c0dac3810586ee75f7cd139665409bc1e7ce9a14e9a48e66c549577a390d4512

Sharing

Copy URL Twitter E-mail

General

Target
eexam_example_offline_doc_postpaper_no_monitoring-materials_folder.zip
Size 44.1MB
Sample260623-gzbb7saz7s
SHA256 c0dac3810586ee75f7cd139665409bc1e7ce9a14e9a48e66c549577a390d4512
MD5 6cee5434cef8c2a7e583c3bee92064e0
SHA1 8dbc94e4d7f6f488d107dd03170b3e8dfe13a724
SHA512 2d50a18228e669a003ed224e8cc68642c97ada8eae15932885230b7cc05b6b4c64dcb45e265e264e9e018902a31586f4e34e39296b661ff630da3f0c3c7a8173
SSDEEP 786432:7Dv3yftIOj7S3sQxMSdZ2iqHDSCgjvxV7rqVY4klwXnTyQ26S2CAt30z0Oz0Z9by:7Dv4t/12MSdIjKx8ncGTyQUASFz0ZK2C
TLSH
T145A733596EC49E1BE55AB03F58C24003753CC0A3FA4355F816A59B1DEFCE42B83BAAC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Materials/Balloon Car Builder.exe
- Size 2.3MB
- SHA256 4155db1acf3b8e1009beda47a384ff7013686a987367dc64d1bb0fd91b53127e
- MD5 74cf314ed41a65004e6860dd0fa30070
- SHA1 2a2216ed1de856627e2c5b2807a6de7807c2efbd
- SHA512 7577d840cea4d1ae0d679b5b00528dd455cd953f4c9be41495de9ed6b45ee8c5d2f6d5c442f38034eedc4f258643486f09f95147f0931bd9e07142af0f08dfdd
- SSDEEP 49152:9TKlpDAShAZ4kVsZ8kCyfhlcj278fZNKn:9TIDArZ4kVM8+lV78fZNc
- TLSH
  T1AAB59D36F6C1C031C5B2537E4A86BBCBF27ED8034294DF87E7D9DF585A616932A21212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Materials/CelestiaPortable/App/Celestia/celestia.exe
- Size 1.1MB
- SHA256 30c85d26cd03858bf09721b39651472e689979867786911b04ee796353397b05
- MD5 6069b321d232d9535e1ac7bcbd4aa984
- SHA1 7d144dc50c23d4d348d22a8f15f60beb38b4746d
- SHA512 41bb030fdd91bc5ece39598aa992929acfc7cdae6e1f4ea5964dc746931fb30b42731d16d44fd6bacef38dbae140f9b306916bd17acc82815a40577c63927038
- SSDEEP 24576:JX2vvIgPEmGTNgvfkeCcY3Vs6Of+rV9DJPc3fwiKwwkfKoh1Lc:JuFAeXs7FvOf+bDNAwiwkfBQ
- TLSH
  T123352316E2C96ED4D3600578340B9BF571A4FC23EC159B81D7AF7B5BE830F2472982A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  Materials/CelestiaPortable/App/Celestia/celestia.url
- Size 59B
- SHA256 ee0c4541324f5fd1b5d1a7e727243d9e6773a7e76911fbfe4cb716cb88269d4c
- MD5 a0ea2afd233e4b72c2d46fe07e4030c5
- SHA1 ee809a32bfc33d420b575718ac61dc076c32cea2
- SHA512 bb8466a18007b73e13a74cf7ad61d42eeb65d1f7dc4c94db2f030389d5367f708a3e9dde20696b727e1d97f3921fe517f2e1b706bf5a2b25db52485e8d28f861
- TLSH
  T147A0028CC54AD7558007A80DA4B5C514D82771D1C452E4E6E1418F04E887158A5DC315
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  Materials/CelestiaPortable/App/Celestia/help/CelestiaGuide.html
- Size 150KB
- SHA256 72a0a939053cb7c9156ad14289718fbf996bb50a4f983c8d6805b8af0878b2c5
- MD5 5fdf8421128f48c16ea28cf00dd93d14
- SHA1 b6dfa01b761206f1577d7278aa971f979c326485
- SHA512 9fe46707b19e1feacff2882881a8fb2005ae26c5ee18b016a5b7cc48101aa31a2df3d8a6ca2910091fe217b4d49d64fcb2ff77f68849876282f0d2072d629b15
- SSDEEP 3072:7v/IyP0uwoED1g6px4p0W2Ix3OxaHcoLSgoKyGei:dRwXDIx3jHFSFKyGei
- TLSH
  T1A4E3855A718C473A49672183823D5DD1A2EFDC74B3614188707BD23B6382E9C6B6F1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  Materials/CelestiaPortable/App/Celestia/help/CelestiaGuide/animatedcollapse.js
- Size 9KB
- SHA256 f2e021b8e5d3e2db17abd65641008a0fe7ecedb3ad3e736f685528ffbdb5e387
- MD5 0cf3388511648869b540e88450a14d06
- SHA1 02f78c927e0381a13641d7ee5095559a0be3e27b
- SHA512 6583db33659d993ded75fc0f3009772631cf68b0359d4ab2df1c7e5e62683b3e6ba651ccfbf4daff2e4e70e852c6cce91b6ba9621d5cf713f72b9a72d8798af6
- SSDEEP 192:J++qD9jUQr7fh3cy55B7nYOpIauZmgxiVp1Q7wO+y0fgEJsRMMMLwDS5:wVJUQr7RH55B8OpIakHxip1nO+1F1ww
- TLSH
  T18D22F1E8938C751381E572F8658F065C7BBE4830D523252B38ABD6DC7A724CD6A3D07A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Materials/CelestiaPortable/App/Celestia/help/CelestiaGuide/jquery.js
- Size 28KB
- SHA256 9db225c50bd535f0e170ca98c93e353d65db90887504f26b58b673ac01c2088d
- MD5 c0c3476b6e2c382dd77d14d96fb42602
- SHA1 2710cce192fcc4dc676d9572cd852f104ea59387
- SHA512 dfe70d938e848391e3ea6bad307a9fc197a6be08d9e52eb4c9a6757c2954b7a1011816530a27bf105ed2b9f110fc8ded118784bf994a19ae5357f354d7f84a72
- SSDEEP 384:rJe2h8Imngxt8iS0OYee5RBITeJ6NxDBaAAIMETW0kSyIahFepP5N:E2h3mnQ8i2p07WU6NJBaDETuepP7
- TLSH
  T1B6D23BF8204815B346E6D09A946A43630AE300A7EFAFD5B5B9DCFC5D842C2B5714B73E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Materials/CelestiaPortable/App/Celestia/iconv.dll
- Size 619KB
- SHA256 9d7c6ca4111b3568c020792cae2a029cfe92301d0c8d9e24ac2ee7691bfc2ec7
- MD5 fa81d842bbe23e6f7c140f2fbce65708
- SHA1 334637434a7540323cfae7747b986b25b1d76136
- SHA512 6a9eb2cf8b9171d637bdb6cb6e7a56a6930573df227efe9d33cef375a7960ea63e0b7633bc2015c0cab5adab8d40e0bd515dc2acea44e77a73dcf13b56ac91f6
- SSDEEP 12288:49FNv/uu9T2wwBVmPsW8XnSFcNkreTsImOlP02c+qH+icT:kNXJ9T2wwBWsW8XFerTjqcHehT
- TLSH
  T1A3D42386E1E8575AF57BC270E26835A3EA06C50AA513502DEFBBC347407ABF078DC587
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  Materials/CelestiaPortable/App/Celestia/intl.dll
- Size 20KB
- SHA256 cde9f1dabec93f328b07bc3a9dc19469f1c8afa3dc8cedd599d0f652c671dafc
- MD5 613fb4fe3bdf65d4ab7e2e4150653354
- SHA1 af4f20c810dba8cbe17eab4feb4d16d8fd497339
- SHA512 a7202538b73cd2a54e7fa2dd84277e9a15f60f4fb925ed6194033b909b20ad7c147c2bbc6f782f21f439dede6e1342c35403db738a8548265948582ac56fcb59
- SSDEEP 384:gpMcbQygPbHx3U3mYgt3PuajnypVbz7NiCATfXFzPZtSA8yIyNIUZm:gbD6RSPuPuGKRz7NiC2FrIZUZ
- TLSH
  T1EF92AE0453F16437F5F71670FAA2D745882A7CA1E9B9CBCC29F484891C705D89AA1F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_ar.dll
- Size 30KB
- SHA256 264c153dc7a3bd4f29bfce5183d30fd4145b2fa6b364a29b6a6ec7b6112af5a8
- MD5 23e3038c27a0ef4fa9dceb2c00aef306
- SHA1 a990225c5cbd9917b83e0091ec01251320612986
- SHA512 e117ca574c05b0e5aa43ad7772fe3401d007d5aa80d8ba79c465e88be927319cfa06b88cb130ce9d3521057995b799e36b43bb1b01e6f18314a598a7ec0d5a39
- SSDEEP 384:yuQKVl9YFT1uq5KdkM6UU+KKDfRMsQ9K7pRyHshlVs6YbrDd6PkE:yuQvT8qbM6UU+I9KJlTYbPPE
- TLSH
  T1A4D29406E71CB88CC599803188579EF43464FC63ED489F6367D4BE1FAE31B85E9012BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_be.dll
- Size 30KB
- SHA256 d28c829d48a399e81e2fc7024686bbb4826ec01f3cc683160d678a624e2a4338
- MD5 8f580fb3a20969a7dda481097d7eaeb3
- SHA1 ffb4931d2540299b680aff73c943dfc96fb5ea83
- SHA512 0ff9a780b2dc0f9136c2bacd1bc0b2ed68d5d5aa78523d4d245e8aefee7fc8341e835e5caabbc33ce04e5223c27c4ac959826cd3d0627362131b243928e7e68b
- SSDEEP 384:OoyBs3z+e8p2yDU9oKDfRFsQ9K7pRyAshlPstjbCDd54QE:VyWb7yDU9b9KWlKjbEhE
- TLSH
  T1E1E28206EB5DB88CC59980318C574EF53424FC63ED499F6367D4BE1F9E32A81E9012BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_bg.dll
- Size 30KB
- SHA256 f0775000a40ef9700b3af1db8221a2e8f7f37225331b2a3735e598a86a850a99
- MD5 18e8fb60a2fd47bb2a1f93b0a2024cd8
- SHA1 56cb7f1b1ad6d382a4c3e2b40a88aa43df2396f9
- SHA512 6ce73fb00430b0cbc651a4a725fe0309877b24e039bf79943b5ebc73e29436105bef7521964ed95761c9e2ea05b00db585ec3ae1a978e43bd2abb8a7a32bc568
- SSDEEP 384:innxQh0PdjVCt2eVAkXPUBNnKDfRbsQ9K7pRyishlCsj1b8DdPiXE:ixRdUt2eDXPUBG9KElp1bayE
- TLSH
  T1BAE2A306EB1CB88CC599803148578EF13464FC63DC499F6367D4BE1FAE32A95F9112BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21 behavioral22
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_de.dll
- Size 30KB
- SHA256 d020685b9cac54db1a693bbb20dc3584eb8eccb3231fa62123370330d2075236
- MD5 e906ddeee33d1e95f02d03376c7d753c
- SHA1 698d6fcb7878ca8765bc0b455290fc2e3d369c9a
- SHA512 126223aa99c85067a8029022d83cf93cc4d1b7b314f16adc9d72409afcc50c99e4edc68f92b9b1df736072bdac69798cc9d3fab0ca6215607f7fe7d6115cac8a
- SSDEEP 384:igbDcUBfPspjiUVbKDfRIsQ9K7pRyAshlsstjbCDd5iCE:igb4O3spjiUV39KWlFjbEtE
- TLSH
  T145E29506E71CB88CC59580318C579EF13464FC23DD499F6367D4BE1FAE32A52E9112B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_el.dll
- Size 30KB
- SHA256 e5e5d767f637902f8db7019154da8f0687b0d1c55f8f05057531f0ccac87ec0c
- MD5 22265fe381b5ead0408b292654793bcf
- SHA1 de7c9beec241773e92320d2c74a7be7e31f75968
- SHA512 d75eb7d869678463b83eb118155b75440ac551a399c5a0ce29877d41f8d1df4b3d15cb939a0a080673c07c9448478f5275f684df5b34f5ef55f24df3797ea17f
- SSDEEP 384:4jOcWUV/Xown+qZxF8HoUZ8KDfRSsQ9K7pRynOshlGsnBb4Ddr5CE:4j7WUVgrLoUZw9Kol5BbeOE
- TLSH
  T125E28106E70DB88CC5D9803148578EF13964FC63EC499FA367D4BE1FAE32A81E90117A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25 behavioral26
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_es.dll
- Size 30KB
- SHA256 90a25d57b34a872124ddd8bcf3567e38f3448a00dbcf578e33dad95ff45ded12
- MD5 b19745cf9aa6115adb9739a999ce9bd5
- SHA1 fcc40ade1e44b1db02668d24e7a3069bbd5e1488
- SHA512 d31d3414d2afc5031d737c3849f1ade15fb326d9f22f954d10f0d4b8437ff3ac95482ed7f171f959da87403c6fe3639e3e86851bfe6bfe73079db9f032f80abf
- SSDEEP 384:WHStLojtf7KfeVNkX5DU41EKDfResQ9K7pRyNshlnsM2bpDdEFVE:WH2LoZf+esX5U41M9KDlz2bJeE
- TLSH
  T1CFD27406E71CB88CC59980314C579EE13464FC63DD499F6367D4BE1FAE32A85F9022BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral27 behavioral28
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_fr.dll
- Size 30KB
- SHA256 60d38201bfd1a287641d9ef74ac7df1ec12bf028429152b5488fbc42a5c5928b
- MD5 264aef8a5832ee4f9bca364b77a87dfc
- SHA1 c98c727ce959af7eb0eaa7ced81ba0801f36b4c6
- SHA512 fbd0f5c4a8b3d33c8b6f28625cf69efe75798daa34be88015a2d4b6f091b03f50dbf7dfc458d49e9720d58d14e063ad2990e011aa0d1d6cd555c5f6ac77c1b1b
- SSDEEP 384:rd1UPP9/+EHpFosL0UiBKDfR3sQ9K7pRy7shlBsGMbvDdeWyE:rDUPP9NwUim9KFlTMb7CE
- TLSH
  T1CDD29506E70CB88DC59980314C579EF13524FC23ED499F6367D4BE2FAE32A81E9111BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  Materials/CelestiaPortable/App/Celestia/locale/res_gl.dll
- Size 30KB
- SHA256 55e6f1d2b1a39b54b2551a268f589e0c460107af06fac7412bc58f7fa444e87b
- MD5 747c114f3a3ab51aa99203f29633de4e
- SHA1 72b5a7a45afee88f02c4f74af2733cc48c59a7c9
- SHA512 2e3dc27075ba956d4b2b65010bf1edea4d5bb32a03e8f8c2704f71234f91c9a81bbcf5378d354509c3d6f45aff3f27fc9d6d3129367baf767f6861dc8694f564
- SSDEEP 384:vFSyFOf8dZXFSeX+ljw+SMlwZ1htU/KKDfRQsQ9K7pRyIshlUsVUbnDdk6iE:9TCaVSeX+j7SqwZ1htU/89K+lFUbDwE
- TLSH
  T11DE27206EB1CB89CC599803548578EF03464FC23DD499FA367D4BE1F9E32A85F9112BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32