0392998690059c8b68ca62036103b93f95b12513019b761ee6913e5f12127617

Sharing

Copy URL Twitter E-mail

General

Target
decompiler.rar
Size 2.2MB
Sample260623-l6dhcsby5r
SHA256 0392998690059c8b68ca62036103b93f95b12513019b761ee6913e5f12127617
MD5 07a1766d47afed2f4c93ba82f93ce577
SHA1 8e968e4b1a71c9d7edb58e35cc62f7bc39018abd
SHA512 8948070232d543766e35856ac98c4fc3855019a286d8d4c9e7b3e4822274a335d3e3d26642d6710969f51a6103fa725b88c44f9c1cae9a74d7a6e0ad2aa94fb9
SSDEEP 49152:9u+TUGOCD4hZZsCJ1zIKdnUpgTWC718N8omN8o3Sr1OLe:E+TUq4VDJ1z0pi708oY8o3Sr1j
TLSH
T12FB5331CAB48F64E53AE0DBA0A438717531BBF69CAA185A185F1F0570E49CD0D43AE7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  decompiler/__init__.py
- Size 22B
- SHA256 381f9bfc69d49d39040a7d5fc3197ce385019a2ba2de649622f841a8c658ed37
- MD5 dce8b270fa2cd3ae3d50c8cf708b8281
- SHA1 9f0f32ad69efe72223162fc3934d29e442a9f8c5
- SHA512 66d2dfee2c1f59e36e5a628cac23278007576db3304b7924fd910b7193214f83c65f0543b079155f94549c86a2f17504aa39f3a511ec2f7a40dabb4224059079
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  decompiler/__pycache__/luaHelper.cpython-310.pyc
- Size 11KB
- SHA256 ebc00e4323c250328828e1f2f3631d7f70e6393b3b6f66adc21beea455b424cc
- MD5 9353e5359088186704e0690871b5e917
- SHA1 1650bae97bff930aba30eeb8820f83b86a42a329
- SHA512 716b7f34b7cab4fa2b53f4cc20536c7075b71e6812d031e73d1d4f7efac482ee9204f4faa59a436302a6f53bbfaf92b5403b379f0968300934d9b1089efce7db
- SSDEEP 192:pc5nS0WudLOd3/43qd6WIDsa90hMdGcOuqyrmgyv9A3aLKQYRNkuUITb0Ji3nEUS:G5nS0Wudi46dMsa90oGcLqyrav9AaLKQ
- TLSH
  T1EE32738C7811AD87FD84F2F4409B42182618D572FFCBC19A1A097A7FFD881860B6BC4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  decompiler/__pycache__/luaHelper.cpython-311.pyc
- Size 19KB
- SHA256 cb6f049e973d8894bc8271d4849b2f76bf961a2e1ef01260e14d11f20c0f12d6
- MD5 8ce81e197153765154c6af66b9a9faab
- SHA1 4f54449f5ba0fab6d8d7a711a1c795cc7e3ce1ac
- SHA512 561a0e92b983d292da94d01ee21cc8e0e2d67ae834291080cc0ade6a621eb212123f4e3309c0cbdf12e9efbce65818065897bd81a7759fcfed5c5174f74fba24
- SSDEEP 384:FG/y6kI5LffG/tEi0zOwEhsd8SeQHPkSVw70QYv:FSy6kI5L3GVEi0zOw+6lHMSNQYv
- TLSH
  T10A927E487861C4ABFCA8F3B58887018DF328C9F2FB82C7A319539127BD1A3546D664DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  decompiler/__pycache__/luaHelper.cpython-39.pyc
- Size 11KB
- SHA256 e7343f2fe54ff0feb5f9e153b9cc2fdc2dda1f11a135d8d63ffbcedc28c5f2f5
- MD5 af6fba2b358c62282b254070b65111b8
- SHA1 bd752fd5ca78ce2238223e5ee50676c3d3f170ca
- SHA512 e6c644afe657eb3a32d768712b182f387f7c8821a7c65afe183bcdc5f33d0109bc0b75e5769fece2d96ee31c1c92428adbb62dcaa7e313e0c536bc37819983ba
- SSDEEP 192:ttR1jeN7rEOEC/VP22a6ZWaHmgxIrp6/MfuoVxkKUu71/eDnEJpp:LR1jeZFTp22a67HZ4p6/MfVxrv1jJ/
- TLSH
  T1883273CC2A51AD8BFC95F1F4405606682518D576FF8BC29E1A09BA3FFD881850E7BC4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Drops desktop.ini file(s)
behavioral10 behavioral9
- Target
  decompiler/__pycache__/script.cpython-310.pyc
- Size 5KB
- SHA256 72eca42860011ecda18acf851e64e6d960a6060bb6dd0a8ecefcecda4e61a856
- MD5 c38ae64129913503eaf59cdd87347a99
- SHA1 08972d5664ebe08c2f8b52a01ddeb6fa8f476db6
- SHA512 f19c479b16c36ae21fec746b56d357b120547d7116a90d3023efbdfba2f413a0207d7c93bf49a5367711dfddeb9522727defd7706114e11c501404a0563de2f2
- SSDEEP 96:eeVr4/2gVYSyHr9t3u+iKn8ITx7Nb+p3gZSZlsSlyNSs7V/N5LhIfEN:3d41Y1HrV8Ir1ZSZlsSlMdL0EN
- TLSH
  T121C1F6C98D00AFDBFC15F2F6406B52251F55E2F63B04C2AA934EAE6E1D891E40E12C6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  decompiler/__pycache__/script.cpython-311.pyc
- Size 10KB
- SHA256 bcf16e452d79681176c5fc6557ae38161060a049e00101f8040b85d86e605955
- MD5 5276b9db22babc521d3b26b3a3292750
- SHA1 d3063702ea377ccc500eed1f1aa6b60794ffceb8
- SHA512 518324eba8b93b09bd20efc5c8bbc718dd4fcfe87f12b29e8f4050e5a5edb5477cb4637a0d958b0baae0a5748b86eb9e065615a20b1341ad68e67f70d5479519
- SSDEEP 192:59SGenqY1X8r0hahlsSlMZaH5h1F8BzervY:CG+qkXq0haPsSlMsH5h1uBzuvY
- TLSH
  T1933295856E40D5BFFC19B3F9842A152EB36989F5B600C35366ABC02B5F9B3606E104ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  decompiler/__pycache__/script.cpython-39.pyc
- Size 5KB
- SHA256 f520a8d49d2ef2bf0e85ca24a349a46e4ea65dcc0381a68cc5a7282429c04006
- MD5 dc0c6e22edc7d0771661a9fbda96fdc0
- SHA1 b149aa0eb1eacf9fdf10cbadbb9b65239195e69e
- SHA512 c6bc78b38fe725e6ad40fbf88e68ba166479cc72540269ba0c63e786102748d155628ab6381ab577f0fa2f2d5c2f10326f52c0a554905500f7813cf7f012c436
- SSDEEP 96:AeVn4XI2YPYSyJ9rn+Ubs86dfx7Nb+p3gZSZlsSlyNSs7IdNaG2e:5N4XCPY1JRpH6dP1ZSZlsSlMdWwe
- TLSH
  T1E7C1F8C98D009FDBFC15F2F640AA62612F55E2F63B45C25AA34EAD6E1C891E40D11C1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  decompiler/__pycache__/sha1.cpython-310.pyc
- Size 3KB
- SHA256 501faee0d98f3c9ac2e7c228ad4c2000dec5b5ffee570ba75eb135045d1f9ec5
- MD5 8a6ba5351f76c277daaba067fe1e4fcf
- SHA1 3f9265b4ecc1ab716f7f4fab6c1de348f3d24581
- SHA512 2018acf891750bbcb030c2a98a07fd2c3db7bfee8687dda832302abd37cb407269c49c7312955f7af76ea1038d4a596df8c1cdf47b45a7a391dcb1f1363142d3
- TLSH
  T1DA61D9C143145E67FCA6FAF340269205ED29B17E2F0557D3852D514F7D0C7850EB295D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  decompiler/__pycache__/sha1.cpython-311.pyc
- Size 5KB
- SHA256 fd9c6edffd1a9a8fca8545737ede8a78ea21986f64cdb2a5fc099c5ea33f3a44
- MD5 751cb9f6ee2aa89b5abff1a193ab2b78
- SHA1 dc0d96caca05820d685471b850606627e8636adb
- SHA512 d71f5bb86da3ba7809d2a21682f7a33c560118834240eb99d2fd89317514dd1a30c897a0e732b22436d35fb8c6cede34f106d6b4e4efd9b46185b5f0059f4a43
- SSDEEP 96:bvkcfj27qYeQfFIDRrNigLJVKrwSniqrz3+u/ko2Vgjl52z449EVW:b8eS1mrNi64GIz3+KT2VgOzfEVW
- TLSH
  T1EBC1B5C12A11C57BF872F6BB45A6410BFF3988F8BF40C7276679803D9D2A9446E506EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  decompiler/__pycache__/sha1.cpython-39.pyc
- Size 3KB
- SHA256 b26e8758ba2f084c86537bb0dbe9bf411a6496f1402afb749a5e0963b4d76c81
- MD5 de73286916c6234e0bfa3ab1cb1d8af9
- SHA1 08a69bafa85e5d05519d867116d4e88ef0b630d6
- SHA512 a5a1dfcdb04a9db41d45c42b4ecfb59c4699df8f2e09c67d45b0ac02c65025dcfaf72e1d62a68b8e3798734617edf66c741bd5110ea7651274335c12604a3432
- TLSH
  T12E61EBC143489E57FCA5F6F304269606EA29A1BB3E059393C52D835FBD0C7C50EB295E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  decompiler/helpers/ChunkSpy.bat
- Size 427B
- SHA256 4995d370e987b706b62f2c95e8ea2ddbb7deb81d80f63b76e5916b978bf8ee1c
- MD5 f6767092ddbe69551e282bc032c7ca5c
- SHA1 dfc6ce76fa8ef3a61aacb78f970ff875dbe7adb2
- SHA512 7ebf13af3f9e80af65898c145acacd26f51cde9741407570b9af67182c9c0e5507e95470de3fedb061fca5fc03ae44cd45fcc202fbae0e6a7f909527b7dd69ab
- TLSH
  T118E0551AB802B29903F228C1ADB5E19E212CD1C74662E900B0224A3DB4092CC382886E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  decompiler/helpers/DragDropMethod_1.bat
- Size 775B
- SHA256 9a6fb46d2ccf25d786265c6e947fddbc4820e2a2a0486af5223cc777370464af
- MD5 b50367ef9d88927e657b6d8e0f042764
- SHA1 9dda05d42bf6925e2748d3f4eb73cbc5faa13d54
- SHA512 3df2b4c6e53f8feb5896727f1a6b269b5fa0875cbaf3887fe9b9fff23df8f8c9fc4064dcbb872c3fb632de2c3b8af588689ce6312c3103e218ad7751de974cde
- TLSH
  T12A01DC2AFC5AE4E4537234D24FB4E08A255EC2032B11DB88704F88BC3C0A3C8697C8BC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  decompiler/helpers/DragDropMethod_2.bat
- Size 727B
- SHA256 f2354faf29e29cc37fcb2b3913fb12a083ab505e79edba74aa255318194a97fe
- MD5 6b080328aa030c2093cbc6c944514af8
- SHA1 8972e17cfb8a08bd0f264b26ee92796e08795970
- SHA512 31fae86452637bf22580c37e31b40941f9d7fb31b2464fc478faf12743f9a0b383c35164ba4d9009da8f6c68cfb1e39b3f3b6dda9284bfe646a53918ed3d1161
- TLSH
  T1A601C029FC1EF4E4537524D24FB4E089255ED2436B11DB48705B84BC3C063C8597C8BC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  decompiler/helpers/DragDropMethod_3.bat
- Size 515B
- SHA256 e12ed6bdc3da786f6a5a836773ea188d8b5c8ef281ce5fce40c49de432f6d243
- MD5 a6891c38ab6e6bb87d68972d620c5fd9
- SHA1 c80964fa56e12a7a9bb754a531967daa4e5b72d9
- SHA512 c2160dc9ac63ca11985da6bf196b167d8e82184dfadbab9de443f70c8768ce2c2f2bab908db0cd1670522417010412136e2fcc87f500e3b8ad136479e754efcf
- TLSH
  T15FF09E3EB80FE8D602B638C14F74919B776AE0436B06DD84701B49AC75063C8A42C8BC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  decompiler/helpers/FunctionDecompiler_1.bat
- Size 636B
- SHA256 149219dd15455d7a9ab2882e94b5b7cac2ebca443375eebba743d3da5188c553
- MD5 94432996fc22621766cea1250c4fbfc0
- SHA1 bfcd3d2d4cd4b57aa6a40a74fb185e2143c310ef
- SHA512 ad44c77bd10d9434f22c1af49874b3482ee31beff276cf8f650459dfc7a1e8c08da58c8bd279681aecc41d11944f4f5811b042b66319314e3804bcf55426a19f
- TLSH
  T156F0F96DF40AB6D449B628F07B7B4809E538C0835A54BA81B05B4DD42CC618C057ECBC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32