f4400905b298bdc9f777f331961853283ec204d9f69bb4991352fc0eaafb555f

Sharing

Copy URL Twitter E-mail

General

Target
BlockRotationExploit-main.zip
Size 54KB
Sample260624-mphanabw4p
SHA256 f4400905b298bdc9f777f331961853283ec204d9f69bb4991352fc0eaafb555f
MD5 79adc23babdd4a65bb927416b2b783c7
SHA1 9df38cf7490548e1d6b0da9a16c35bf64c9a4100
SHA512 e85edf91b28afe47dd3595557a6fd776835e9b4397535138e00e0db91c2ef20d280aa8490eadaafe989a2be9ee61e0e05ec332cd32c14b411049dfb69c99d6a1
SSDEEP 1536:hER7jMnxXhw8vxugs2gQHx4/ri4fafgpTdsvPXj3W8:hKM7PxugpU/TfaKTdsnXbW8
TLSH
T19F439FD55A375C02EEE22EFA6FF10F126B2486B9C9418D51B0D18825AF0E04E6B3F1DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BlockRotationExploit-main.zip
- Size 54KB
- SHA256 f4400905b298bdc9f777f331961853283ec204d9f69bb4991352fc0eaafb555f
- MD5 79adc23babdd4a65bb927416b2b783c7
- SHA1 9df38cf7490548e1d6b0da9a16c35bf64c9a4100
- SHA512 e85edf91b28afe47dd3595557a6fd776835e9b4397535138e00e0db91c2ef20d280aa8490eadaafe989a2be9ee61e0e05ec332cd32c14b411049dfb69c99d6a1
- SSDEEP 1536:hER7jMnxXhw8vxugs2gQHx4/ri4fafgpTdsvPXj3W8:hKM7PxugpU/TfaKTdsnXbW8
- TLSH
  T19F439FD55A375C02EEE22EFA6FF10F126B2486B9C9418D51B0D18825AF0E04E6B3F1DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  BlockRotationExploit-main/build.bat
- Size 1KB
- SHA256 07bc373fb2a0fee5657fa72cf8335367f363b4356103fcf4f39e64e9725abec9
- MD5 3977bfde266deaac28089ad30d8199b8
- SHA1 df00274b717f29c52c655eea3b53f6a1b2d4c069
- SHA512 72b6e782d8883ac6d69b0396352ec2408adb29c06cbc31c443476f964115569051a0cd576b7911a1bc9c7c783f67eedea36765eefd8f17ca19b0c494b79199d3
- TLSH
  T1032102A7B28D28B01053409A8E66BA6D3A5EF30BC728FE1D64D240F9C1661A561FC5D2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  BlockRotationExploit-main/build.sh
- Size 1KB
- SHA256 83ddda3c87575ea42c415f3a67a3f5d71bb9c59c384ae56d01e175e3be18576a
- MD5 8961aed7549455c13483e9ce4cac00b3
- SHA1 9e97bc66ff62294ffcc3f011c0167930cecd2c9b
- SHA512 9ac9fb28d057f7796315ef8cf889f76a7b8851fed0428bbdb4b23c53dd1d4b4cb2709406a6f444a6e86e215ff29c72a4a5ea90b944f4c01ebd667cb454d2d0f6
- TLSH
  T1C621AEFA681C28B4110950419D781E512A8E370FE654DD3CD8E2C37DB536B53F0BE4A3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  BlockRotationExploit-main/src/io/github/derbejijing/coordinatecracker/Main.java
- Size 31KB
- SHA256 2ca8c9824a78a58a7b90abd5a0a80e88a6ba7cce273f8a5f8771f7bc41d87488
- MD5 a5db98b82a7a83f3c59abd331246468c
- SHA1 f16d059ccbf6236772382cd6be85bf9fdd302855
- SHA512 12fd106f36cc90c8693b62ebbb638e90371827600ecc5ec42b390aacdd7e1c3b1b119a9a59fa7ea83f452a707dfb8a3ec07725c99e8dcf8b2a1df7edb524e108
- SSDEEP 384:yqNEBaZrM3+DU36qQb9jWJr+2ORjqsihlmqmrVhhTqwG8OmFU6AJRHj1tN3/YqJW:PM6qQJjI3cqsihlmqmrVhhTqwGfDXs
- TLSH
  T17EE2A5A4E7CC85F6097231ECC92986D1CF3E947B69C1ACEBBE8C95901A4A817017C777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  BlockRotationExploit-main/src/io/github/derbejijing/coordinatecracker/cracker/BruteforceThread.java
- Size 4KB
- SHA256 1aba7e8b61e5bfb8fe3a9bcd56de0403e8a7a312481947f3e17c192470f51b4d
- MD5 4aa0fd7180637c30f0f34707d180cbd2
- SHA1 012acbd24f40707007287aeb36487f2b2a218c32
- SHA512 2794231cc096ef0e2b3ce3b8c8d7bc019475cd136933a2e5dd8c240992fcd6a823366c96aab40b3ae5935e5353ad8b8e79724031402c57c6d3e27d1337a76b0c
- SSDEEP 96:YH4ZBrEV+Ujp9Y+XSgr1lDMMjgjaxja3jjRxjK1Rv9gDx6+xYmjd94oMn:YH4ZBrEV+Ujp9xiPjat0jRtcRv9W61my
- TLSH
  T10FA142D6CB8C4817191522B8CE0CEAB9576FC0F6AA501C3B7FDD52205E0642F4A7C6B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  BlockRotationExploit-main/src/io/github/derbejijing/coordinatecracker/gui/ErrorPopup.java
- Size 2KB
- SHA256 2a1b83a77c5fb79e2eb32a6ef9ca3aceed2c8d914ea96992ad25a79f4bb74c81
- MD5 5ef9d7895b7628f7a2939ec2b6d0dd7f
- SHA1 f9b3b6640410009b5c192525f748d9292c998846
- SHA512 0610d6e89195f92f48293bda1c6afde2fd4e1d724df52df1e66bd248b893912670e6b9afda3b6f286b1b71d00a764cbce84f35c16ea1463c236ac047632303be
- TLSH
  T1F241300F874DC6A788B2A3EAC0493A92FD6E44F035526CF5742BDDAC2CE480B41157AF
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  BlockRotationExploit-main/src/io/github/derbejijing/coordinatecracker/math/Matrix2.java
- Size 3KB
- SHA256 7ba33f9d64df2b49d7c6867fd0ac0025a5353f4063a6784bdad6cfe1f030e390
- MD5 7edaa88e041bf562850be7e3fed0be83
- SHA1 5ea2f3d2bdaf71bdea7d60548066efeb1e7bd3ac
- SHA512 93a9192cbe492f1d212939f7f788bc4ce2b5f8b5ee0078c5b3e0b44c46033f11a02cf27a5230b5bddb6f4bf7b4aba1376ba1e98b728805e9f54e8663d3bc6429
- TLSH
  T1CA51904563919277A1073558CC10ED86CA4ED0AF95AE89EFBEAC01F15CC1C2B81BDB2B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  BlockRotationExploit-main/src/io/github/derbejijing/coordinatecracker/math/Matrix3.java
- Size 3KB
- SHA256 e0d80f731a0bdb5ddf3b0aa66fa6674f3ecfd60fe153a38ea066e96c0628b644
- MD5 31b85587f50c4548a8df828489d84e67
- SHA1 9990930f7f5f666ef31ec25b2cd7f9b52226feb2
- SHA512 8a6720cdd3451603d497f93e31d90ce99addf50368830efe903bf6185f56ef9af80693ed1c862db4746802f1ccf67e1ad777477f13829da0a1a1cd9580ee4b11
- TLSH
  T14471AD8967919537A5433518CC00ED81CB8ED0AF94EE99DEBABD01F15CC1C2B81BDB2B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  BlockRotationExploit-main/src/io/github/derbejijing/coordinatecracker/utils/MathHelper.java
- Size 3KB
- SHA256 e2c52cbcaad1780969b654b823bbd09e5701e41fc29fcad6bd980d906cc6cf21
- MD5 91c3b82b04b8fad545c0c562a39b9608
- SHA1 9e786a11800635b3d2f58acfc7487c0f269728b1
- SHA512 325297ac1d8d977442fa572ffaf1c2590fd71681eaf49d2f102a8720831098788e7594af4f45aaa4e6e9eb7e079b1236a502c9ba80c735f7dcb7f7c451e823e3
- TLSH
  T16B61F34023C2D513666BA9609D687A53D6FAD0E697BEB4D9F6EC00202F4181B937CDCF
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Indirect Command Execution

T1202

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Indirect Command Execution

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20