575694481720f24ab79990e8102391474a78b8105798779722dfdba060f433d2

Sharing

Copy URL Twitter E-mail

General

Target
Pascha.zip
Size 1.4MB
Sample260623-mwbrfscs7v
SHA256 575694481720f24ab79990e8102391474a78b8105798779722dfdba060f433d2
MD5 a45c8a0308a0d8087b657593f305c464
SHA1 6c08ab2fffd95c0410d51dd05cc40f0b998b2366
SHA512 23f921b115d791a44ffcf28f0872d7e9868252ad80b1afa338c12ca795db6a820c99a8137b76f47ab6a5585686154d522ce5a65979b276e99d604a49d6c328ad
SSDEEP 24576:4298gp//dyINglIzWUaueqINmDvGmmqb8truL28nQb5bS88H9JF8BT2HWY0QV1m8:D9PJ/dyKJ08ummrSL28kbY9TJ2Y0pfLI
TLSH
T1436533E331C973755A7788A63E21CB80C5CC6687B19CA55B0ABCFEAC538034957ECA13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Pascha.zip
- Size 1.4MB
- SHA256 575694481720f24ab79990e8102391474a78b8105798779722dfdba060f433d2
- MD5 a45c8a0308a0d8087b657593f305c464
- SHA1 6c08ab2fffd95c0410d51dd05cc40f0b998b2366
- SHA512 23f921b115d791a44ffcf28f0872d7e9868252ad80b1afa338c12ca795db6a820c99a8137b76f47ab6a5585686154d522ce5a65979b276e99d604a49d6c328ad
- SSDEEP 24576:4298gp//dyINglIzWUaueqINmDvGmmqb8truL28nQb5bS88H9JF8BT2HWY0QV1m8:D9PJ/dyKJ08ummrSL28kbY9TJ2Y0pfLI
- TLSH
  T1436533E331C973755A7788A63E21CB80C5CC6687B19CA55B0ABCFEAC538034957ECA13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Pascha/README.txt
- Size 108B
- SHA256 69a1d4fdb1a72d5cf43791757c190bd7fdd12e3833f92b2bf036e55c04fedf2f
- MD5 85e66fb48bf03355964ae455f422ea16
- SHA1 27ea2c1c915bef29504b49a03194501ec8c24529
- SHA512 4f68240010b1ac2062a851785d3b8c24e99ad347c2683ce55067eb2fe0511b435634085f8986345eebf01dd70db37faf9ef52de7abaabb927f9dcca1a073e29e
- TLSH
  T193B09272202D36301037CE81CA642DD0ED3E92223CC6A041F5E20A1D02045809428B93
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  Pascha/content.js
- Size 774B
- SHA256 4874a11a0d1917b0936fcf7bf8fc92735244a1afa3b6e1817e4463e499bcad1f
- MD5 4fd296ccb126e7c187ce151bed71df50
- SHA1 a2d0e7ddde70c084fcf66cc084fc23d954245567
- SHA512 bc7c34517f405f7cd81d9fa0ccaae14e4b98e2ba6d617c03899beecda5fd42f4736567d23dda77b83bde155c89e5ed873312679ea5aeb1299582dd532a4c183f
- TLSH
  T1FB016D9A3DB1D12C03F68297E67BD114F93A04562016F16279ACC6BC9E30BCD565B8CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Pascha/icons/icon1.png
- Size 1.3MB
- SHA256 4eac4d2aec2ee45c98908d577b8556527df9dc57651452028b80f882ca049f82
- MD5 5aded2e112d9cd07a3a37d9ee4fe9cf9
- SHA1 047a3b89f546a42ad40f0aa90487236b7c25d933
- SHA512 a3cb6a3609cf599e452eac78f3a9fc2690779494351593662a2249b384648ae5d5b85be3bbefda93e543658289f7388b9ca174d56d85bfe7523a6b63ebc92d56
- SSDEEP 24576:S4KIUAEsEzpD/jyInglEzWotTIuAdmDLGQtv6L28nQr5bSw8DFJFwhlK+EaOC1fb:MBtsEzt/jyOPiDKqqSL28iloFTwDKDaf
- TLSH
  T19C5533EE73C9E7B061AA515BFC110790C85D5187AAFC4ABA067CFDA9524034632ECF36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Pascha/icons/icon2.png
- Size 156KB
- SHA256 ec2980d57138428836e2922e166495649b36ca94c18c8d5e9ba190a0053231e0
- MD5 86a9a20c10ee66175d07bbd511a124dd
- SHA1 a9ffc8e362a184d4b2d7762fd3e9b734fdf04dda
- SHA512 3bb9ad14bc599e1b6027a141606afd569ed36ac4c82d5ceaf33268e51195aa18e574e6b43580e86ae9bb3fe36b2cfe85d7e65769326ad2877fce2e05cb48c68a
- SSDEEP 3072:2se8RXt646rZseFFBzZWgMO4MXSqpmbwwTN8KNmRxuyyYpSbGx2:2s51c46rWerFMSknTGM+xcYs82
- TLSH
  T12DF3123D435772F9D586401BA0A328052F4F7299DDD8166A338CEB1F3AC167E0EA19E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Pascha/inject.js
- Size 1KB
- SHA256 db192768c088ac0c31bbe2034b3bfca404c3bff37bb45b05253142fd9b4e4428
- MD5 be1d5be8d1a4560f5558e7721af1f422
- SHA1 ca48bed1391ddffe38edbe6bb5645cd231203ed8
- SHA512 6d73d60374a2a7f53a49510101db68562bcf4832f3e55ef54336f58797de2b32902b2363c59b1e5ac5c7a137fadf46fe0b63a242bc5c171c8e0aa8324ff9793e
- TLSH
  T11C314386B1F2944405B7397447DB6401AB3DC45B602DE9D0BBECC3D09F91A260A172FF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Pascha/manifest.json
- Size 680B
- SHA256 03a8b2729a23b3023143b72d2ebba5ea13ba7100c11c6bfd8e2c49184a890798
- MD5 fc90ccaaf75dd7389381346be9dd1373
- SHA1 a975a651edccf6d1a83d0f546973dd6611f57b56
- SHA512 41e62119d28a472811d58a338413c3266197b4c2b1541c96407a68d36c9877c828b373800ef7053a894ec710f49df0b491400e9e39ee54d571a65574f9aae92a
- TLSH
  T14101F432D8349C7203DC2AB868AD52C2E7510B47D9A07D48758D005C8FB916919B9B89
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Pascha/popup.html
- Size 5KB
- SHA256 1101026a898ca7252663b980fa33bdb40e0b7e31a23e8b992cf3ff4208225930
- MD5 c522d27dee6eed463573e2348b41b2f8
- SHA1 0964973805b33c6ce547e75094815231990d715b
- SHA512 c9b44e838cda4b7afea25ab4459290401b1b654f11deee17a999b40f3dc9beb98572b282429cfe1ee57bf56db5ee56024ec73cf725f47d192f444493230718b6
- SSDEEP 96:9EnPL/qd3ahvUq53e6Zxl1iBrltTXURdU1RRyyZ78PSz:9EnPL/8cvUqx38lFERqD8Gwe
- TLSH
  T141C1EC47A6B70486B823D4F42FA7268B2355E1078009CE693FDCE268CF4719CDA7A75C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  Pascha/popup.js
- Size 23KB
- SHA256 dffdae5d29ab484df73e89900024ee1f05e03ee9aa01106b275c1ca687cd8a01
- MD5 945eb450d5fffa407d2b31f0f8ab095f
- SHA1 bbf4aaa72108d6b82e19488c9cb076516c936ad3
- SHA512 5ab7143fbec957e471981e63350067590259e746449de542da03fe103779bc44199043df777810925ec33a05effc48725bfe17de88d81023d6ae59284362496a
- SSDEEP 384:QZ+1LwvhXLOq9id5/7ejpGv06BJ8M7/IIg:QZ+ZGjpGv06BJvo
- TLSH
  T1E4B283E874B3606691332076AB6BC8597B39B113340AC966BA4CC3607F61518E3F7EDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18