3bc42fd30d48fda6078e32d6ab80515ee87e39c6094b39262751402a734baf6d

Sharing

Copy URL Twitter E-mail

General

Target
Real.zip
Size 41.3MB
Sample260622-vb78xsev4j
SHA256 3bc42fd30d48fda6078e32d6ab80515ee87e39c6094b39262751402a734baf6d
MD5 a57d746ac4ff02b5e7f1c7d17698e5ea
SHA1 8a1d1bf00e6b9865fa0322c1417e094c1a806929
SHA512 e940f65fcd3c7bfb0181be2495201f02ca2ae54661e24f17fd16c1f05791cd7f5e487bf057d33cfc731c1f33ae1cdf5f2300b9574cedfe116453390a663a1f76
SSDEEP 786432:WEMWAg64oJAfDTECuV9zO06MjwOtoAAZwGx5Q84B+x1oMNYo6SF0wCc0nYk/7:WEhoJgPnn40AAZPY8Y+LdNY7S+wCc0Yg
TLSH
T1889733A0E20D5800C99BFEF958F902EE6367F4966E8355823D2917407C4F5FA7A32EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Real.zip
- Size 41.3MB
- SHA256 3bc42fd30d48fda6078e32d6ab80515ee87e39c6094b39262751402a734baf6d
- MD5 a57d746ac4ff02b5e7f1c7d17698e5ea
- SHA1 8a1d1bf00e6b9865fa0322c1417e094c1a806929
- SHA512 e940f65fcd3c7bfb0181be2495201f02ca2ae54661e24f17fd16c1f05791cd7f5e487bf057d33cfc731c1f33ae1cdf5f2300b9574cedfe116453390a663a1f76
- SSDEEP 786432:WEMWAg64oJAfDTECuV9zO06MjwOtoAAZwGx5Q84B+x1oMNYo6SF0wCc0nYk/7:WEhoJgPnn40AAZPY8Y+LdNY7S+wCc0Yg
- TLSH
  T1889733A0E20D5800C99BFEF958F902EE6367F4966E8355823D2917407C4F5FA7A32EC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Real/Real.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  Real/Real.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  Real/Update.exe
- Size 6.6MB
- SHA256 4ee605d151874a4a9b4f804da713a9745ded3b32a5a776aa54189d67569c12bd
- MD5 3fc4a22a41678b1b42681fed27ce2672
- SHA1 ed2aaef4d26b0542bfbf071f503ff12eee4715b4
- SHA512 6b274b693621424fae81fd1fabb846cb104c9de41b26c13784abbc6bea1c00170f4d2882024f1a57799e74ccca5b5443201722eb6d8678b4d5ab5ac7805c3985
- SSDEEP 49152:6ZGtlqWfVwASOl1gzjFlL6X/iCvX87OLhiz7cT8nfXvsZ8rW/sHbzsHvcl7JNJSd:2rLkP86Z8XoDHIJ7SRz2AWE+Z19P/0
- TLSH
  T1ED669EA9B6BC00E9D466C1BCC2869223E772B45517B057CF1A649AFA0F63BD01E7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence spyware trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral4
- Target
  Real/data/editor-sessions/tabs/tab-4.lua
- Size 14KB
- SHA256 0f7ef3513df4d313ca5540220754e53f970db27bf471019b2d9a5931f7f87e9f
- MD5 0cc3ffe8d363a4dda960b023037efeb5
- SHA1 4c9dc92332237a122d00fc74e473a1690c7afbd2
- SHA512 fcfc3d808efeb011d40917a8c18dffc990f2895e179a2ecdb6a58c1a1f0368c38f4edea7af7fd6cbdb1e73055a5bd48656f6c764be2661f54866878409fbba5f
- SSDEEP 384:ig1WmMFMsNx5O+vuDy6ERv68nOWD9GCwhZ72XI2QwDggu7A1lQDOZ03Ctxhlt8Rj:iO9SMsNxrvue3Rv68nOQICcd2XI2QMg9
- TLSH
  T19F620F06AD8751311AF2D772DCDB150AF76921032318246BB8FD22E85F3559C92FEBAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Real/data/lsp-workspace/tabs/tab-4.luau
- Size 14KB
- SHA256 0f7ef3513df4d313ca5540220754e53f970db27bf471019b2d9a5931f7f87e9f
- MD5 0cc3ffe8d363a4dda960b023037efeb5
- SHA1 4c9dc92332237a122d00fc74e473a1690c7afbd2
- SHA512 fcfc3d808efeb011d40917a8c18dffc990f2895e179a2ecdb6a58c1a1f0368c38f4edea7af7fd6cbdb1e73055a5bd48656f6c764be2661f54866878409fbba5f
- SSDEEP 384:ig1WmMFMsNx5O+vuDy6ERv68nOWD9GCwhZ72XI2QwDggu7A1lQDOZ03Ctxhlt8Rj:iO9SMsNxrvue3Rv68nOQICcd2XI2QMg9
- TLSH
  T19F620F06AD8751311AF2D772DCDB150AF76921032318246BB8FD22E85F3559C92FEBAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Real/real-0.4.55/AutoExec.lnk
- Size 985B
- SHA256 541a78caa3f0cd205c6013e6035b8cb3f47c0cf269db8790f366e4c82aca754c
- MD5 8b5762e7d2418161415ea97dd618d5c3
- SHA1 a57f63229c23726d1a92b99283c708b83222a052
- SHA512 1a7eca3c87d2e397166e980086839d48e7cae5b97f74554f7f1ef96e808b5c3ba9fbe65e79254b021ca3c091624bd4c90ff05a88513e94c280013c6039ad51cf
- TLSH
  T1F311EF195F824A35C1A0C0BDC9DF0506C655B9A652D51D8D00AA820F1872683BE86FDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7
- Target
  Real/real-0.4.55/Real.exe
- Size 9.7MB
- SHA256 3a3448f8855a85354d5f9e8cddf4599684bbf908cb035e7fc147b93f235e076e
- MD5 02787748543452fbb37fc31a28ee35b7
- SHA1 decbe463cb520dea981a249d16bf8bbf20f94d85
- SHA512 9a1e482e704703e37166123239e8e03a55d30ce82d35d8acea0a6ee07501d8c86357450a8caa3706cc640259e8e755d10404cc448ff6036498a4bd2cb99b120b
- SSDEEP 196608:hF5L31t6yUpszlrKLOC4JJEGwKI0U3vfH1+zlh+PEC:pFFZ2LPCyX3V+riEC
- TLSH
  T105A6BE07E29481E9C0ADC0B8C35BA637EA72B889473171DF6BE44B112E16FD06B3D759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral8
- Target
  Real/real-0.4.55/Scripts.lnk
- Size 978B
- SHA256 dd568faed49a66074c154e93517e173672debe321748148dfa97443759e88424
- MD5 f8dacf80cd8da3d4ad7b4ac51472de31
- SHA1 597629d029dbeb8b775a573b703d0444a45a7bc7
- SHA512 0fc5523b93ef03d626c34ce54b14a1d5e829f834d1e5259495e0d13a9d442225af88a347d4055d6c7c9583d4fff21cefc9393dc2a78f99a6c60b626f7e2295b9
- TLSH
  T1C8111256AE820635C0F0C47989DB1116CA08A8AA1FC76D8D00EE810E1D20753FFDAEDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral9
- Target
  Real/real-0.4.55/Workspace.lnk
- Size 990B
- SHA256 a44f0d61347826c3caf960e41f2727c6a824b22407e7fe3e02677e2877fc5276
- MD5 87bac6e4b7d82ac4dca694eeca5603e5
- SHA1 4d412646a9dc5a2198e6a37981a3b381cc3f5a66
- SHA512 5d56869f507936db7e4712d0b0a0f411ab624ca08c6f030c1aa239305729c2ef56e2a7e1ca7016d6c8aff39aefb23c7671c82bd3576acb711b5e0c9b568ded77
- TLSH
  T1AB1112156E821B36C1B0C07DC9DF1612C60CA4BA67C51ECD006A850A0861E83FED6EDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10
- Target
  Real/real-0.4.55/bin/Real.dll
- Size 1.8MB
- SHA256 9cc441233989fee4708065f882b2c04968a08bc4133bf5d1242a225ea8e76bed
- MD5 8b089b44f17fd59f101d9078f4438c38
- SHA1 15b6c4f2e0d930f5b11a1f313968fe9c20df6171
- SHA512 be25f015c27494b397cace2d3aec04b2c04fe3c85100aefed88aa2f2d9f58895587c3a875b937a4dc904ee3f72daf07ba4f4d1df3f95874cd7ce758321160de6
- SSDEEP 49152:knr7XenBY9lRU0tsnhtullEcde2EINe/PjD3:Q+nBY7C0taAlEcde2EAeX3
- TLSH
  T1BE85BE3AD954F90A1927BE6250CEF30EA0C908705DFDC349722A57B9E76C750C92ACED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Real/real-0.4.55/bin/Real.exe
- Size 3.9MB
- SHA256 ec1c9fba14db7e2c37bce7dff05e1c1f0dc47f3913248313cbcea70453039644
- MD5 bcaa7f43138c65f51d18991d3b127ba3
- SHA1 389ce72dd45597c0bdb601044b2def6306f91f95
- SHA512 c79808486267887edbe57ddef1d2d82612ec33310176cfb07ee8a44575e714c8b4278f257b3acaee519909890998b13d3e69456a0edd7dc18b12be4c3c157802
- SSDEEP 98304:NiVZ5P3qw5lRwxs5iS7SUO5GxO3LoWG8YUIbMd:gdL2miDUO5GAbGRM
- TLSH
  T111161209E01F9DBCC96262BC84078953C92A37CA177979FF46B502397B917F062B9783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion persistence spyware trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral12
- Target
  Real/real-0.4.55/bin/luau-lsp.exe
- Size 16.1MB
- SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
- MD5 0e14d186ed05911115868aec341ca13c
- SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
- SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
- SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
- TLSH
  T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks whether UAC is enabled

Enumerates connected drives

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Network Share Discovery

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Boot or Logon Autostart Execution: Active Setup

Checks BIOS information in registry

Checks whether UAC is enabled

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13