9bb9452ad6347f45898537011ffdb8cf9e9d415ec91daf062a0ffd0fdef7ec42

Sharing

Copy URL Twitter E-mail

General

Target
Scropts-QOL-3.0.8.zip
Size 1.5MB
Sample260624-ds91eahz8p
SHA256 9bb9452ad6347f45898537011ffdb8cf9e9d415ec91daf062a0ffd0fdef7ec42
MD5 07eb5db1b3bd45118ec0b54ee9436752
SHA1 5f690204ae76bf6f491ad77aff21955b106645fc
SHA512 4a11c1a62f50bd84169abc40f9bdc1d48df40d13c797a1c5c9fb9e6084048f1cfbeb3d1e26e4d1291c651e271f5fee7f4e3e5463a843e76b5f62a055a65107cb
SSDEEP 24576:Ed3PkwLr+56vWTokuKIZSRhE7xzZ0Sr9KrEZQDxv3IvI/3OxWEHLokEbA8UqJMnd:Edkwr+YvWUk19ExCSQ+0OAPOxskH8Uqi
TLSH
T15D6533787D6622A7D5733438D936B713CB25A22FCB9C7EB804D43A61C98684C2B145EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Scropts-QOL-3.0.8.zip
- Size 1.5MB
- SHA256 9bb9452ad6347f45898537011ffdb8cf9e9d415ec91daf062a0ffd0fdef7ec42
- MD5 07eb5db1b3bd45118ec0b54ee9436752
- SHA1 5f690204ae76bf6f491ad77aff21955b106645fc
- SHA512 4a11c1a62f50bd84169abc40f9bdc1d48df40d13c797a1c5c9fb9e6084048f1cfbeb3d1e26e4d1291c651e271f5fee7f4e3e5463a843e76b5f62a055a65107cb
- SSDEEP 24576:Ed3PkwLr+56vWTokuKIZSRhE7xzZ0Sr9KrEZQDxv3IvI/3OxWEHLokEbA8UqJMnd:Edkwr+YvWUk19ExCSQ+0OAPOxskH8Uqi
- TLSH
  T15D6533787D6622A7D5733438D936B713CB25A22FCB9C7EB804D43A61C98684C2B145EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Scropts-QOL-3.0.8/.gitignore
- Size 43B
- SHA256 1b638a714d53225847cf6359151727f812443fc00a5cb5a5c1271b9ab016f7e2
- MD5 1fb017a4421573b1d5e5773e69e8a899
- SHA1 b30e42f10344e441d3e7262a14ce4e2742c0dc9a
- SHA512 7e48124cf8e46926e0c85cfe23c556f2fdf23185b1367f0a8883aa205033dc6678e03d5137fb8bfbe01408f9773da8fc1273307d7da0eed88f90fc0111ded7cb
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/FontAwesome/IconsFontAwesome6.h
- Size 72KB
- SHA256 6d22c1c0a8cff8ba06490951105093bd401f6d6eb765fab767081cc968b6c2e9
- MD5 d311a1828128952fda4e418b888482e0
- SHA1 6eddfdc54a6941773ae318bc90385cefff2c7214
- SHA512 586d4e88ee187f1fc1ca9979113e3e77526ee5cb7cc7c7a0fa8e4ee3846728191ab794ce03f10cf83b890ccc0fea482ed30f6b42effcd88606c361a368528b2c
- SSDEEP 768:0GG5/jz614mysNAG48tzVIMHhsKVEqJdrf+DkRR+Grg:0584xEvtDhsKSqJdrS
- TLSH
  T19C739BA109E3B7DE9CEA0417897BDD9166D6C823848458AC74A7CC2F2C406BA17F57CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/FontAwesome/fa_solid_900.h
- Size 1.2MB
- SHA256 e36daebb6288c575c6d32bc6af4be692712f49ea0d21eab40bc380dbe31e6f75
- MD5 188ab8fed971824c0b0303971c450f5d
- SHA1 2f3940d27129cc81ca29f5933aa9cd80ccad50c5
- SHA512 750553398f6e3eab046f475483ddc6345167dc60da29493da3474f4686eba71108cec92be2b826081d73c921ee544e461d12a31dac31f1f9503b6c99d444bc35
- SSDEEP 768:h+mBxiIZRd2/LNzdrUfrBzB+BsBmBNBJ3ZD+FDWP5BmBC6RqOCBiV3BfKVN9B9dG:gdZ/K
- TLSH
  T1FF45C0E9B30D65D9284B377CC7418853A6C8B93105B2998EFA9EC76EF5DF80844B172C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/FontAwesome/font_awesome_5.h
- Size 92KB
- SHA256 8cc251b0e49d744ba620e0102c09730ab2def91cd144b0cf084f18ba95a7a5d0
- MD5 671322994555b0227b33aa10a921d956
- SHA1 41ec5f675723d035fd392ba44d75768b61560478
- SHA512 ddc142d3c6074dd8754ca6d25a4f84d96c5a6adb50741f25af85bb4a32d08b8ec87d0c0722d6fcc1e0662111c38c524c12a87e6e8ea0d6e410f1282ba6158ded
- SSDEEP 1536:rwXEf8Kr3NaGcoxAheXho1uGaHbJpOv8hfgdrhToek+:yG3QG5xAheXho1uGaHbJpOv8hfgdrhTD
- TLSH
  T1E69346640993A7DE9DEA4516897BED8166D2C833848448EC74A3CD2F3C406BA27F57CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/ImGui DirectX 11 Kiero Hook.vcxproj
- Size 11KB
- SHA256 d3a26e0dad7ab6cd5a2b5a2316f823c3aa33aacc539f81e0aa676d7cd4641353
- MD5 3cc3c1f96daace55cc203e98d85a0ac7
- SHA1 07e89bfda2ff9628c770375d1fe829eca72deb88
- SHA512 94385c5353866643ef9276d895abe60c378cd4f682663c69109993c5e94480636a98c32f4c75ce5eb5ae100f8c4de657912dc2214831619ae1e9f0b1fe2f986b
- SSDEEP 192:L/zciV1PZ1PsZPyZPv/nPcQ/nPcY/nPcz/nPc4XsR:r42/Pz/PB/PY/PzM
- TLSH
  T1F5320064D1F81E4A42B34167A3C7DD45DE21B3C3095A8C68B69EA39B9BF75083123733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/ImGui DirectX 11 Kiero Hook.vcxproj.filters
- Size 5KB
- SHA256 df0ec2f149179fda90af70ee5f82fec7fc079885c06e086e8661119b452fa29c
- MD5 ed8be5d650719c58e41771336d7f3550
- SHA1 33f5d289f6829226febc6a9b7ccb6fd444431df5
- SHA512 9f394d8fe792d58edd5213ffd9208c3fff2c3db7d045b1dac9ddf2f1ceecc2b34410bc777ddd99af46eff37c4ad738b77a9b3155932fe04bdcac99a05fd5daf8
- SSDEEP 96:AzdWys2ldAD4WHX4Hfh52xjxrS8l3gFRxDuiRdMIFjFr1LW7Et5:/ys2dAD4WHoHaS8l3gFLDuiR/uEr
- TLSH
  T1ECB1A131D4FC1E8C203309A7FB94DE02DE28B3E3505642997AA9E587BFF3509D217269
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/ImGui DirectX 11 Kiero Hook.vcxproj.user
- Size 226B
- SHA256 7502faf26979fc3ee106ca7ab072f9b1666cf912f348482ad7ba7a1bc0b64a16
- MD5 562393f574bf53551d552a7b4b535afe
- SHA1 9de3ae3883e70e59b12fd754aed2b8ceb2c6942a
- SHA512 067e51fd745a458aae82c5b1001d751ef24e15f099255e3568d771ced4f0ec2e535825b6e97e138cac63e1dcf8fd09e3a4487d6bf71d2d87d8df79d5683a95e3
- TLSH
  T126D0A7104540B42071B417349358D874E2E2A6A310B04898F7E0E40D111605960163B3
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/Scropts QOL.aps
- Size 1KB
- SHA256 df6a25ef22a7a2e425f4d8afb0a62f19835c6641ee667fcf37cba979ec93391c
- MD5 ee403ef7cdb7d3c6ee1a30d82cb8adf2
- SHA1 bc2a33562b6ffe708ee82aacea7eb20897f473c9
- SHA512 5e18908ea747f62ff92067ffd86347a309630685f0bf22113859257b7a7197686973a5425605dde9960d3abb973dba02be834104626465181d98532ec3764d02
- TLSH
  T16E213A06FBA5E012EA6F657205A9ECD35A61BE144A598F2E30C0232D2DE344F5C11F3A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/Scropts QOL.rc
- Size 2KB
- SHA256 c08a06d9a7a69bf8f7587b5b2c9b9886aec434177e4e02119ed6b8480ee59449
- MD5 8aafa38c8f6ab3317771ea8c46e3111c
- SHA1 7ea6117fc32ac4c90947d7bd09e7dc4ca1124760
- SHA512 d8dc53c3f32c621afde7d342e88cf70ffb0cfeb7804c9e3a746e59fa8984fe69fb12d7d3544b6b486a6c7f35403ee3b3dd43cacab6b7effd7b276dc72ab74279
- TLSH
  T17551705332E91608B2913B9C0F7E94788B163B51457E467D06F9168A0AEAF004AD97F3
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/Utils.hpp
- Size 7KB
- SHA256 aa94d8527401861bb9853f5e0af7043d0b4ca89623df5648694398f48956bb37
- MD5 82925152076a993f763605f56387f073
- SHA1 91cd8e67fc8e3308527a80a6245c0594b8d62219
- SHA512 828cc51c1d5be16e7026086e9e02f59a578a3bb9b238df4750043a2b0ba2331c484686235842ea139af7fa2c3b184c690f34864850513416ee8eaf6f995c0aaf
- SSDEEP 96:ACboMjfjVewX1dj+gvdWX/vauGPoyOmOJxKg7eyBYuXc9Noa:pTJX/dWX/SXoyOmkxKgTYuXsWa
- TLSH
  T163E1EC81B66FA90F1BA111645871144BEDACE8B3537A46F5F4CB12A8F0F6809C7387EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/common.cpp
- Size 11KB
- SHA256 685f0aa7edbd72ee83b0cea675386b7e862f48beee884731839d060ae5d5d718
- MD5 9e5ec3eda176b14b0bc222643cd64f60
- SHA1 fa44728b6ec2419462f0cc8626f6b774d750f3b4
- SHA512 17baa570fcfa1b59b35bb6c2d6f31115c9e2e684d474f35411d65360e20792978606e611fdcd7ac5c5fe236422f142b9fc8fb5852bce2aaadbb6921156c5d407
- SSDEEP 192:0uJz9fjGGSSGNUFKH+Phi7UfLlIX8QlbVqgFmJU2xLMsMOejkQmttmJ32xDtGnM:0uPfjK+YUfLlIX8Q9VqgFmJU2xLMsM/0
- TLSH
  T1D432FE37EB004C91B47F9196E68D4090FB08C35FB67B3D5BB478918C9FBA81590C9E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/common.h
- Size 22KB
- SHA256 9ae0851e9a8d03dd4dd2c4a70a1aa7756b29e614e655ac36ff0302859e6366e7
- MD5 8c763c55ae9d0a6503f5d8088a6b06d3
- SHA1 85c459e14f7fb8a16e68cb02f033e0d7425c7602
- SHA512 a7ad5e8a446d23b71410ec2287121a75554e422975a07362b69f20f08417f94cd69713c3b1e52fa013e12bff05e962c62e6114bb9b5dfb0d2bd71b69d558a9c5
- SSDEEP 384:JrGzrGIR4s2OmiUlu8iFLgga9e8XKLT4QUPKvqc9o/KL:sWS4s2OpUlu8mLgJBXaTVvqc9OKL
- TLSH
  T121B211206025C4EC88F737A1B54206F5CD4AC0B079E264B1A75DE52A0FEF5C6D13BAEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/crc.h
- Size 20KB
- SHA256 2484074de0db7e28a6b4bc42dc4bb4be7bff101ae191d8180d4cef6bea972c56
- MD5 745e642a68166f89f38b3eb7376c09d8
- SHA1 21de018506e3c2f295ec33ac92f3bce26db7a8b5
- SHA512 a52fe7f7f7f26db6ae69f9a493ef6f9cfaf1f4385c7ac83290e69fde1e37f1279b9674583d458ce882a7aee93928b156f86b705044e5d4caf5ad5027b2d5d658
- SSDEEP 384:kIDVUh+6xF4BKsMPue9VLma0M6MCrEADZU:3hz6UE179VLma0M6MCrju
- TLSH
  T1BA927A1C024BADE6016852ADB2253FA671ADF3C6D1F84189B7E35C60028E37F517B87E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/detours/detours.h
- Size 38KB
- SHA256 e1ee1e61a42c6c16838ca589487be9897763ba72e91347583ec8f7855c5d4857
- MD5 aace11cda646662322d19a8bdb7e341a
- SHA1 f71202e3cf76ab09425409c4a236f693c73269cc
- SHA512 dec581c63b065a747d75b73bc8da47943f1fa5cdbb8fd1c52b6474b7516a5efcf0c3a08023a46f507d2db99d9ddca957e5e324ca7fc8d6d24f4cde13a396bcd8
- SSDEEP 768:qhr8OqhXPBC+nKSaknHZJILZ/7iufeV5CLO9WorhzS7:ThPBC+nKSR/4/mwGhzS7
- TLSH
  T1FF03A630AC9430D1F5265CA27A9DF429858EC9232E66D5B0389EB6554FFC20832B67CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Scropts-QOL-3.0.8/ImGui DirectX 11 Kiero Hook/detours/detours.lib
- Size 672KB
- SHA256 e7904c999ee64a3440606beaa7dadd47db9b71b4fcca424dc3a9cf002bc147b4
- MD5 be636b13b5471886bc5a74233e76be54
- SHA1 323ba980c2f1919ee61aa7f1bcf52085847a491a
- SHA512 924af22292fca0bb6080e900de42b2ebeec278007e99d4f0324b8a0dc5fad03e3a577aff43f51aba894ecb80b5f61972a497e66318b617da20300ba12e2ab000
- SSDEEP 3072:8wiXyQg5PEach8GeSnXfL4fvxNu9oP7OLch0innT0K/C9oZvdeXwYgybIjNmNIto:++tGeSnvwOaasvdeXwYghcNXbiSgje
- TLSH
  T170E4C7A2FAE4CCD2EE38C174C257586D73B6F1492672A3033399116D6EE77807E1A391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32