55a6afd2711aa66e36215c55bc54bb72c2a5d21be95f6b3ebc48065432bc66ab

Sharing

Copy URL Twitter E-mail

General

Target
citrixHealthAssistantPortable.zip
Size 1.4MB
Sample260623-vx364aev5n
SHA256 55a6afd2711aa66e36215c55bc54bb72c2a5d21be95f6b3ebc48065432bc66ab
MD5 324d9945cb142bd79c390bf597128c9a
SHA1 9a9dc6fbfd034b3f4dc6954f40d191579c2d9966
SHA512 c4c1f6afb97e97adf874c5a150a5809b08b420f5e50316e946c45d12f0fc6b9f1f9a5a20c83a52e56f10942df10a0f5677777b6afb4cf82086c08f8213cdd96b
SSDEEP 24576:ip1T3XVmtfPvM8tBGITwNiBJ2k9h0Nr0a5ISbQCzDIHc7cFnf7GcoWL7orfNkRon:ip1T3X8tYITwUB/4Noa5ISsmIHcuzEWU
TLSH
T1E065334920D2F2E8AFB79579783452CB35F0926D48B52322A6154FEF0DB32F60C161E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  citrixHealthAssistantPortable.zip
- Size 1.4MB
- SHA256 55a6afd2711aa66e36215c55bc54bb72c2a5d21be95f6b3ebc48065432bc66ab
- MD5 324d9945cb142bd79c390bf597128c9a
- SHA1 9a9dc6fbfd034b3f4dc6954f40d191579c2d9966
- SHA512 c4c1f6afb97e97adf874c5a150a5809b08b420f5e50316e946c45d12f0fc6b9f1f9a5a20c83a52e56f10942df10a0f5677777b6afb4cf82086c08f8213cdd96b
- SSDEEP 24576:ip1T3XVmtfPvM8tBGITwNiBJ2k9h0Nr0a5ISbQCzDIHc7cFnf7GcoWL7orfNkRon:ip1T3X8tYITwUB/4Noa5ISsmIHcuzEWU
- TLSH
  T1E065334920D2F2E8AFB79579783452CB35F0926D48B52322A6154FEF0DB32F60C161E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  citrixHealthAssistant/BrokerSnapin.dll
- Size 1.4MB
- SHA256 04b5fda2a9f4304cf1819b8632ceb40bdc9b4038279d64ecc57af89622056522
- MD5 9b38e0a2300d41f8b4a3976454c900e7
- SHA1 a0ac53f9084acf21713e159b3f1ff1b85a28bb85
- SHA512 84984f8f880819f09b2dcbb56952dd971dd5f06fd464b78ee32a98834b66901f1f8d9e011b86943ad96c39b5b84a26855f61b54d6c85054f0bf0684d68e53231
- SSDEEP 24576:Miv3iCscr0QWnrIOKQrU2LIuh0HYsCU6i6Dzgp:MXcr0QWbP8
- TLSH
  T10265C7057F9C9DBCFAB15031EA6A027D72B4E6543B68EBE2432CD44D7C91BC41CCA662
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  citrixHealthAssistant/Citrix.Diagnostics.Recorder.Cdf.dll
- Size 45KB
- SHA256 97cdd19f88ff89bb84f631037b753f816f8b4d23ce3eb292c3eca4ec6de47857
- MD5 58de60fb23ef65f4c2aa579277b8f035
- SHA1 ee54dd579fef95038017225d31aa5b97bf2b454e
- SHA512 581ef68b85dc53e1f92890c45f43d3695e991987ce3027f7b8ddbc463605837c38e74908bfc4692584eb6b0ae0987fa65dd39bb95b937fbdab0cb78ce54e0f49
- SSDEEP 768:TiY4FB/4PkdmrWRUacgKHgpDkU2Q0UD4LfFMTepJS4kCX93whr:TTyBYaOW8lvX9ghr
- TLSH
  T19623074D0F5B1503FA924E74E2D086C64FFCEA5378D3EAAFCF6841865DC27840644ABA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  citrixHealthAssistant/Citrix.Diagnostics.dll
- Size 49KB
- SHA256 ada85a5407702ffc1d05d689091d6b6c8f08796efcc5cff1913e7bbbabac55f1
- MD5 59d8edce9162a60c9e5de08d7e1da390
- SHA1 f99d0af0bea6dc8157dc7271d427569821996cba
- SHA512 956b312c92dd6bb60acd28b55f33fb14ca47124a4690f88c8b6d04259677575ae706978d39b5d6090e923dab5d8a7e0d10010786d62bdcbddf80b834eac8468e
- SSDEEP 768:HdwsijKWI8bbphdDBUYckgGIo1oJphkCgxJ3whs:9wsi2WVbpDWKExvg/ghs
- TLSH
  T1BF3342068B460836EF664E35A18641C61BFC878738F3E7AF9E0FA1615942B0C15D69FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  citrixHealthAssistant/Citrix.SuppTools.Utility.dll
- Size 30KB
- SHA256 f329dc18bb47a893b4aeceeb81fd4d1b609170cffacf90cfd9240c54b369907d
- MD5 5b3311f1040ddffae85b25578ef80212
- SHA1 5715890ad73197703a69f11b87bb699b4c07dc14
- SHA512 f1030a2677b2eb22da9ac47580dea8d59195486ff95a61afa67d6d8dc0977527145530f428978ccfc57aead945d3600ed9b7058618d755c3af32087f14814dce
- SSDEEP 768:AWG3/boYHutANsLCgqJbLd3WKoG2ZDJb2MyDGdhWZRDGpw2MIht:wlHutIiikltdF07Fc
- TLSH
  T1B0D27B55DB600A52EEBB8E3571E4D6152FB13742A991C6FB850CD0989FC3383297837E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  citrixHealthAssistant/CitrixHealthAssistant.dll
- Size 7KB
- SHA256 87bcff69c99da14037378aba69587323768f189fc1dbf0c981ea7fcaec4291b2
- MD5 3d58ccd8ffac99889f5a0491c3b61950
- SHA1 540e9f1f9e04c2ffe19b957b7ab6633014dbc958
- SHA512 2486531bb91f3e3ba97162633d4442888ad27d08b1b4489f88401836e631bd4466901f9fe9432d55678b161fad0b12ce50021e5f415c956fcc8d441f1b524ed5
- SSDEEP 192:SN7Pn4d6rZ4sVaDYHsBJu3UOWIVQV8JVpW:SN7Pn1daDYHsBJWVWICiJ7W
- TLSH
  T135F1D52297A8C732F9F70B736C6316810676F2409C76DB6E8A9C801E5CB63544BF2B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  citrixHealthAssistant/CitrixHealthAssistant.exe
- Size 397KB
- SHA256 49a3fceaf334c8978346bb9cce99fafb168dc22b8681f63a053890e3957bb96f
- MD5 0914eb3c37e5509d01beb75197372779
- SHA1 d8baf7210586cfb58c064f3611ca6ddfcb3c91ff
- SHA512 9cedd7c10b47119b20a9f2b7321d120015779bcb9f1f19449d8933e80c4b909e314d55cf2fee650a6ca4ceed767ef6875106b213c62b87eb129464cede070df3
- SSDEEP 6144:AaAXep4WiUVcDit6vcE44isWuoCsFiUVc89p3O:AaHoBGxR+
- TLSH
  T1B68417102E44C80BDE567BF05860A26CD8B4BE942ED2E51CA5B97CE8B534743DC1EDAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  citrixHealthAssistant/CitrixHealthAssistant.exe.config
- Size 552KB
- SHA256 c9031458f26f973a014a23ea28ba0060187a4426a7f6179d293746401ace7951
- MD5 ef98f4d6ae225b87f8e6aadb1155e542
- SHA1 3d1669ba8d78307ab0c95a1b3f9408421be1ec16
- SHA512 450112815a4bf2dd91bfeeb007969e739e7e2ef7c3dec4a6c909c0aef3b3cb5c10e53821e10d0be6051877f4239630bef20b34d50b9c94ceba4ef6a8244a02e4
- SSDEEP 12288:ptR0ms8hPvj6zD2HYa0FaY34B56P+ZctB+cJRlHyo:ptR0vkWWvXBzgpRlx
- TLSH
  T1C3C402258A847FF9CFAC1A1D50F90B1E57E04A9E812B348AAF23BD06DFE7544160B1DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  citrixHealthAssistant/FMADalAttributes.dll
- Size 23KB
- SHA256 9f5887ba2e827f4b8a213f4121b3ca2367318169c315f0eacb73ea681310df5b
- MD5 4dadb67619eb71d43c44b314e7e3b2a2
- SHA1 ca688a386db82bfa0d225a295154a5462f23af27
- SHA512 a11671438ace02dfaacc7634759393684b4189eece7ec068760e262259e2b3dd6875ec03ebab9ce19eded6b1990c8bb0e816571e653b2264f9ef9339b963d5d7
- SSDEEP 384:zb1wKpx0/jUOkxCHTad6jexTnYPLxDGqCrZ8n4n2DGqCrZf68JN77hhSqY:zblx8jUhWY6jehWDGqC18nq2DGqC1fFQ
- TLSH
  T14CB25C664B286637DF5B8E35B1D4D1632A30F3857A53C4BFC93EC0869FC2B86226446D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  citrixHealthAssistant/FMAFilteringSdk.dll
- Size 24KB
- SHA256 cb5c45bc0b23cd8bb69a7bb2873d0c6fd77a35ea474278b974ee9aba7837d5d0
- MD5 146ff0f651d2bc13ae04165679ff669e
- SHA1 2d9898f2a522388a2c9d4ed434ff1f50d4f19808
- SHA512 344a6753f3c503b0b2c872e21e70f4568fc59cfc8c341324950558991bd914e931ea8639d8690caff8cb1b199032c3ad70a3dac86688fc9d524871a7607937a2
- SSDEEP 768:VkOqCNci0506WDGqC1j0dDGqC14H3whuE:KemfQC1o9C1IghuE
- TLSH
  T1C1B24C4A47145933EEEF9E7570D0E546AD70F7816A62C5AB88EDC082CEC2B82277817D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  citrixHealthAssistant/FMARegistry.dll
- Size 39KB
- SHA256 9ecda094dd8b2adda293ba3694458b65848768e36e5f64e783e14eee6d8a75f2
- MD5 fa6f9e2cfd860865f0c3b681a0850a94
- SHA1 f883c0e6a8727dcb724c2f175f0d1f02937abbf5
- SHA512 65adba5d432ecaf739ba05d6a66363ba78da912c63723bb95e82f1594b937553b8cca2c840f4934c7a80cde6bc79e11636c49e4e3287e9dbebda5a1732084e63
- SSDEEP 768:Hk0eKoDEr/JiRK6qJwT1VJialzWDGqC1uaDGqC1Xp3h6p:reKoDAoRK6swT1VXCC1zC1Z3h6p
- TLSH
  T19803198A9BE8404BFAFF4F7961F651134FB1F6456D62E7AF4448C0B6A843B81192132F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  citrixHealthAssistant/FMAUtils.dll
- Size 197KB
- SHA256 d3bb141e278b6b5d5fabd6c2db1e723dc53ccfe7c030f26519442c9cc990563b
- MD5 f632656436224a4c3c61b3a929e67862
- SHA1 8a3ba870703f1175464720ff1c36b865fda47626
- SHA512 4a89f13d787481b4856194cd52598d39b6fd2b9c0d59c2ecbda55685e9b39b23395f58764f52cdb3181b0b01166f2db951dbcd16390b195c714b7dec4bec2f8e
- SSDEEP 3072:hOlcdzYsgWOkJxxzkGp6dKRSa4sRjLgHKzUNoAH5/BC1GgC1s1:hOlcdzdakMESejC5E1G91s1
- TLSH
  T157149F0277A87E24D8EF0639F47309454BF4D34AA322EB69996CF2EA315774588313E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  citrixHealthAssistant/Interop.NetFwTypeLib.dll
- Size 42KB
- SHA256 6faed549db6055f492db290c7677f1c30a528d308b06d97d0d8456f6f48d770c
- MD5 bda5c9ddfcb72d1f6563723f84f49566
- SHA1 050a2cdbe00dd2d4a99ebf5016d31c01c75089a5
- SHA512 83ed26389da3a16a91c9c14c5c238d3c4f56c4ed08d539e9b40b6e464d971ab96a3ca041aedbbe2465a0c81a62f36bb79e0b33f27add6b159dedc193b0147dc5
- SSDEEP 768:VGsENrBCNUr7o7+Hkeu+CyPzTVEpYinAMx7zKsYYitzI7AMxkEoF:ksEzCNUr74+HNu+/O7HxHO7Z4x8F
- TLSH
  T17F131867B62DAD45CC9B8F7F34E947398A31E6456751CEA3A20DC12D0F433896E602F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  citrixHealthAssistant/VDAAssistant.Backend.dll
- Size 530KB
- SHA256 1c207d1c2c714dfafd13a26bfc7d7bac8421fc7fb886c6f76f71c4751289295f
- MD5 1b1c7e9b524e244fc07969e9cf8a1691
- SHA1 fa3b73e27251350c43cd5f1e3c0cde3079d557fc
- SHA512 1297f2a04c8527111bb4f6650425b9d95a1069bd59147364d8f7880cab0aef902fe61837a21f80bd1dfa183a1a693c07604cf4d82d6d749a75e7446f9099e1e5
- SSDEEP 6144:NboghPqX9l0uyG3lvUQz8dPVwrQwkMUkPIO414wL1NARPbmLiMZBO:VXR49l0ub1VswrQwkMPIO414wL1NomI
- TLSH
  T10BC4F7043FE84629F3F7EB74A9710514DE36B5976AB2D60C388C408E1B31B45CA6DBA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  citrixHealthAssistant/VDAAssistant.CommonInterface.dll
- Size 30KB
- SHA256 76b91fabe99b55782f78f3ea380ee87a60fc6390bfdd536e36d9afdb5d772bc8
- MD5 de90a8002a716a208cd0efaccc0a75bf
- SHA1 0752a584e7653001bd827d1454ed5039bb607b78
- SHA512 7cbb8d4f5cdb52bb941fa85722855b8d6502f566540d33a2a113651cafd5817f899f150f55c080ecfcde188cf2ced5997401870f034b5d45c0c79fadb2147300
- SSDEEP 768:n2fw/u8/7/VnEpYinAMx7zdSfnYitzmOAMxkEJ:2fIPa7HxHun7Zbxd
- TLSH
  T12ED26C62CA54CC19DEAB4E3478C4863A9F74F3425E81CAE7224DC5198F87341BFA22F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  citrixHealthAssistant/VDAAssistant.PS.dll
- Size 51KB
- SHA256 a56022471666cadc3d0c087db20ec2c7ad410255270efddd5d82f9cc7cce7dfa
- MD5 ad2880e9a3a4a7265579b5a977479578
- SHA1 ae5ee4f19ad742dedd409c280bef6f25cebae99c
- SHA512 836c1053cbaba15568909fe363aa495ec33bfc5102cd79da88960e88a1464c80770461b5bcfd9629e9f3821fac14b7f9202815af7cc52946fb4a7e0b0a6d5494
- SSDEEP 1536:J7jCY/X2Asx2fW7Xbt+X9ST11aF51c9UIRIpHNTRRxrZMw4Z2knkFnlyR87HxH2j:JyY/X2Asx2fW7Xbt+X9ST11aF51c9UId
- TLSH
  T1DE336C601AF84826EFFB4F74BAF005261E74FE963A20C6AE11DD800E4F61F466D62775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32