802ad2ba20cd1e0576b2215c20358e4772be7089a3019435ccbf781e297a41fa

Sharing

Copy URL Twitter E-mail

General

Target
AG2.mcaddon
Size 9.2MB
Sample260623-jw6eaabw2x
SHA256 802ad2ba20cd1e0576b2215c20358e4772be7089a3019435ccbf781e297a41fa
MD5 5c44416f0bdb8a74a879f45d7a0c9574
SHA1 68f10bb15ec70a0d0a8be265257bc05c1eae335c
SHA512 961e48e456ae27fd82270e8c1f487a358330fc832ecf4a4b9f0adffb565ab87a7392edd0ce77ce458bbab8bb72871cb97db609e34fca9d458d526084dafd2b37
SSDEEP 196608:Wu2a4FRRleAxuT5bAhqmFFYN4+3TN55inmsOo0AcBz4z:WuEFRGwCKqmIxTW0AcBze
TLSH
T15AA633F6F86A759B08A8F287B0D2F236356746C2A0D2CC7DF74B5A2E16687D047240D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AG2.mcaddon
- Size 9.2MB
- SHA256 802ad2ba20cd1e0576b2215c20358e4772be7089a3019435ccbf781e297a41fa
- MD5 5c44416f0bdb8a74a879f45d7a0c9574
- SHA1 68f10bb15ec70a0d0a8be265257bc05c1eae335c
- SHA512 961e48e456ae27fd82270e8c1f487a358330fc832ecf4a4b9f0adffb565ab87a7392edd0ce77ce458bbab8bb72871cb97db609e34fca9d458d526084dafd2b37
- SSDEEP 196608:Wu2a4FRRleAxuT5bAhqmFFYN4+3TN55inmsOo0AcBz4z:WuEFRGwCKqmIxTW0AcBze
- TLSH
  T15AA633F6F86A759B08A8F287B0D2F236356746C2A0D2CC7DF74B5A2E16687D047240D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  OldActualGuns2[BP].mcpack
- Size 1.0MB
- SHA256 868d6ef61ce841ce2bf9c38327abe6372c38876917fc0d98bfc42d6c98e5cecb
- MD5 a02d49cb219e38a5d76cf684c302f5c9
- SHA1 d83c19efac9c11323f786766c7a1e451de720445
- SHA512 a3ed66c0ac422e51cb71683e47fa7fa37aea915542bee6f3e0344bfb17fb94e4685083cfbf89943c15adbb8077035aab5ca8fc423577f6f1321b8d8a4316c752
- SSDEEP 24576:cz3X1GomnwKahHo9tyDDpZ/3asqZ4YTij/YJ8Fc:czn1Go2ado9ENZG4YTYYJyc
- TLSH
  T18835CF5CDA5E6352E19F773E204F523AE8F2CB5463B0A51F1480188C9DC65EB0B9B72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  OldActualGuns2[RP].mcpack
- Size 8.2MB
- SHA256 fae12e2276631ef05f3b43f069858c4ba54c133d95384fa740137ddeb00fb7cf
- MD5 69d97b741fc9a8fc3e833118162718cc
- SHA1 b9058eda4ac0f6382d82ac6e7c9c81d309010b3f
- SHA512 03a08fe20fd675fecbff9277cbc82ef71640d91a3f126e143f18265f4b1381c0fb41765ea85b1acf821e18527f6e81d59b5065e3378ca92e5a329e252d114147
- SSDEEP 196608:bnKgYxtWJzYLq1z8va0bESX8ZJqksTrtpSqMLu8WIO:m5xtvqia0IHahsqMLHWn
- TLSH
  T19E963399D7A966FBC19AB33D7ACB5607EED286445872B00B541090CC9CC3F6B478B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Changelog.txt
- Size 3KB
- SHA256 c9f0504ccecdd2b4ccfae9c2af7a36552b37cd670ad2367197785bb67bd7b682
- MD5 81e60fda7afa7ee4a58a516a11c7cff6
- SHA1 7cee4dc93b39213fc08078c7571c8b1d67f0a904
- SHA512 966953168bb8837da1c1db8c4e942a73388c71d19b487dbfeb51cd52d9162984c57c01e0f37fabed52603a3df4d3d19a58abd5c63f9a18960a97e930a9cbfd27
- TLSH
  T15151666D229BF27A17B200EE96AD3432875C5024EF35C16478CE834C71640A9B32E9DF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  animation_controllers/HQ/Matt/butterfly.json
- Size 14KB
- SHA256 86ebe088de9d060a7140d94ed50914a59366c15e056dd12405b552c7ad1bdd88
- MD5 6c98cac6b030994fa31b1ff4867b20f0
- SHA1 85f6f136144291f0b56f8a68d0d37e0a8f6278ec
- SHA512 7b226bbfc2f5a266880c1c820b6ff14d2860bfb9281d0261fe6cd2d3df10c31a203decb6420676a14760b1e770d52e52df959443c2d9c7c6e8023e779916dd34
- SSDEEP 96:4EJctOooyIHpsUZtD+67ZUwmhNtDdEDj3pAyXD+6u/tUwmhMvPy3httzw8YOktD2:rjm/5gf/PFrWyxFrFLxFlFt
- TLSH
  T1295279F7CB5F1A27B76DE11E622D94D945EE8935DC1100DFF2003658E06B82A813B9FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  animation_controllers/HQ/Matt/seal.json
- Size 8KB
- SHA256 e9c2e5c7f200deac092a429477c551a0f6c7e8a37c9eeda41127b724ff7bd145
- MD5 be2d1b9bba25e2e135eadd7aef0c7032
- SHA1 c84c595e6af3cb3f0d2dccaf8d0d109a6aed1e59
- SHA512 c7d2bc3893359077a9b5237250cee950c28481e986d7ecfcf06bccf521b48a053aaedcad704a0ace9363445dfca39fccf3e8628ebcad31a245d8332b582b3ad4
- SSDEEP 96:wbUm+4PhvQKrAnPhDez1YOakKxRCz1Y6zz1YIcL1JK7z1YU:c+4PB/0Pu1ra/81L1TG121t
- TLSH
  T1A60250B6CE3FED1F0579EA2E547CA6CD4B5E90FAC9A049E7F01C630CD04A84D2126667
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  animation_controllers/HQ/ak12.json
- Size 3KB
- SHA256 48fd67b7348b02c3abdded960e4d7e72700844d53bdf0b1ba0220e868793736c
- MD5 286ff7ff2ed9fe76a9426719af77cd6f
- SHA1 d2a404f7a75b70d5aac7b5754b45977bfa370c32
- SHA512 0ec26819aa922a95becbb060bb120590b53d2b4d020c83502c435340d991ee76e9f0cc5d1f8b1abf5a5162d44c8bf330619b5562fa196d22159d9ad431a18f89
- TLSH
  T17061E0CBCA5F511F13FE53194AAD98C4516E80B5DA9042FFBC0527C8924BAD5403B76C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  animation_controllers/HQ/ak47.json
- Size 4KB
- SHA256 e153e78b5f72994e15f5fdfbdf182cb0ccf37412b07fbc95d1425d04e5496682
- MD5 937bef91389ef00833885709c22cd48c
- SHA1 6983c414f2bc11df148e170ed10ce38edd797676
- SHA512 17200e5fd94b53069254c80a7ece56b416d5ae1d849e293796f159f8e42fac6b31044d4ada96db861b28c58ed4051449985d0771de301379c047efea887dbf6e
- SSDEEP 96:VTtzWpwiUmrKgxzWfUThLz/IBzazu9ThBtSKgyWfUThHfsMDjG/Wh/hnhzWfprKA:k6UmYDUdFD+hn
- TLSH
  T1C1A11B97C9AF667BA3A577C8D54E5DC428BE8035EE6142EEF0023E75C156189003F3AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  animation_controllers/HQ/ak47r.json
- Size 3KB
- SHA256 9d5d87806050bebcc82c83c3afb22b8e19956d74e5c8f0110f781f8728b8e34d
- MD5 aea315ef1e9935023bae432a3d268bd4
- SHA1 2df475b539ba676c017f25b4df0cea20c8ebe2c0
- SHA512 cb85c7fb1a46191e0a52d1a8cb00073250c5198c08b30d40a613afc3039c50aff4b759b5e0e1b1172b95e2d66d4c47b6a195746b194130afcd5d475a57e310dc
- TLSH
  T115611C8ACE5F616F53FF531D199CECD869AE80B5DAE042FFB404A348A1486D4402BF68
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  animation_controllers/HQ/ak60.json
- Size 3KB
- SHA256 7d0f8b613322ce4605d8f53d695e3d8c34ce0925fe4d16a692c9114930c411b4
- MD5 0bfaf7bca63dcff8511bbcfc3b79a0c8
- SHA1 c1281219000a2ad71c8868f34140774b95555960
- SHA512 71c8469447e875bedc31dcef1d8083a1d2e0032ad40d4c15aafe2d8a88d55c318db83faaaf2cc6101cab609dbb751a4b999e0d721c7edd7f17f13a68a5f23e3d
- TLSH
  T1EB61608BCB5F506F53FE6319099CDCC821AF80B5FA6062FFB805275881685A4407F7AD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  animation_controllers/HQ/akm.json
- Size 3KB
- SHA256 66748b9991c630913d1e3e512e5485f500627f8bfe24e23724f09b2d5c07aa9a
- MD5 fc1589106ab87863b2e27e5e7648d93d
- SHA1 8a7dabee2a700df1cc94d93c8908fc95601891cb
- SHA512 4d730818cdef08f05e0ad78c1c888891a20f1554595adea2f0f1fd2b0008f37392a6f4c2f68de0bd42bd2ec9af997673bec06876dc0fc8566ea0e32814c5dc3b
- TLSH
  T168612D9BCB2F512F53FE53094AEC98C421AE80B6DE9046FFB8053758D24959C803B7AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  animation_controllers/HQ/automag.json
- Size 3KB
- SHA256 b7bacbe88df596bb744120bdcf48ae3a3d2d3be94fc0c5e6751e6fc06101b32b
- MD5 0376a971ea482220e6ec990b84178952
- SHA1 029212b675a16f6ce53b69b01bc95b885fb2cfc8
- SHA512 19509b6b578c39381ba79ac59dc6886aa1b04a744fe218f35a2dee53811ff051c7beb90fa9a901308d9bfa57a78ab644d76753d3e352bca41bd13e613e22d7aa
- TLSH
  T161616CCADA1F482F5FFE431D089CB8E8117C9079DE6056FFB006A308C94D59540AB7A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  animation_controllers/HQ/awp.json
- Size 5KB
- SHA256 44f17f655e48f874f3a3c18397a5eedc8ca07d5326c6c696a3a08946f243d4df
- MD5 e93e04e638d37f0995108f95796c6e3c
- SHA1 862e07593819d806b1cd24427a548e2217bb2e79
- SHA512 2a8c6564ca43d582c89dca2dfa3cb99725cb9f3eb080c0538b8d0a8985e479d7dd811e488bb2f4aa07e7bfd00b1aecbcef65944c2a4b45a8377dc38f22faff20
- SSDEEP 96:aKA+LFRzbQrUhvgxsMDrxnvB8bQTxdF/Y/hitrc:9FFJvaFDFn2qx+
- TLSH
  T13CB1C7D6CA2ED12F22BD521F259CF8CD11FDA07B896082F7B1292349918CD94552FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  animation_controllers/HQ/awpr.json
- Size 5KB
- SHA256 9a951f5e2c24895b056af957fddd89feb5a955e53b9a481e053edf8ea801d9ed
- MD5 612898d604f40c60929af51a486099f0
- SHA1 2566c28da03a468c1556e8bd9d70b3dc8632d166
- SHA512 d68a2f028571fc238cadd96013681b50ff8a6fb1c13c7233aeffe5ba4b08c298cac2521533d4718f55cd4ee78aee02b4c9d36f2612dfce787190bb1d5a2cd9e3
- SSDEEP 96:SU2Kth++MB8eK79j315bQxtUWB8V796xD7sMDrMku8nRonTyDXccKu3Bo5bQxD5K:FhF3B+FDVnee7W
- TLSH
  T111C1CBC6CA1F912F22BF531F29ACFCC951AD607F896082F7F02A23499189DD4456FB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  animation_controllers/HQ/deagle.json
- Size 3KB
- SHA256 0d9217a1ffe33585008a40d15b7fc2e48cc83ce03681142776739f36ae685726
- MD5 0039570ba91280badf20ad115ba0b663
- SHA1 8ca1bceb95dc1a28b4ea10166e12f0944c1d3604
- SHA512 a6daa4cc6d3d7cd285304c4a919e663bb495aa8dd858dac4d05a34ef09c5b9d34801ada764656ce81b33b9b1b20e98b71a19bc6b3dc329bf2df8009cadc68447
- TLSH
  T10E714883EA6E413F92BE432A09ACD0E9753C84359E9447FBF104735EF1889A9407F7A4
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  animation_controllers/HQ/deaglecsogs.json
- Size 3KB
- SHA256 70d1d2b689d4b4817b18294e86ce73b47a9076cd05af73a63b799b7ddf173fd6
- MD5 2d70bbedec40257b98decf114ac6898c
- SHA1 7ca8d8abe894e8170a4fe4ec26a0bfa359b3ef73
- SHA512 aacf0ce1a94c73af06c360247ce0c52f7a2cbf81420d44394084644d86e1e886eb0f23bf8be9224c3a725c264c93cb6f53ac940748bcf717313eb67b8b72a905
- TLSH
  T156713B87DA1F413F53E9431A0A9CD4D5323C447A9A6046FBF4C8B35AA148AA9403F7BC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32