16b12d5931d747a71d7eae5e35946b61044c8ff42f55fd7a2ed3ebccb4b9428f

Sharing

Copy URL Twitter E-mail

General

Target
Boxcutter 26.1.5.zip
Size 2.2MB
Sample260623-xav83sft9j
SHA256 16b12d5931d747a71d7eae5e35946b61044c8ff42f55fd7a2ed3ebccb4b9428f
MD5 8021c328aa122c7a27c56b65313bbb75
SHA1 102d5533c47dbbee32fadc992abf979b8c6e4bc0
SHA512 d49a0a2ecb81a5c0e8344e56fafdf61669047f49d5aabc4c7f25bfed3598fa169ece7d4afb84f5865dc087141a84d8b9a8cd4b1209d78474db810ec20110b30c
SSDEEP 49152:uirRVnIqVgz3zzjCcogiqBuMRIJvWLA3uRKGVsYnOe32FSD9j99P:uiFVnIqVgzjCc/FLcwVvnOe3nB7
TLSH
T10EB523C7C32DF438F61973F093655332A3A0018DD52E64DEEB4E63A977876B4263A528
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/preference/keymap.py
- Size 12KB
- SHA256 f70515692c2004b9e4d53891d6603564fbaf2a7b0a7904c351171817bdf31c58
- MD5 3e4bb2bcf57dc6969b403df542cb3641
- SHA1 98dbd3710a258bcc10e409874a83528139a8cc3d
- SHA512 da98aed8079dd5e92d1987dbdbfa7de99565ff6f879d12ccea565464af6af158daec491246b3268279cb7674f5c189651fb565b13b825ca5b241cb4d2f444e44
- SSDEEP 384:QcgsR+QKgNrqwjagXMPECx/XxEqfEohtgDQpOl27ckOYtGkHX5:NgsHTNrqwjagXM8CxXncoLgDnQZJ
- TLSH
  T1B64211321E22A52051ABD21209FA3613677106D78B327032FBDDC5587F891AAD3FF5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/preference/shape.py
- Size 17KB
- SHA256 3718560a9189fc607336ac80bee0862260cb4da782176060f20f3f4fed4e7dc4
- MD5 676425d173393b9ca512dc8b1e2ca4df
- SHA1 d853284b1ec4e7114a6202d98957ad95dc8f6d67
- SHA512 41a60a501a7e2cf849688ce012d022c64667dfd45773756a59f3f56a98c133f2f97c3493b04500aeb10a1a9cc3a1247e8c9be7d26e3ebf867ac74f9bc9afb40d
- SSDEEP 192:D8czKqcOMN/X8ChrVKagOt38shQwAbCQVQchaMvfHaZipOdGi1G54qa1b1tWG4Dm:Qc2qMNf8ChrVKagOt38LCaQchayHyFEg
- TLSH
  T1E7820F3A1F249415819AD1220F7A3607563413EF4B203960FBCDD2846F899AED6FE7B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/preference/snap.py
- Size 8KB
- SHA256 5fea481afcbe0612a6521be5b9e8914859cc62259e2bc3a065c07aafa6480ff3
- MD5 c853d87895332b528d1159998ce2caeb
- SHA1 fe90ab2981c0b84e31b17e7e1053d6e5090ac5b3
- SHA512 5b968733e962a5104e49fe367802987d6ffa291a05a71c7580aade3d0b00250f3b9351f30e72514b09371d73d471d3a81bf888ced10f7360f616f3304e967e79
- SSDEEP 192:1DJ/LSTV5rckReo/cx+0G9AGNaum/o6Gp4qn:AVnwGNaumQP
- TLSH
  T19A12EF373F2AB42880A5C4264E7D731355641BABAA213570F3CD81985FCC58EE6F2776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/preference/utility/__init__.py
- Size 1KB
- SHA256 7d6cf6ad6ebbf4a393c35b1890b84cd5c99db6872939e444506aa26b193ed675
- MD5 ea56f597dcc10b813283c74116b74ed1
- SHA1 d0778f5a0b341862c1ee29ba8789c6cb2b57da2b
- SHA512 5d008394cb1536111387d463e559e4082eb5671150b8876ab7c5b49e7b436181a0252d1dc65b54b45382624863f39f269eb0b76c1caaf0406de2b1d885abd82c
- TLSH
  T1C521EE24F9360600C392D17FD8865D13C2CE3EC706448071FA4D87A63F562D691A9278
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/preference/utility/update.py
- Size 13KB
- SHA256 b4170f9580095972f0d532b28d28f774fe6955c80d2036511d3b896af56439b8
- MD5 ac99cc490706aac4a870fa4d77e1de02
- SHA1 6f4e6d6140295d254aaee894342af1b5362c6bbc
- SHA512 42d603b053780b2329a32cbcadc8af83651a14e0f0d4c57115a9ff8901e2d813aed59cfe8e1aaf7ce52882323b0ff47d653ff1c164f86b2cd47c4e2ad4386c3d
- SSDEEP 384:VRxNvIvyJkujq1UwoNU7/kqWyWIu4gTc5f8Vx5PStpB6oD:VRxXqsda
- TLSH
  T1E652FE395DB024C5B3770B9B4AEBE426633A6507810176743BCCC398BFC591493BBA2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/scene.py
- Size 5KB
- SHA256 22f93958a0b3679ffeee955729672b7d34c0e76a7b8a19194bcdbbf13325ca7d
- MD5 5b4ff3615018bd9ebc318c88227815e9
- SHA1 adcd3c77e65d4d202b4cebaf1fa63a69179311bd
- SHA512 86d8e60d177848f36cd672476aae1031e304dcfb06a0ee97c9020d93e8b15fa30a1bdd7b93cbed7dc5fca43ec08bf700f346a4792a87d5fc39e5f5d054fa1611
- SSDEEP 96:BS1AWDnAPoLNZj14YAWJWm75vl+D0woWLlRL5lajcYPD6:BkA8APoBx1RH5AD0oL5ed2
- TLSH
  T176C18126992799B001ABD38B04A6B512C6340597CE343851B78DC258BFC967CC9BB7BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/snap.py
- Size 545B
- SHA256 5250816436527ce29f6c3912d58481f4fb5eead440af5797f3f7e565d39f7e7c
- MD5 f3295b657805c137bc78a1b3791f76c7
- SHA1 bb86472b390bbf6201e09d6a880499f20c3c3471
- SHA512 99abf0edd301ae7fedaad2ecd02f90f86dff9e03c7a255c50a0e859bc96024bec5d1aea05c2a007503dc9f6750546da4deb4426263b926bf5dcb2ebc6ced9912
- TLSH
  T130F02B053755AC30E1D7F6C48857A100D2B516CB87392439FBDC03F16F4622CE5536B2
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/utility/__init__.py
- Size 5KB
- SHA256 b414709e0ddf89e2995b96e4c0c1ac44f538f1ebbcdee410174a851047cbd66a
- MD5 0ef66dcf21e13031d1535610829f6ec5
- SHA1 7dd98a85b328af93fdad286ed959688ba7e52c9e
- SHA512 0e422f5edfb29eefae5c039a14106a6727e228d7abcfb0b2aad6c207423677c1828692394bff939b0b265f143c5e646ab8347142305f0eeeb69cc76b1f67f769
- SSDEEP 96:cjHp5gLkwQ2i5DNh60lPeGqqW3fSRvs6oaHRidjMeSxeNtix7CHlW:wp5obxil600QW/Hoxe5W
- TLSH
  T1ECB142FE8CB7A65D4695980FCB6D3C0724A244D7CE423AD1BAD9425D2FCE11E02B2535
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Boxcutter 26.1.5/Boxcutter/addon/property/utility/update.py
- Size 2KB
- SHA256 37dfb39a73b0e80ae0be73f37980cd93629209ccc8e412542428ce0b5d11632f
- MD5 acd1fd4bd7e4917f29f5cf9a2455b184
- SHA1 926d54538bbfc54dde605c57935cb478a3f751a6
- SHA512 6d7509c1c8b0397cc72dc209b347720c4750a1c31c6aa6ba4fe7b512877d2a23e850e48de91bd30028646b0c4a762cbc8c99f64c5c7bcf12e2a07409c03887cb
- TLSH
  T19B416A1BE935359DA8E7758085C3405AAB74AB1352083925369DC3C5BFC9420E7FF30A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Boxcutter 26.1.5/Boxcutter/addon/shader/__init__.py
- Size 3KB
- SHA256 4d9b27c0e7d3974e132df86aeb96f0593342dc25e64fecf1b90cba4b9d100aaa
- MD5 4057f06f0ec65aa035ebdcc713148448
- SHA1 b54c7b8d83d5e6cc67276053361418c026f5603d
- SHA512 c3a736f5c9cc6a787ede1179eb4fe15a3e355899fc16157cbfaf0f3d71d09d23ad5c1b6fdd0e777a2111807ceaa4da4a8a7533fcf37fae8ef5d35b8fbd824c0f
- TLSH
  T1DD7112635C92D8EC9213908E19DBCC515329A9A70100A779F8BCC12C6FE2E60E6F47ED
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Boxcutter 26.1.5/Boxcutter/addon/sound/__init__.py
- Size 561B
- SHA256 8781966b26ed1aadcc982e9768ced84ed1068de3f96a9ce7b092a1feb34a072f
- MD5 121268b0e66a89bdf79626913688111e
- SHA1 2e731dfb19082a0cc27caff037be5a0fa28c9d90
- SHA512 dc5e646db0a72488cb4ba7fdce8e5af3716be1b5ec01047fcae30d07d4d5ac5f9fb747bd4ed476fa555a5eb155843e223a588780511e5420b5b6311c3c03c373
- TLSH
  T1D8F09AF648DE85CE2838C04C177C210C6449200B9DD835C0BB8601AF3FDD59D52FC422
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Boxcutter 26.1.5/Boxcutter/addon/toolbar.py
- Size 18KB
- SHA256 1fe6f86a74bd8090c940ae889affce39c95d0917ee87dcc47253ae1b78342f0e
- MD5 f05c528f8be6856c8f48333e8b3eb073
- SHA1 56f8b3c85f6a927bb3fb2716b705c416cf23ec6b
- SHA512 a6a7232d23199f6f55a02cb735ffd3fe005c51307fd8babc0d3ccce937eeb80599edfae43936d99dbfaee1d770f064bea4e44e476424f151d8d69818fb7dd218
- SSDEEP 384:5y2+GioR1eou393wDwqPhowPyS+mYnUxaDUXSacQh7+5U2EFU2o1lvCelZOPlpZX:5EwDfPhowPyS+9UVD3
- TLSH
  T10982A661A5706CC68337620E59D74703637E2897C42477267B4C43A83FE9BA8517E3BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Boxcutter 26.1.5/Boxcutter/addon/utility.py
- Size 1KB
- SHA256 ef5e00861e05c12e039db504b61fce1d674fd59801a96f7dde3e0cf4dbe7bb31
- MD5 5060678edd9b81a672e8ad57fc338f6f
- SHA1 2f91dcbcf59b4c684cbf803f412cc9a4f7e3006d
- SHA512 dee704d11ec7bf08b28be96e4698f58103ff9d99da4fb694bd899c5bc73eaa1ab634973aa284ab8c8373518c1b6055728c15258c6699333bb1ccf4c2f01c9781
- TLSH
  T1FC41F03B9924687BD622EF4EC0A3AD413B789813E51521AA3A4DC5547FC3DADD336324
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Boxcutter 26.1.5/Boxcutter/module.py
- Size 147B
- SHA256 e893acab1b2169e283e98c0d1c45fd877a7aec485786488ae6605a5a46e13aee
- MD5 1b9b454b7594f9165c9a34bab5ca3fa1
- SHA1 70df2cad2dc0f5ec3f581ff11defbaa842c8e089
- SHA512 ea58006cff0b61ca82529737c008839abed92751b288b04a275ba0016301d318cc5c44a8dc35a41056883b7b3490c1b98570daa3d074784f2748b77896a730c4
- TLSH
  T144C02BB00FD3F14B724878B7B09CF4000DD82C9703284016625D8508FFC5762C2B0195
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Boxcutter 26.1.5/Boxcutter/utility/__init__.py
- Size 2KB
- SHA256 01cc75d2f54d6a5b5d462c1316f545ca25fbb87df202f177dc6633c7889131b1
- MD5 6bebc8ddcf1ced052f32dbe1349ebd8e
- SHA1 709af9be4e3bafdbf630742900b0d9e26a58f032
- SHA512 fdaac6da8b88810666ce8bf56501e87d01d8ebd23ccd89db950a71d9b599f81f201a142d724953b15f206525dba7174ad10b56c69ebdcd0c8e89d3ea475e8bc9
- TLSH
  T11351422A18B234E2CB06802DDCD7E656731F7C27411B603879CCA3667FC1145D1F82AB
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Boxcutter 26.1.5/Boxcutter/utility/addon.py
- Size 871B
- SHA256 41e9e621a8927c7492dc150e4c39ee6458b8e864da20b51aa42a1f6938695df3
- MD5 935d1adebe8aa1557dd702309cc673b6
- SHA1 3b42882caefdf5e5b519db565d1abde0fc412ee5
- SHA512 3fcd540f6ab39c1e72313e016f72172f05de51d67af39ed5da9481402204f2bde26a7906aee752e7f81d879be60396f43ea7fde75ff1cacf6116c96ed7c7789f
- TLSH
  T1C31129F1D07390A14362D1A89D938B9A6BE75F77972801397C9488397BC1EF181B21FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32