ee183a036a9d022cd67cbd79d3cdb229b7c8af200ad4fdef3f6515ada2f3b08f

Sharing

Copy URL Twitter E-mail

General

Target
shimejiee.zip
Size 1.7MB
Sample260622-wpflhafs2s
SHA256 ee183a036a9d022cd67cbd79d3cdb229b7c8af200ad4fdef3f6515ada2f3b08f
MD5 3c9b857c4fb0073d02ebdcaeac2d8157
SHA1 3beca68516bb46a3ff8a85292ed2be9bff30c200
SHA512 0533868b37d3d62b81218e739ad2aa0788e9f4551036cdcf88ef707ea8ec73423604012179c469db4ccbe4f44f29fe2d7d6c16c1fb9d880951b911913089fc31
SSDEEP 49152:FJ6QGqSmkgAj+ncuEfBAuw2zYYuDRtm+UwFubXogRiQ:rXzmn+ncu2qu1wRA+UwFuzogsQ
TLSH
T167853354D0F9E850C5A9E2BCE53E9D797C6FC07A0E31E030B3285A7C7A43B34A66465E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Shimeji-ee.jar
- Size 401KB
- SHA256 526d6890174bdd5a83f500d35ad8f28278ac3cf8068264582f869379f251c7f3
- MD5 613e2669fc2cb09676324532e16c2b9e
- SHA1 8473098eaa02ae29e51dd46055b575334f18f28f
- SHA512 1008fa526b2ea985959b96a2a52a26208cc2e5561d7ee6b4d7de8a4504973abd720c85757e5b7a61e2f1c77b5cd8759fdd613837f22b6cba2a3c84fcf7e879cd
- SSDEEP 12288:Ze8+S+Tmr1wcrfmk69R8GHTluRkaCrgp2DA:ES+yr+KfTYmGzALCrgp2DA
- TLSH
  T1E794BF2A309D343EFFE241F1813669616B2D0DFCE887791C9464488BB639CAF9FB1255
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  lib/AbsoluteLayout.jar
- Size 2KB
- SHA256 4abac589999437603d0f8574432597cc25b2e56811c3fcf6287f07a5a69986d7
- MD5 9ad69f3bf0f3cba0968502f1094bebf2
- SHA1 5f0fed9e68b07cdc8b0af9c1734cae4faa381c49
- SHA512 95808ea390f80d7d4475047f1c8ed2d885249bef51ad0e620dd4a47d3ea9d90bb8949f8ae5fcfa47309cd650b6702875dad8ac2ee383cfb1b201e5464bef09bd
- TLSH
  T183519630E9B8C561E3482538CD400F6E36715DC46D558CAE63D883E1FE2A9462CBF268
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  lib/examples.jar
- Size 281KB
- SHA256 5269f84be819569db56fe822826f0f067df9eaa1518893cfc814f7771c728844
- MD5 503be26455fa4743e924dd7c51b3bb97
- SHA1 b707061335970862936d3f845c63d0068b4bdce3
- SHA512 5fac80ab6add776fa0d6bfe12c2700f35c8aad047a341099c956415ba656880bde5dccc0caecb155b041ff273965cd77b5e55a9d91860016b902f72033d6ff20
- SSDEEP 6144:Z7SXhc/2bOw99sPqlELBjXRw0g5jVk1x/Tq/0:xghD96ilARW0Em1xbN
- TLSH
  T10E54CF63D20694A5FD1221F342C7569A3A2FD5A0D18548792FEC1FB61C2383F7BA8778
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5 behavioral6
- Target
  lib/jna.jar
- Size 753KB
- SHA256 2bf1900b5ee02cacd304eae5e689b836e1bc7874eb87db3837a72fd9a8bc317a
- MD5 80d8d4ebfe90dbd857c8b5e6c7c547b7
- SHA1 67675f42f9218b7359a1ac2d4b04ded13656fa07
- SHA512 e7cf92de8fe58d7bd802756a3707d27d4dfc3cd7299abbe855452f36aa17639fa32b2082a02474a868c89d2c088c407f5f532ab9a519163322c07857dcec8e0c
- SSDEEP 12288:bWx74ffmlOOMqXk9NlOmolS29r+uTf0f5JnuFi4JSBVU6EqftkKndXBazSyBYi9k:bWGffuOOMA8aSduTf0f5JnuF/SPzfaBM
- TLSH
  T142F42327E06A9461CD2202FB02AF43973E1FD695E401A93D5BD81CB44207E2F7B76B79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral7 behavioral8
- Target
  lib/nimrodlf.jar
- Size 208KB
- SHA256 b827238aee08c6b32c59ddd723b6797275e9963c7ad22e7b940e8f43da84b537
- MD5 07d02f10862b3136c8e91c0df8f3e0b4
- SHA1 86406bba308f3eb4576a43921b992f20ff7a08cb
- SHA512 15f5edd993c531df50a7538f1eb91838249ff15d86f41e6f21fb17550b348ab5bfb9d63584aa1836a3fb1a801fb2e5c896a011d097f7021730637a77ee0c4e91
- SSDEEP 3072:w8LycdnbUUeWWfAUqFSuXYh8kjVqD03Q/dnZ2UbHJImgs/vM0lvInXmyOGQjPeF8:w8LfFercSuXzcVxCZ2UlImgwM0l7Gkxf
- TLSH
  T19E24AD7BFA9B10FDEF62753144043001E96BE4BCA90FDF0560B5A5ED146A90E6B4CABC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10