e116997cedfd5393afe290a92ab0b2b3a8d6dfbe0e37502e4314c565984cb7d8

Sharing

Copy URL Twitter E-mail

General

Target
LarpLedger (1).zip
Size 165.7MB
Sample260624-egekssh15m
SHA256 e116997cedfd5393afe290a92ab0b2b3a8d6dfbe0e37502e4314c565984cb7d8
MD5 eadb908f3415d542959be92f010772f8
SHA1 706562f88846e4780b500bcbcfddb3c3702c4636
SHA512 849ebc9f171186b1bb94b4912b0ca3046030babaea0a6250063d52fff17dc0ae49fc7a9283de271c995208a8a2c13f168268485d06a2264632785f9db236b7a3
SSDEEP 3145728:wIElLRlbsSjkrLRdtxXvfmwgXaEu9VFM4nCtvNicNpy4HLb2txo9wMBtlm9qE7:JILRlbXjk3Rd/XnmwgXaEmivNdy0fr9k
TLSH
T1178833EC42A252B2C34D016F88C687FC271949B1F9761B8970BC6391B4DA5D9CB73EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LarpLedger (1).zip
- Size 165.7MB
- SHA256 e116997cedfd5393afe290a92ab0b2b3a8d6dfbe0e37502e4314c565984cb7d8
- MD5 eadb908f3415d542959be92f010772f8
- SHA1 706562f88846e4780b500bcbcfddb3c3702c4636
- SHA512 849ebc9f171186b1bb94b4912b0ca3046030babaea0a6250063d52fff17dc0ae49fc7a9283de271c995208a8a2c13f168268485d06a2264632785f9db236b7a3
- SSDEEP 3145728:wIElLRlbsSjkrLRdtxXvfmwgXaEu9VFM4nCtvNicNpy4HLb2txo9wMBtlm9qE7:JILRlbXjk3Rd/XnmwgXaEmivNdy0fr9k
- TLSH
  T1178833EC42A252B2C34D016F88C687FC271949B1F9761B8970BC6391B4DA5D9CB73EE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ledgerfiles/LICENSES.chromium.html
- Size 7.9MB
- SHA256 6bb288835bc59b4550338d8034ef8fb9f05714e890ec08c327149c82142cb4ea
- MD5 d5b1f4d67bbb923ae30f5d5ac424b269
- SHA1 e751270f329f8f5cc882e615157891421f569c79
- SHA512 b8c5ebcfabf56c85467b27815d7b2cbb0ff922a5bf08a3e619772644fb53049393134d17a849d3191a29b6af1218feed32895bf26c7b77cf3ef0178552ccede4
- SSDEEP 24576:dbTl6Mc6T5kJWSSRKb+oFDwmfL8646a6N6z6fkHuVampem:tGBAA
- TLSH
  T16386942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  ledgerfiles/Ledger Live Beta.exe
- Size 155.8MB
- SHA256 76151bb3449ee759a4b92455eb960dfa083ab2b8c97fa597e1e3735def8ad60a
- MD5 91b1166c8e4ad4f8c915c2d72150b3fa
- SHA1 44bf4650c1021768567259d3ca875988440022e6
- SHA512 ea11cf8c278b0f7901c56e567ddbc0cc2668f4061c5f80eed2c7e9c6382a2ded9e0931cf19448db2a336a2b57d1aafe54b256745bb46ccbf326c5bccbd740d7b
- SSDEEP 1572864:K0QRq/6WEq928PO3ra1xU3xIv6wlWYkkVSIqnpvJzeInOVHZCW1d8tlyW8ZYgg0F:Xq/E4/NIiIP
- TLSH
  T175788B03E29A11E9F05DD1B58B578636EE72B8460738A2DF275407562F7BFE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral5 behavioral6
- Target
  ledgerfiles/Uninstall Ledger Live Beta.exe
- Size 170KB
- SHA256 ca9332565efd821e52f4a2c674ec19286b82b616313119d8d31902efd50b5bff
- MD5 7c59bf6939fd11c83ed7969d164dd548
- SHA1 e8a0836adaa4c8a780848bf1cbaed50b0ca5443b
- SHA512 c2e1aa751dcaf8656c7d923e499c42023d59888cdf0e9b47b17c738e7781b0af3f955de871b1025c186d5841ddef9dc880a4656e7bc780168e90cb1743f34e84
- SSDEEP 3072:kn77v00hEoDEtauHMQgf2X1FaP1zaHfMNUaq2tvhOEA1RJCir86SrSrvrRbOa3E:k740I4f2X1F8eSUaq2t0EyL+2iaU
- TLSH
  T13C040114B7A0C523EAB64F7147B487971FB6F52469384F877B8023AE38A2790DE2D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral7 behavioral8
- Target
  ledgerfiles/chrome_100_percent.pak
- Size 132KB
- SHA256 99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760
- MD5 443c58245eeb233d319abf7150b99c31
- SHA1 f889ce6302bd8cfbb68ee9a6d8252e58b63e492d
- SHA512 081f3ee4a5e40fdc8bb6f16f2cfd47edde2bd8f3b5349775526092a770b090c05308d4289ecdda3d541cf7f0579ac64b529930fd128edad9b0991dfa00b0e9bc
- SSDEEP 3072:bKzwJCcIe4woKmWVlBL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:bKzwjIe41KmWVlNK18Gb0OV8ld0GecQu
- TLSH
  T136D3D0E3B3F4EE7DCAA715B7A61500B1ECF3462917A1434A074BD8753A26788D8C8793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  ledgerfiles/chrome_200_percent.pak
- Size 191KB
- SHA256 cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4
- MD5 81b5b74fe16c7c81870f539d5c263397
- SHA1 27526cc2b68a6d2b539bd75317a20c9c5e43c889
- SHA512 b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80
- SSDEEP 3072:A4DQYaE/N6gbrvy/+JPnKmWVlBafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+Hxf:A4DQYaSN6gnvyWnKmWVlSgx5GMRejnbA
- TLSH
  T12214E1D7A3B8DD7DC9770AB3662501F1ECF215395AB6520B13DF9C353A56B8888C8283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  ledgerfiles/d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  ledgerfiles/ffmpeg.dll
- Size 2.7MB
- SHA256 5b59ea0a14b7046a142dfb4d45870c609d6d7fb4bff0471221430e6aad07814c
- MD5 add3b8680a0f25ecb7c130a1456644e2
- SHA1 35bba3989734e0ef4dc6308f6e974c93cfeedacd
- SHA512 b0eb14c3dc726406fd339be6ebee8351f2147680b16b81ac3885e0a1255245be51d5535614301fc649f7367103bb6082e4a1e0f192761666ec91ae563d70a1d2
- SSDEEP 49152:PAvA/y8/iOxDzztaebBrkNI/CvAA/hTUvtkRhlweQ/Okx8VpJ0UKN3lzl3hRcr3r:Eoa0eqCzQ/Okxa0Ufb
- TLSH
  T1EAD5AE07F6D640D9D029C174869FA233F62134468B24A7EF1B909A252F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  ledgerfiles/icudtl.dat
- Size 10.1MB
- SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
- MD5 2134e5dbc46fb1c46eac0fe1af710ec3
- SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
- SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb
- SSDEEP 98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
- TLSH
  T1C4B63803A2FB4EC2F9FB6F31D8F452679567BD496E32805A01042F3B5C336908665BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16 behavioral17
- Target
  ledgerfiles/locales/af.pak
- Size 381KB
- SHA256 7bb75adef02d28819f1bd3b42fa46ed56d6dfbeae072341997b09b8c1f52d8dc
- MD5 b293cc5ea7db02649bd7d386b8fa0624
- SHA1 32169b9d009b7a0fb7ecdaf650c989e956291772
- SHA512 496bc72e7b798d02e453eb96d20566b91405bab774521527ef882c1fcb58f25e2d0718013ddc0d23f7fad883f4cde93b57c6caaeba8cd18a09665c9f6245f557
- SSDEEP 6144:qu8SyRtgbfbjR985DhdxQ+ICGSBsjA636Zi2Jynq4UtUKnpgmhqxox7sfxSC2C8l:Ry0zbjREda+ICTsjA636Zi2Jynq4UtBz
- TLSH
  T1EC841B0AD784273D09B07696BA0545FBBB9CA26CD770B2B6DD9D823305A2EFC017D1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  ledgerfiles/locales/am.pak
- Size 619KB
- SHA256 1974de0984976556288a4612d5f38fe0ff21e868bdd877ba5d5fde3bb4c9e36d
- MD5 d3f48b60620c5bbe519db9c0cfb634de
- SHA1 7b54a0bf25b2ecfd78c2ad7dfb6f6a09bfd20abc
- SHA512 279a7c162e53b2d4e7a92a57de3ce3c919cd9a9700595af6a26ebc53f925773127656b2c817e91cdead87c2b1f5dc00bb0b134d6d51cb083149d85598a2d5b85
- SSDEEP 12288:ihHb86uogj8xST1XF/gpwozVgd529+1VJ7uYyPJx30jH8+A:MbIj8xSXFopwozVgd529+1VJXyPt
- TLSH
  T146D4BA547EF9F7170F8E8A19A4310E4E9594AD4652913C38C35AE3FC2B2EF1B4DDA218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20 behavioral21
- Target
  ledgerfiles/locales/ar.pak
- Size 680KB
- SHA256 da3294b3c8cd12000a4fc6610618a96b82d1ca67a764fb6387c7edb388b6c6fc
- MD5 0ff7a127ca01498e946394aad3648674
- SHA1 a7ae6aaeced53b096a8f3005c666fef3f1138db0
- SHA512 088e210bd15a63f32ed52bb844e25bb6f16565e92f45a6505ab8831919e70369069592840af84ddf6a6dfb816f944264a976824e49ce5643c817046418c4ed3c
- SSDEEP 12288:FUrROt/9FlOX8vYU3X1YKk7Mm5MNi/+dTtq3zMgSENWI:HbwbF5F+8
- TLSH
  T180E49CE21B2984720B92DF0FD1E23668E872BD23DB4BFD3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  ledgerfiles/locales/bg.pak
- Size 706KB
- SHA256 571e87f9c62cfea2a2303674f93ba879d9b899afce4dd7e47ddf5e6781b7d4a6
- MD5 5f629042a1c501b290eec5ea3fcc6779
- SHA1 d6b304838630bbbb375c21a0e6de3e1ea600ead8
- SHA512 e30f92453bed2dd0cdd5a2a2f70d1e240e983b0a65f056a9623295ed01e9a87869706fc4acb40cb79ffe7c60f5121a95893662c1d0299c0a585b8ab75888c14b
- SSDEEP 12288:ADqWwQkDdLlYMdAs1aQUtjtaVVnFH2mFxadnra35rKN3yoSiVD1BbCeSKn/xJfuk:ADq/DBlYMdAs1aQUVGCa35rKsoSiVDDv
- TLSH
  T1D2F413A15B9A689F0101F55F98087E093CEB84FE3FE7879241642DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24 behavioral25
- Target
  ledgerfiles/locales/bn.pak
- Size 911KB
- SHA256 28e1441c4950a90717ebd0641b1f0b4a087cbddeac39edb2618b7d24fbf5a58d
- MD5 35f1083544e86bb85fe5860b36b743e2
- SHA1 27ad8b23fc03f9b26eb5125e886d18ee3798765b
- SHA512 69fd40b1d1ffab122c244a7111972fa8b2d6b38c595acee8c6b650a595eb756c35f0cd774d8a7b79656258ee1dca9b6fe0a72e6bc38901804e62ffcf9976ae1c
- SSDEEP 3072:MtVVy6YHuQ4qxkVxCp2tUkbBb5OMDK5T0Xl+IP:GVVMH5ECAt5Bb5i5clR
- TLSH
  T12115EE209C6E91B2A8D5CDC9434C6370C1236E9B9B61F34DDC17A25938ADC3C8DADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26 behavioral27
- Target
  ledgerfiles/locales/ca.pak
- Size 430KB
- SHA256 6cf25816859b95a5ba7b50578c14630105aa5c078338a4d67f15df0aab58233f
- MD5 a69946c79799dde4ead4ee6f27d7fbc4
- SHA1 f304240b57df781eb38eb3968b8110db24f18de3
- SHA512 169a676cdc1efa5700f8f472a9c0f784dcc7d6215c4ce348a0fc91f3c0dee6c512aea02967051e4daa880ace00cbf2fb9def032590f416ba9f6129fe30df3957
- SSDEEP 12288:q86RFXnMh7nyRhIs3cSlFEYLCJBqB3nbhjJOtJuwlwSGMwFdLbpuQ16BtryBtwIU:r6c0RpTHpEMNJ82kLI256xte
- TLSH
  T1A4940A238BCD3B7744D2320AFB46C257F08CA9847B06D254F5AE1B1622CCADCD677A95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28 behavioral29
- Target
  ledgerfiles/locales/cs.pak
- Size 441KB
- SHA256 60cad724b1fd9820fa6ed7278b61e65a410255abb0335eec2e5195147e827939
- MD5 f311807c2f5db6fbdd8f513f660be938
- SHA1 f5ec379b83e530e67ab44964e75aed409984dc03
- SHA512 8dfabea5b46d550877bdaebebbd0891b72d47805396de827b10c30ce13545ea260d6b22eb653e13b215d9581e3da8ea20e52b5dbde2f0767bd75e1974606aaaf
- SSDEEP 6144:YqAKv3LGLBP38QC70wXaNA2MXQC5t8VNDKNDZs1X8Qb:bTYsQa0wqUXQC5t8VNGNDab
- TLSH
  T18FA44B1EDBA36535494002497BBA5228AD1E83540B6FA5BB7CCFAC82217177ECFF4D48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral30 behavioral31
- Target
  ledgerfiles/locales/da.pak
- Size 400KB
- SHA256 d4d8ce557a333310ff0f59d6225c41cbde396fccf0872605252425a917230894
- MD5 4bfee234ac9e04fe60d97f67f881ebb1
- SHA1 bf2b676c6268580b179fd9716d54cd7fbca36334
- SHA512 af91c4c890625011ddf93048f84ce11f267b72239b6eabba8be3673585ad8e595338ce7b91962c18b81f9f6b91e2c4c9c0fd2136894022cfdec47536b58ec2c8
- SSDEEP 6144:+/O3LZ82jZAsngwlFkuJwZjoEbUSovDHv50Sr+zOUPOd40TWwr:Jm2tA28otR5DrJTD
- TLSH
  T1E3945B4BCC9D332FC9A94B65F2108DA7EB5D943CC680264F75D8943A0ACBD6093BE1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32