dfe65c82d3c6e5b6246c3865111e0ad3f8eab7e2522965eadd7a594aa4e8dc4d

Sharing

Copy URL Twitter E-mail

General

Target
lol.zip
Size 7.8MB
Sample260625-1pcxtsfv3z
SHA256 dfe65c82d3c6e5b6246c3865111e0ad3f8eab7e2522965eadd7a594aa4e8dc4d
MD5 b8d0d1a66ec94a47570c73e00d56edcc
SHA1 1866e1abf29d4753d132589d1cc1c187b3df0dcb
SHA512 52c8a40e7a0cea0747d0bce00b785b219bcdb31f4544db6d75bf65e73801571594ae28e33505d5e8f4c51f1eb202e0d17503d869e252b4779c010fe01f1b7218
SSDEEP 196608:eS19/QCUPsDWpiXGHv/EplOei5M+laXTeDBwfgzc1S85LILfZu:eCpUPyopP/KljIAXqdv4S0YQ
TLSH
T1928633BD316774DBFBA7FDF8A33DD2586226A89161700E2B2E2981D70D035DA017DC98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  FUCKYOUp/FUCKYOUr.py
- Size 276B
- SHA256 252fcfd9293d200920cf05cc922886043f7a6af057aa6e937045d921f31eb38c
- MD5 910967ad7ec976bebb17562bbbe99a13
- SHA1 b652d7d191e383f53b64e1dbb53f0b1004752b49
- SHA512 b385b58f086829faec3b34b22021391bdf7bc4e49b6c8dd231759ecb420a3567149d3a0eebf7f42993cc33cc93c5cdbf048ef273cdb7f45d5c5399f3d3f25c7c
- TLSH
  T103D0EBBBCC19CCA2E60100014B0AB13C8BABB60790A3D0E049E2828ED0EC0B42B07283
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  FUCKYOUp/_asyncio.pyd
- Size 63KB
- SHA256 6e25aa5931f175b971dfd05aab7a24cef29edd8f4b524341c414d0577c07a200
- MD5 0400b1958d0f7aa0d2ad409ea12ffec7
- SHA1 ce1a5c61192ffe489a53f029ac0a95d4abb3d2b9
- SHA512 8790f3f9c69823d55350ea63a1b8ebb3dad64942b6e6752109d2932b3bb848a5101e2a9a4645e93a476a8c4e5c8b27e15eb39b33fcc772a876b0e8ab9fd5eefa
- SSDEEP 768:YVtJbo/5NQQQ2cA27ZKky1qSwr2ysMqBOf/nLeuK1P/dIIYn8sKDG4yMhb:YFborVdW7s1qx737K1P/dIIYndOyQ
- TLSH
  T187536C46D3808291ED6791B8D8B31F56F7B2F1406B00878E526CC29D2F5336263FEE69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  FUCKYOUp/_bz2.pyd
- Size 85KB
- SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
- MD5 a49c5f406456b79254eb65d015b81088
- SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
- SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae
- SSDEEP 1536:eKpLuz7t0fjOUSKdvOKJbdV/qj1M9D8WAPpP3JuFIIMVRy7:VizTTmbJJV/qj1M6WAPpP3JuFIIMVI
- TLSH
  T1A6839E92F3A056F6F09BF27596614347E731B8094390D3BFA2A8424F2F02B917D6971E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  FUCKYOUp/_ctypes.pyd
- Size 124KB
- SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
- MD5 291a0a9b63bae00a4222a6df71a22023
- SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
- SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09
- SSDEEP 3072:psrzScwzPzuoUxXVxQXKIAqoFQufLTA/1mj9AItH5IIBPmQl:a//wWX8XKIABfLTcmXlyk
- TLSH
  T130C35B1B735800EAE6674178C5B35E0BDBB2B411072087CF0264C6AA2F637E67E7E745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  FUCKYOUp/_decimal.pyd
- Size 262KB
- SHA256 30eea56a4d1dd78f9d65fcb6168ab189cfa8098c38aad47ee770756a056749ca
- MD5 a2b554d61e6cf63c6e5bbafb20ae3359
- SHA1 26e043efdaaa52e9034602cebeb564d4f9714a7f
- SHA512 5ea99fa23e7657e9f01dc155741d5f93945a2e6c90f1494873aa7c35a8da0001815b31b387b239ef7de1695b8f416028166dd94db259d246d8dc10a37e20da97
- SSDEEP 6144:OLYg4UlD9GwglHVbM+J3OFBwsgW8w9NoL+Tv9qWMa3pLW1AHGZJXOSRQOGONHPj1:O3lD9GwUVZowsgWP/oL+dAZBR1vjYM
- TLSH
  T1B7445B56A3490CA4EE738078D95B9B47E7F278940360D7CF43A48AA72F53792637E348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  FUCKYOUp/_elementtree.pyd
- Size 175KB
- SHA256 00d68d3879ab410601e7e8fb2348d4995cec2ee78b3a07ea59520d35f9953bb4
- MD5 8216378d8e15d65dbfcb7ba68bbd923a
- SHA1 91e3a9a89c236d7018854f7f163bc291a46397c2
- SHA512 2610324ae9510b68745c5500e7a99366e5eaa0a935a43eb951dd78789772ded6cfe9581b6108540a5cac9f848173c9375ee6fd91e40cb6a982114905f7cfd578
- SSDEEP 3072:RYsocTfzwonX/c4J2nK7pz4Km+lT/9IO00FOlekUhkt6D98m+8o190vn1IIkfTG:RYgTLLvhYnK7pz40bIOpMPC+um90vn3
- TLSH
  T180044C676160D0BBE8A3803CD6668B46EBB3F8A4070093CF0294E6BD6F677513D5D369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  FUCKYOUp/_hashlib.pyd
- Size 46KB
- SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
- MD5 5e5af52f42eaf007e3ac73fd2211f048
- SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
- SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd
- SSDEEP 768:E0mbG0HUxzB7992zIyYsw3jYXjV4h6HgevWASdIIYIASDG4ybhMD:Tma00xVMn08x4EBvAdIIYIA2ymD
- TLSH
  T16B235B05A34104E2D87781B8E4A24F57DA71B5505311A3EF93A8C19E5FA37D333BAF29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  FUCKYOUp/_lzma.pyd
- Size 159KB
- SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
- MD5 cf9fd17b1706f3044a8f74f6d398d5f1
- SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
- SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a
- SSDEEP 3072:LIVa3V86CLON9lUm+/3i4p9qZqznfY9mNovvFOhYIlLvyFIID15x:LIVa3V81LwlC//q+gYOvPIBvy7
- TLSH
  T1A5F33996B390F4E6E7328C39D6624F17E7F578190320929A01CD836D2B1F7659A2E327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  FUCKYOUp/_msi.pyd
- Size 39KB
- SHA256 52f3adf011b2e6da14e0ae5d13637d35f98951d0c0077d3b4a70ed514dc68b6b
- MD5 db20799923c444311ff09eb3b8b0f5a0
- SHA1 494aa7f512b1803668d54edc2e7ed39d331fdf81
- SHA512 648c30a173d9d9e1cfced74c777d9116aeab4d0f25d5d8f6a9fd0fc0b7c4c430822bac17ab8a505ec55978e653cab9efc63fe4ab9fde40f7ad71415704245aee
- SSDEEP 768:b2uXan3nSr/5LsAzGqKVW4q6CwxoUAIZdeoLuMl6QUtmFIIMGhDG4yMfh3:PKijZVKVW4q6Cu6QLFIIMGjyM9
- TLSH
  T18D035E95B34C04D1EA2B813952935F26E970F8210760D2DF53AAC2AE0F173D2F63D7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  FUCKYOUp/_multiprocessing.pyd
- Size 29KB
- SHA256 54c28dcf2f2a72fc854f49c76fb021bbf2b53675fe5b5ed021c61efe9467197b
- MD5 5cadb7186df07ca4ca5a8654cb00c9f1
- SHA1 513b9160a849a3d7d510f59ffa5e201809d0161b
- SHA512 f853c618ca243b5da04e53079d3e6a0c6a9e4e358bb5020196b49638f28bf4171a487db7ce0e5e2c46df6a643c04434f967f1c614086121d1edddcf891f5a409
- SSDEEP 768:JyJ9dDNuElddhJDueNIIAtWSDG4yBvWLhq:Jg3bJDueNIIAtW2yNB
- TLSH
  T1ACD25B45E39055D6E833D479A0A65F1EEA71FB120B60C3DF1338C18A0F263C176BA6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  FUCKYOUp/_overlapped.pyd
- Size 45KB
- SHA256 5f92c163b9fe6abb0f8b106a972f6a86f84271b2e32c67f95737387c85719837
- MD5 7d5bb2a3e4fbceaddfeef929a21e610c
- SHA1 942b69e716ee522ef01bde792434c638e3d5497a
- SHA512 8c44f1683fdea0d8121ff2fe36f2582313980ef20ee1985af7ff36acb022acbb7617e85d2dd3b8e75715444dc0cfc4487c81b43d0222bd832aac867875afbe30
- SSDEEP 768:4ALlM4CwMgcpx3F3O6FNnZoYWEpNQ0vnIzRIIttyFDG4ycD7hQ:4CM4a3F3hrJQ0vnIzRIIttyPyr
- TLSH
  T1ED236B52A35001D6D82B82BAA2A31F13F6B0B6814725D7AF4258C24F1F3379177BE79D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  FUCKYOUp/_queue.pyd
- Size 28KB
- SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
- MD5 dd146e2fa08302496b15118bf47703cf
- SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
- SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c
- SSDEEP 768:UbErqQu06rhuOUrRm4MH5IImUVDG4yaC97hP:wuqXhuOC84a5IImUfydL
- TLSH
  T19CD27C81A7A858D2E833C179A4E25E27ED71B9115321C3FF1228825D1F36783727BB6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  FUCKYOUp/_sqlite3.pyd
- Size 87KB
- SHA256 9ae23d679a929d47b252ce14c9b2763a2913bbf17b0f52a8fd4b47aba0def0a2
- MD5 434ac2f2f82d15d9a3cb57b0145e1254
- SHA1 35327a6ac08d8954f10b1f70c0fbc3077c768504
- SHA512 e515253cbc5f7c8d2bfde5047feadfa413f637918be31053d85c89fe74aadee5f815e7a17f97ab66eceaf73170c0bf13a26f4e1a1d94b149774d4c0603a553d5
- SSDEEP 1536:nMwgTN2unyJTU+UB3/jilNGo8ne9k4ko8o4lE8bBYCcyE8adIIYQxCy6IR:MbzyBURelNke9k4ko89EaBLcyBadIIYI
- TLSH
  T17C9338AAA75400E4E8A79038D4A35F43EB71F411572097CF5268C24E2F637D27F7AB88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  FUCKYOUp/_ssl.pyd
- Size 152KB
- SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
- MD5 d4dfd8c2894670e9f8d6302c09997300
- SHA1 c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
- SHA512 1422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048
- SSDEEP 3072:PBgil+Nig7FXVxb/8lwiaibUixhk980VUuOazbAOXLkdWXxZIIkjVD6XFIIM7y:PBgi8iWXVxbI/Xhk9gazbRqo3
- TLSH
  T107E36C03F2441AF7D813E4BDC6634902E7A9F1052311979E85D6DA4A0F07B06BE6BF6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  FUCKYOUp/libcrypto-1_1.dll
- Size 3.2MB
- SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
- MD5 89511df61678befa2f62f5025c8c8448
- SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
- SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668
- SSDEEP 98304:ZX+SicVMcqx5q6ypQ821CPwDv3uFfJwwzS:1FicVMcqx5q6yX21CPwDv3uFfJwwz
- TLSH
  T1AEF58C5AA3AC1194E5BAC07CC9574727E3B1B85A87B05BCF08A681780F27BD6373DB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  FUCKYOUp/libffi-7.dll
- Size 32KB
- SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
- MD5 eef7981412be8ea459064d3090f4b3aa
- SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
- SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
- SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
- TLSH
  T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32