81a63e73995d8966327aa8a0777c8427441e9285823df534896f320da108e9c0

Sharing

Copy URL Twitter E-mail

General

Target
uvpackmaster4.zip
Size 239KB
Sample260623-xdgvvsfv2n
SHA256 81a63e73995d8966327aa8a0777c8427441e9285823df534896f320da108e9c0
MD5 4de5c08b553dbd6d01c3c25b2fc4ad86
SHA1 6904c43f72483028ad23ce755974300ddeaa1d24
SHA512 b7bdcacf68d59f1b518c8b42ab3d3ab2671e0294c393123ea4acd6697833a7f23fa6b9ab9e0513aeb269e3ba9c0a0bfa61dc64d39d1ef43631a4f2e5fc81407b
SSDEEP 6144:aXLaMYXVOvmG3ahO2ZowrJ34MHZcFnA2FD7hAW4/41T:aXL3YXVOJ3nit34pjFnf1T
TLSH
T12534D137FDE26506CC4B707CC04B860FC2CD68562B53890B6A990EBA767F96036357E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  uvpackmaster4/spipeline/engine/scenario/pack_tiles.py
- Size 178B
- SHA256 9cde219b239ebd6ca448ada688d42de912d9898069abb6662c043fa3218b2c7d
- MD5 3596ab8ebe1a7df2522ec27d209901c0
- SHA1 6cbe2d41964014e59b47169eff5eee43e7b1dc19
- SHA512 f5af8bd7f74d419ae45808d76f1b3468a6726fc4104d53ae336a74eb8bb1ef5777775b0d74b4d1685a40f219f2f1c0d4e6e8b3aa9d871dd1abaeec478ca620b7
- TLSH
  T177C04C26E716E8B955256634130CD12877B5322E8B7B14113CF6932C67491C0CC27138
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  uvpackmaster4/spipeline/engine/scenario/tdensity_adjust_to_unselected.py
- Size 980B
- SHA256 402da655460cd7612b30ed4ebc6054b736a4cf2460097ac0d0579c0616318f53
- MD5 705b191add8e27bd6c7fadca0dc29feb
- SHA1 606ef6f1c7b7d03f8c02beb174e26f90ae3974c6
- SHA512 98d0ca02b15a27e2089962c3d5740b4771935788734a8f73e7dd36fe310c670fecb5e10f9b731ae5b63cefbe0987ac8514fe07425968ce13e1fdb5758962df39
- TLSH
  T1C4119C8ECC66C1B5823F457B9DCAC2CAD70A6B123A296041B89CC93D2F71A04C8915D3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  uvpackmaster4/spipeline/engine/scenario/tdensity_set.py
- Size 545B
- SHA256 1e976f63d26250605ba906a8a93b7bd1b0adc1c967c53e2cad967bd817b7c860
- MD5 7bfcf70a8e9cee8f04cbe0b139d65695
- SHA1 3958ef6922ded0184af379e0a89b0c2a98818902
- SHA512 754c4e908ba669ed46a090b013ead84e98bd65667dc0f9be240a39cc11280e07bce9c80477516403c2d13535cea6653c5ecebb249c409bd4c176f129bd95bc9b
- TLSH
  T14BF0501FD52BC140913656348C75D146BFA6CB233B19444679EC8F143F78605DD61956
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  uvpackmaster4/spipeline/engine/scenario/tdensity_show.py
- Size 387B
- SHA256 4bec325ff38c49d2c0d0d03ada218de2f6a5e0c5b38ec951f445070b04152746
- MD5 59f084ff7a384305133e9a4c6e66dc61
- SHA1 9ed0fbfed15b75fea154f89c81fc393869221d8f
- SHA512 fe77554b9d684210f74da495a5c64cc5a07b15157363e55738ae02ecf39fd66409820f515254285a8fcde8e1e965f058c2c69cc1b7d0ab495713af3bdc69ae1e
- TLSH
  T117E0C0164827D1A0F1368B3CCC4582469F655F22373D4101F8FC8FA12F7C405C913EA9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  uvpackmaster4/spipeline/engine/scenario/util_get_iparam_values.py
- Size 240B
- SHA256 61eb32c772c18e765e9379e49cbef78b396d2fcbbeb64825ad96f278c53e6733
- MD5 deb7428c938858233fdf3842f9ea8388
- SHA1 683a4f11e14b41c1b77146689ba20c149fe5c90c
- SHA512 15c9819c23cb45f8eb23aced9c665d2ac9407907cf8c43b394fd70403962a517be1430936f3f9954805f6404ec146e7543d776d02c6f0dcd7502510c4b65b50c
- TLSH
  T1A0D0A769C477C1F08272D9785485C206AB951A239B1A1041B5ECCF603F78911DEA3C89
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  uvpackmaster4/spipeline/engine/scenario/util_measure_area.py
- Size 697B
- SHA256 ecca2806393992020805238fed04123bf8e8f97af775b5837c9ea653eb8ea3bf
- MD5 90869c84d48023669b2963c047469d52
- SHA1 5a88cb380179d6dcc272644ad3bcac17f138be7a
- SHA512 842b307edb54d1fffe2a75e509e71eee7e6a4b7acd9d3c32b519caf63631213940920e4123a1b06fb1455dcd2097576ae700b5ae3c4fd9d8dfea11f4e1b47919
- TLSH
  T151014914FC3B0265C9F788AB55878089E7460F274D7410D5F55CDA283F75415C8F1CA6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  uvpackmaster4/spipeline/engine/scenario/util_overlap_check.py
- Size 889B
- SHA256 e5da225cad29419b3f5cf47071a36a4bbe6f5d043c35bf5aeb9f491b8b56a2d4
- MD5 166e01eb531fee38deb4cbcda33002f6
- SHA1 111cab3fd5d7d119e79066338e46f3d59e15faeb
- SHA512 90bbf74cfdd8f9e151f836c0ffd76b8955f1c4d976e155f627f74abe227fb4bce75f6a80efe0b35ce5632455a5b453662b71a2cb364e010bcff68d0a768431a8
- TLSH
  T16E11FD21D63B0079D1B4677C3C11824AC3460BA7EB358D09354CD3953FB4936C67299A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  uvpackmaster4/spipeline/engine/similarity_utils.py
- Size 3KB
- SHA256 d0e3c05d8da36f9a631e96df0f09bbce061a2ca9d47a99e394ec7ff478ef96fb
- MD5 09434094bdd37d868a55ef789cb5c4cb
- SHA1 e9a60d3e4a77f7de22bfcd51f85a399390150216
- SHA512 74f00719d18c6adf484258d874a432e7eb1815afc918724b3099dc977c20736a3a27dca8b620aea1f47fecb87919519a87d4965f1d5ea8c00f8511c9a95f5d93
- TLSH
  T18881005488669ED090F2B86FE2956D42FF87288F366E051B776F81901F3DDCA03A2C57
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  uvpackmaster4/spipeline/engine/tdensity.py
- Size 4KB
- SHA256 c65875ef51353ae82ffce822c2841afffe7047c2c396ab8355d9657493e465bf
- MD5 3a49e55bbea1684a8de15ad4fde0589f
- SHA1 738fc0c13e789286b6456e557e701f16d3020021
- SHA512 848dfd107829d2f0fa20e8e0d7d693d45835efd9088106278e13d8fb4eff16803ebbeab4b133162378c546fb402f1ccdc063b22b2ff3344537fe93616dbdbd23
- SSDEEP 96:SSJVskWHl/7AwWnASlX2J1M3c/hTSGkFp:wkWHl/1WXlGJ1d/hfkFp
- TLSH
  T17391BE6EAE93B140917BDA3D4D4AD42BF32D0B43263DB223B4BD61942F38528D5F189D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  uvpackmaster4/spipeline/engine/types.py
- Size 15KB
- SHA256 b0b6c485c9527bc64cf05553ae6c3ba02927e9d8c616954043b9c6312cb4717a
- MD5 e430b42ec4753ba174928a51837883d0
- SHA1 e7db24c62c397478c952350595b0163890730176
- SHA512 c265ea432ba19032a40f56ad89846193f8ef8132a818cc13ca64e20678a6415c0f9f3e4d7bdba0383d0605cb3d9f433bff9d0e4bfe592951a374b2593825f710
- SSDEEP 384:iL4RQDAxl3SXjOM3+rPrjCOrtZ+IkpscHiMO1umlgLhGPOr:iL4RQMXCWr6IkpscWXChH
- TLSH
  T12E726258AC437593B337D3B90D8A995AF38F9343E53A291A34BDC6546F3405382A6CDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  uvpackmaster4/spipeline/engine/uc_entry.py
- Size 82B
- SHA256 c28afb739667749e89c013eaacdb6f69390b60ec8299bbea8502462988fe7e3f
- MD5 55e22708a386e4565f6490c5550bf6bd
- SHA1 08f6424de91ee10876b4423c4e3baae89b435ee0
- SHA512 dedc1e35ed0a1cb56b9a9708d8cf3572ed69820a8d45ba33fffa53b31c4cfbd0c60c03fd62f46c623882a654649012b9ce2dd8da5a5ebf748073e73417d3d643
- TLSH
  T1D0A012228D16C0A7002264490051D030F1C24212AD50600ABC5CC1000B309B44D41607
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  uvpackmaster4/spipeline/engine/utils.py
- Size 3KB
- SHA256 4cd4334f4c9d71a45992d31e0d5ec06f1cb9bab3c81483a1ff7c83d044c84414
- MD5 2b85a657fe8ebdbe1df7f143edcc2872
- SHA1 cbf5f827a6d15de4c167a516a2817c18ef65274c
- SHA512 48d50ceaf09252a1c0ce7da763d9dce34aed72513f4cd3306c918c65ea2c1064505009bd1fea04722c5a2aa83743483d6c80d09791ea9dbebb417723341687bc
- TLSH
  T1A471C8971D57A611A1BFDA7E0853DA56E72D6B171C3D0203707C82E82F3A011C9F5DAC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  uvpackmaster4/spipeline/modes/align_mode.py
- Size 2KB
- SHA256 cfc1843ba3e13d576810300b95384e0cd3765b578830505fa9cf46c797d5aace
- MD5 a8bff0c90715ed744194fd621cfa8c37
- SHA1 5a279febca287b17a4a1c4290c2d20e8c5bd53b1
- SHA512 39073b5fe191eaf45a438a8c783f3e961f7c99abaae2135ee16aa2b793654852b3dddd90c7b1cc72339f1418d263a4fb0e65d082d7f0ec5c5a47bedf10c4aa5c
- TLSH
  T1BA51860865F29F9500341597691DA8D7F3AF06D3778C818370AE82E86F79BE10352CBC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  uvpackmaster4/spipeline/modes/grouping_editor_mode.py
- Size 1KB
- SHA256 b32aa6d43588bfed437540291106e40a27339f4f3cbc6f03ec2a63d66a39a26e
- MD5 5d26fe48bbfb4ffecef01a0e108ea0d6
- SHA1 c8bf1a65a6923f1cce849916b8932bdd5b7f0b1c
- SHA512 202aaaff5d7b487dabb8f03c51992e34f3e81c673ae9f1413846c9b87eaae41c649a9b4a3963b200c26efa8b8c49fba664d3b27bb792e5bc44fca2d6f6892fdf
- TLSH
  T1C831421B1127567202B009F4A10FA4EAE3152BD3BA6FC082369DE35D0B22F2097754B8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  uvpackmaster4/spipeline/modes/pack_modes.py
- Size 18KB
- SHA256 0298105b71339ef31580ff2df8ac5cf984695697baf81bbba5450a63eb6fafdc
- MD5 67676a59679bbf14152dda756c096ec1
- SHA1 e7a5bb8457d329181d9b348a27864ac4333bd4bb
- SHA512 1aec150c5c9a288ab909357bab047cccbc9bda86b34a4c169e209ce5e08af247665b4108033f6845af4c55618cb503a91921d55a51d524bb02de893810975514
- SSDEEP 192:M40LtG+bLSAnU2Q0/CFq8ZTcshiNbac/R/l/YV3hPBSczp/vjQ4OVa2bzqLTRH7r:iLscUJieP0hVa26LR
- TLSH
  T12F82A5082CF7AD5295B390ECE925684BD76E0AE3A4795643BE7C43BC1F70600D2B5DB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  uvpackmaster4/spipeline/operators/align_operator.py
- Size 7KB
- SHA256 8e7d7128f11c53215c2a922e1c149814f8cc46226592192a7d0e37de100ba909
- MD5 bf7ec9bcbb5569878b12c51a67bf9769
- SHA1 3f278429cfd6b7a5d5978764dc4a5f4de352a4b7
- SHA512 e1b492969587ed72b8e0d214c2c15e7cbfcff66e64d0b9598c53d80ec5cdcb74c547acd05942e9d3332e180835d410b7e32e0c74a2266bb7f9dbec8237cfafc0
- SSDEEP 192:M40LtpBy8hAVD6OvZa+GnyVX0j0NUjrW/hB9itfpR:iLTUZa+GnyVXPN3KhR
- TLSH
  T1B8F1D5CC1D238BA0517543AE681D6492E33603D3F2698681F9AC52EC3F7CE8683725BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32