2

Sharing

Copy URL Twitter E-mail

General

Target
IGME v1.2.zip
Size 37.5MB
Sample260622-tfc3xaev3w
SHA256 4dbb34122db86dd416e83361f7fd3c551b1fae5e5489e0a1ecfdd937771776d2
MD5 b0d757cced0db2473cdc2b53b4c0f5ba
SHA1 4745f891e9d3de4b1a80868f733b34b271babd2f
SHA512 4b3ce3c14347758dfc74a5382b63262dc29ac6ef4126b2383fe99cae81afa3f437f68d261839ee03d04ef0fb669457f9fbc72b81b82a8815784502190deecfd8
SSDEEP 786432:Qw29oCY0jPvTtjyPY0JSNbrdWzSuFxjyYi+Vxt94MVn1LRTgtl:ifxjPv+UdedxjzRMiRstl
TLSH
T17D873381B987A4F7F804F37A44220B49B364C8B2A784C74B396BC1955FDF5A0BE569CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  IGME.exe
- Size 8.0MB
- SHA256 841bbfeadfc1d85d94ee03666fb5323fc7a56a4a1b933a44ee8030997e99ae32
- MD5 a3073db092b4f5f4b4799f4607039b89
- SHA1 6205d769cddab0d2ef0fd223c4ffc8badd597526
- SHA512 e929fadd15b371ae784a83bd14f5f5f23aab1d59c21a3b161c48d8cf5d93ac19c6a9bf0495d949de32cf72c0f1dd03eb44daf426b14c4618aef480420d3b7543
- SSDEEP 196608:vvbheCzMKwq5U9NiYVXPDQtjZysuZ3gEJ68hipoTV:vvbhtzMKK9wu7WQZv/BV
- TLSH
  T129863362A9B600F7D9EA413E8562C431D733B88307B2C2EF579492172DA3BD45D3AB74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  _internal/libssl-3.dll
- Size 768KB
- SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
- MD5 19a2aba25456181d5fb572d88ac0e73e
- SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
- SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
- SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
- TLSH
  T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  _internal/markupsafe/_speedups.cp311-win_amd64.pyd
- Size 13KB
- SHA256 755b26c10a4ece4acfb14a30201b5a5ff97b930784a0800b1bbc9bd93407a9fd
- MD5 d1db5c2bf3e90b416bc09afa0f3bed1f
- SHA1 57b47bc42448fc31a191c84dc54ba64c0aaf366a
- SHA512 8bf92d8142e352eab6b0bfe15a9bcbd551c4010522a85391e8353f58b163b659d54911d5c52fb05650c70ca3989353d6ad9f6857ce7ebb1c46448497e7d28226
- SSDEEP 192:lVguajS8feX3PCsQojtxJsFMWtt4d2L58AAx0:fMeYExsFnUQ8AAx
- TLSH
  T133521806FFA005EDDD6780B988338D1AD2F6B650275133CB13656D5A0E233C138BBB99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  _internal/numpy.libs/libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
- Size 36.4MB
- SHA256 57b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5
- MD5 5e46c3d334c90c3029eb6ae2a3fe58f2
- SHA1 ad3d806f720289ccb90ce8bfd0da49fa99e7777b
- SHA512 4bd29d19b619076a64a928f3871edcce8416bcf100c1aa1250932479d6536d9497f2f9a2668c90b3479d0d4ab4234ffa06f81bc6b107fad1be5097fa2b60ab28
- SSDEEP 196608:O99XmuJ2l6d6iET5BH6ZCy1iMq5NV2OzPWJAt+bOzPWVa+llOzPWIqzfr2V9EwS6:0OzPW5OzPW5OzPWIDMD9K6LSn1ZP
- TLSH
  T1D2872B87F46650D8D96AE07043ABBA33BA307C1DC5357A631B41DB252F75F80BE6AB04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  _internal/numpy/core/_multiarray_tests.cp311-win_amd64.pyd
- Size 63KB
- SHA256 c31d1abe635e9006caa9fedda260dd4e4fdba31fbdcc8ac0969ab0396a0c6c4e
- MD5 54192025aa4449a24e8c84ae0f25b164
- SHA1 381f50a8354c4abb12b76fa6e74fd526fbce2da9
- SHA512 1a3210c5c24a86d6cd6e3f2c19ba211611d5054cf04f6f5d22268a99f9ce6a8f61cab41d0d636e6163605180a94e90f0cf2b3832b2c3f731371fe4fd3d96a5c7
- SSDEEP 1536:gE2n94xaKkCCKqItvuP2F0YIYPALteib:724xhqglIYPALt1
- TLSH
  T13F533B5A635410C9EABBD03D8973AE13D6B6B066235047CF0660CE9D0F76BD293BDB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  _internal/numpy/core/_multiarray_umath.cp311-win_amd64.pyd
- Size 2.7MB
- SHA256 c76d812fa5131fe21c8bf9ffbd910f27df80856f910fa61698f23f60cfd9d13e
- MD5 ea2e696dd221290a44fc7f095c4f185b
- SHA1 dd5ae42ae6d2678d65b003ba4ca8286a80586869
- SHA512 7a811681652fb53d2da2ec0042b73a6b75b95defc9b47422df0148832a71079832a10d45ac6e457d26a708a30544ad45f08a87e61426c1f3c8252e48c6374b27
- SSDEEP 49152:Knau2Aq6LWrmiWTeXmj6nCFaNBBG16nKv7V/3SfFOuQCPp4VI/neYf:wasWrDwkKvZ/CB4VIW
- TLSH
  T1F1D5AF5F96E511ECD9B78078863F914AEBA1341603605AE711A8CA742F23FE723BF705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  _internal/numpy/fft/_pocketfft_internal.cp311-win_amd64.pyd
- Size 107KB
- SHA256 207c894d4a97d5eac328a87936b1c5a160cf1163d8b3f59b3c43792d9b5224a4
- MD5 79f63fa108140ba54d5aea030df4be95
- SHA1 1ae3b933106095928c54e1dba66f0966f98ce48b
- SHA512 8bef8bcc947c6d7b07a6b9d40eac134c4190abbc302a175e1e7b8d70a2eea8f2f7a9aaa0a0ff6b1fb74f6d7153cf6d63f8fb9d822bc58e98621f54c94c45bd81
- SSDEEP 3072:+YD9m9yyTZOXZtTZS6royKDaGW2A8wWYpdC4JdEZ+:+YD4rVOXnVSLyKe/21wW2DW
- TLSH
  T15AB31A57F8A40BACC4659131637DB113F7523409072872A76BA59E483B2AF416EFF70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  _internal/numpy/linalg/_umath_linalg.cp311-win_amd64.pyd
- Size 104KB
- SHA256 05922a2be823ec2e4d2378a73b05bb37f2816aeea86b613a9c80e25764ac8736
- MD5 c38f96f75d504fa0c2df82327beeca31
- SHA1 d059816e107302a43b60c0081b91a667327ddc13
- SHA512 a0609881d8d7335fc4dfa79584494b56dd1875e10564035a432bae2bfe206a0f9ddad500bb4d84e3b68a1bea0c698d5b04b19b30e02fe36410451c2a7d2147ba
- SSDEEP 1536:ql/0h7pqMLGrm19IlDiBLlJb+GBKlT51addBCQUo5+QzJIcQbJQP6heP:Dl4vkBLlJb+AKlT4rso5+Q2cpP6he
- TLSH
  T19BA33933718542ECC57681F0E1461A67FF56758B83702BBB13A0CAA02E6BF615E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  _internal/numpy/random/_bounded_integers.cp311-win_amd64.pyd
- Size 251KB
- SHA256 05d5fe8a5a79b1d5836e58307afdd0c8570a7c4e1ed0b6a6294f3978db0dc6c4
- MD5 f380b1902f06ed89554a6a7f76fef247
- SHA1 48bc984fe47823eab6d59db171cee6f7ce33bbf6
- SHA512 a4b7f5405836c746148c14145b76e898228ba29d67ed122adfe68007e4ecc8893825f0a6c7e706035d112874894d588533a715a6aea33d3c83a1dfe7161d0ca4
- SSDEEP 6144:wdJCtdna0wO/95I+LavQrXHFqGEFy3rbjwTS5xDW:wXsb5JaIrXwIjw
- TLSH
  T16544071253DC0C22F9A756788C37E617CA66B056A27CE35F0264C8543BC3E26B7ED762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  _internal/numpy/random/_common.cp311-win_amd64.pyd
- Size 171KB
- SHA256 f41809c03d13487fa8940cc30f5ff2125143ebf071bca10e081d026028c435fd
- MD5 9859d240504af306b9e130b1ae0a28d3
- SHA1 9f87f3badce2c4f02d8780c35acca16c67c44917
- SHA512 16ff6686f7f058c061e4e5d9f411b195c064c3c4871613957d30b50055e428bb9b51c22558267e4ae1089a33a21fabd4de00b525906aba9aae7325b7ae1d2920
- SSDEEP 3072:LTk4oRV2FKRL2METd2WkvyeItNmnavaBAUyEI80SA77:fk4MMFKUr7k6eIanqaBLyqw7
- TLSH
  T19904191663CC0026F9A79178CD329627EAB3B0466334A79F4254D5643F93F66BBEC702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  _internal/numpy/random/_generator.cp311-win_amd64.pyd
- Size 679KB
- SHA256 003c7af2699a370efc1a90bf42ac3b449c27ff9c24b11136dd245bf50ed2240f
- MD5 6de59567e3c76ab31b85ae334e173721
- SHA1 03a81c8a9636e5623b7c98c117b1aaf6d34bfef3
- SHA512 b89e2222bc1f6c13145bd13c404bcff7af304565293d36e0fff619687e65c3909cc94f6adb01447a1bef523a5db5009520a1867aa76045a46f99368201a2f3f5
- SSDEEP 12288:TpSeepC5QoYUyV45SJnmgelQLRxfxtQJxRittjwE:NSHpC5z5yGqRxIit1T
- TLSH
  T148E429172EC80269D6A381F588AB1013EB31F06B7760665F309DC6542F9BE25B3FD74A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  _internal/numpy/random/_mt19937.cp311-win_amd64.pyd
- Size 73KB
- SHA256 36bbd3767a4efc1e5ddd4f96b7b705fc664e95a629abbe7e3b5e5951cdead3f0
- MD5 046eea12f5582cfc5b4dd95c95f3568e
- SHA1 27fd4be133ca784bd8f15ec65234069d7a427325
- SHA512 85570a0dc3200387763570a474089e80ab5e61dc3d271fa01f5d0e7ed9bc61954bd2fe92a7a20f6ab5ca5ff47a6047f6f80551b4dcdac13ba962d790b36d91ed
- SSDEEP 1536:8R9ciOSnvaOPRSDE/ahCUiucDd+mdmSEH28whV:8DcV/94kCU31HRwh
- TLSH
  T162733A5666DC007AD9A781B8C83A5913CB71B05A272067DF71ACC1482FA3B972FFC752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  _internal/numpy/random/_pcg64.cp311-win_amd64.pyd
- Size 81KB
- SHA256 e09a53b33a1908aa4eb58a07166d5beaffe2072ceded2f80df59831adf7fb8df
- MD5 6fdbf3346994c777608f0ad5cbaca3cd
- SHA1 79e08ae5c2ee684537c73f58feff25a3deef0bc7
- SHA512 cef969246e8dbc8809ca21b7fc691c6d52eca977f433331ff05a491689dc4ded79a53c390aefa645834fd395477e428b151a91acf9037943279288a261f46403
- SSDEEP 1536:sxB6nQmTFvsVG91pVxi0ID5o/jPx6fxd:SB6nj59G5orkxd
- TLSH
  T13A833A0523C800A6DAA781B4C97A5527CB70B05B67206BCF725CC6982F93AD77FBCB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  _internal/numpy/random/_philox.cp311-win_amd64.pyd
- Size 68KB
- SHA256 9a777f3f9a59f3d88de84dc3e499138335c3a6cf3bee1b875d9626d6cdf6e098
- MD5 7ad1efc0a62a692722b5eef7b6f8414a
- SHA1 5a0d5f305b149c460e7f720efe5ea168643f0177
- SHA512 59bdf9723854683a6955dcd07d99b05a8f11f2a708171e3cd9ed6cde17ce739c27a4cabe13f1997967f9e87672a9bab36591dc530fdca1df5886ab4b5710468e
- SSDEEP 768:5XyV7b/fHa+CaRvXgKi6uBHUuzK0nK7DOWBVt/aPelNGfiBZCKo3t5A/FzEbP3IQ:FKvH3CaRvuJnzrK7T/hG7v5A5EjxZ
- TLSH
  T106633A4A36CC00A5DAA78178C8761427CB75B02A3754A7CF725CC1482FA3AD77BEDB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  _internal/numpy/random/_sfc64.cp311-win_amd64.pyd
- Size 49KB
- SHA256 180453afefeff645f9fdb2de54a3cb72d8becb87936ea82e2d7a56592aca3068
- MD5 441f1537e70a2eea00f4369e46a26be0
- SHA1 aff994dd60f33c2aaac480c959351f1684349c39
- SHA512 124034b67b0a1abe0e2b3ea8605f25970e224c7b9f72cd7ba2fdd63396afc94bf981224f2fbdc2d45fce3bad299a04238f52a147f0cf8519c26360e55e4359ab
- SSDEEP 768:X6XElQH5p88Cj4zuqkBoRGqHYA0V8aYVKyHPGfVgaLoPTxwQXE8fqIAWaYm:KXElQnoj8kdaGdjox1E8iyah
- TLSH
  T144333B5532DD44A9E8A78078C972A917CB71B4262F10B7CF9258C1582FA3BD6B37DF02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  _internal/numpy/random/bit_generator.cp311-win_amd64.pyd
- Size 160KB
- SHA256 9ad713f6a93c26bb733a90f877b50d51d7f22eef161aa58e40735a5cec149501
- MD5 4f9e45169d349a4922a251df4af06b12
- SHA1 eb4c248b9b5fecc0518d5fbc77652bc8509cc8e3
- SHA512 90dcd6f1e35dde8a37690a2c70036f6903ce868e0bfdce930941ea71dc58de5748dcd4fd1af8745d85aca7d643199512ddc628615382f26340eda3fb229113b5
- SSDEEP 3072:cUU+28eHkDvgKxyZzHRbtdeBoBxz4aI3Lr5Ptt2+Warahg2+Warahj4vSGi53V0m:cUU+28eErJsNHRbjeBo/e5Pb2+Warahb
- TLSH
  T1DEF33B1633E80065E9A79178CCBB5513EB72B05A276066DF316CC2642FA3E92B7FC711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32