3f4996d65acc0b67dc661aa71064a7044539dda3be7da96c141609c4242bd57b

Sharing

Copy URL Twitter E-mail

General

Target
5091-5169.zip
Size 2.4MB
Sample260625-alf7zagw2t
SHA256 3f4996d65acc0b67dc661aa71064a7044539dda3be7da96c141609c4242bd57b
MD5 2379ccabca64e74ede68ba7198db2d34
SHA1 a3ea37add020c72a2f3e526ae2c11186478c9888
SHA512 2807250a62b29791c1921730ed85ce3defd1fa75ac093cf0de2d9c4c17123b3225f33e2f86b7ed7d56c01f2cd7a37e0c6da69e93463b443bb1a73d6e8b0f66cd
SSDEEP 49152:jQuJd8sIYvNcHBnFenEQg8WjlERwpSbDzGht8QL:BJd8ucHBFenQOwAb+88
TLSH
T111B533705C5942D6F86CC4622B7D52CD4B97823991351F8E2D8383AB1A13BC6FCFAE16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  5091-5169/A-8947-2024-CN-5151.pdf
- Size 37KB
- SHA256 fb4d62192c6f9ef578a7a5c08c2b4e6863619e214273592fbc74794a3de76307
- MD5 670f9c1e67c6fc6c6730b2b7ab9b4640
- SHA1 9130cf67d421192829c83ca768fd8a288de2bd33
- SHA512 069f85eaac84b9fa524a953e9195795b2d9e3f8bcfb3f5bfca04e8361a894f2bcdb23756ec35c53c52b4ef4b90c2c1936b96c2a6a5d8e5e46a6f28be744bec29
- SSDEEP 768:D1usJmxSoolV3E1rsGyK7x084jdLOxyDK9w+nKl0o3OuDYCaHY4baqVI8tPVbR9:hP0EV0xcK7x0DYYDK9w+nKh4uF8tPhf
- TLSH
  T1E303D0B28792AD8FE5108C4752AD3C5C55EDF07BDFC83961A9790406130EA14EE399B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  5091-5169/A-8999-2025.pdf
- Size 36KB
- SHA256 29618bc0c24561816d79a01aa27ce2b28c3105e8dd07e6e28c2a22e29dfd06b4
- MD5 cc3d36b0e2fdb814f2b25fa302ad1b1a
- SHA1 7a7eb37a1498fecf5334a1f79aac086da1a7c2d0
- SHA512 db97fd03a019f2d258252321599d4ec1f7179526f23a5515cb8c5198f67ec18b175466ed0fa9bdadcb263bcd1842abbd29b7b46cd2fb065da33796ca9ec82e76
- SSDEEP 768:HaYL16N8JoolVvE1PgGyK7lYixu981DyDK9CRQIARFXmryeki5xzKE:HrLQN8OEV8xgK7lYtC1GDK9CeTkryehv
- TLSH
  T19EF2C077D2994C5EFD91C490EE9E394215BCF27788E934A26D3148081F18E2AAC39E77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  5091-5169/A-9000-2025.pdf
- Size 37KB
- SHA256 5ed290611f141ea936e39aa45cc2b2d3fcab77dafe4c40d36bc8e42d94b15428
- MD5 000eb3a2abf7ad1b0dc7a0661d313a91
- SHA1 236cf800f7f93241cc3ab21a0fbe3aa21e418589
- SHA512 49df04f981bc2be37437d1c605387f5a6c5ec3091320ae92142cde28a1354ad3d3a08b701a4679f57a52ee2f052e79e61dc2413b9834e6a832e8bf316b4ecdba
- SSDEEP 768:mUnVUoolVd8E1dyGyK7le4fqAhrqiSyDK9x+4wigf9kzvPmQIw2buBaiilM:tnVlEVlLKK7f+SDK9o47gEI9lM
- TLSH
  T10703D1A2D25AAC8DF880C974A5143C0D44AFF0DB65E03AF36A744345B618224F736DF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  5091-5169/A-9001-2025.pdf
- Size 37KB
- SHA256 9900a4fd1afbae45b39f693439faab3dc0b049df08f23a57fe08b3e4ae8e375e
- MD5 d1ed2f1bdd29f7553181264591d0e4e6
- SHA1 f8d85d39ac32bdc05ad94a7b372d7fc62f9dc99a
- SHA512 08533d133fbd6cc85d3406aeaabf85f975234216f9efffbaf3bf039eaa40c0a2df27aedb2d6e1971688c94ff2ff45e638394ac54ed30b64204c3ad75752e00ea
- SSDEEP 768:AwRoolVUE171GyK7GIS0TXyDK9tJluhR+RL0iZm9KN+hzYEbRtLsNI2g:BGEVfhXK7o0TCDK9Lleo1o++hsEw22g
- TLSH
  T1CD03D06AD35B9E4FF094C251A279396A10ADF06BEDC03DE552344A0A9304124FB7E9BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  5091-5169/A-9002-2025.pdf
- Size 36KB
- SHA256 fa2b573ef59fb6963125db1184ab5284d313338e2e40575e794d88950ad6a385
- MD5 19b0dad4b5acdf98a1febf1efe08e948
- SHA1 aa6d2791bef39205a460abc4f18d7ab054d49a00
- SHA512 d9f0342dcd29c2908169d2a5d33cf83f0614b088c5bf00bdf0934ab38f454bddd1601d4189921a74b9e55d63388ca3efa595141ad39f21353a4741a37216705a
- SSDEEP 768:6e+7I/kHoolVEE1dyGyK79mc6pG/wyDK9uzbp/3STIw2buBaiilO:y79IEVvLKK79mc6piDK9u56I9lO
- TLSH
  T1A7F2E1E3C7090CCFE8458551A61E3A6D20EDF07BB9E83C72F670464B7E05128A5256FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  5091-5169/A-9003-2025.pdf
- Size 36KB
- SHA256 1e3c7de4b61287ed0270cbeaeccbca2e0558221b1df85147b65eb27a99c9bb82
- MD5 aa480d96772b0c265468a153bd55efb1
- SHA1 70b615809c4b3c3bbf52e5ecd89e14ac9da13e61
- SHA512 a3abbad54a2e25461d17982b1569e0dad436593ce03d2dc2e76947573c2bf209fae85e0711323a4914b02a30dc6b26ef2be8939c497bae0860ed7ab52b10d8c4
- SSDEEP 768:xy7n0oolVsE1dyGyK7nkHc57DC6yDK93O9vg1TLDIw2buBaiilc:xkFEVnLKK7B2NDK9+Jg1TLDI9lc
- TLSH
  T11003E172DA4F880FF891C68AA16C34CF25ECF0A742E4353275B4050E7725664957AEBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  5091-5169/A-9004-2025.pdf
- Size 35KB
- SHA256 81a154fd6f3562bbbaa7a9bced38e6a0748acb1c8447c841cd41b953d8c3c034
- MD5 a4ceb6d7734724f172aa0d89de539558
- SHA1 900d60eb2988a62f0f558dc8fc800836022d3659
- SHA512 13210658e8a0960b2d20c9ef7d3e24ff838dc2cf55c84ac50326c20a95541fba1c2db4ace8fdf505e102fdfff9e7fc246bcf0442253dd4d6b628cf2040d7f044
- SSDEEP 768:ZKkKAfHYBuooIqOE1VnGyK7r66ZlER6iZIyDK9qKbhnW88sxmolD854Ac:ZKkKASfqpHxK7OW7iZfDK9zbpF8sx78g
- TLSH
  T197F2E163F78569DEFCD1D4055A6F3D8568FEF27BCBC83C72612484086E2981AC5282F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  5091-5169/A-9005-2025.pdf
- Size 37KB
- SHA256 26e16f9b254340d948c0aeadc0c438a0a82965670423b92d49c5e6860c9d4bc2
- MD5 4835285256c786b68d1fbd44a35d176f
- SHA1 60dd2323ebdba16d0a4f156756beca27a985e81a
- SHA512 a44cfe59a438bfbbc6ff82a4250b2f3fe5f74ac340e47dbbc1ed76c8a6438dae9126a411e5ad1236f2a1ef47f4c4da4f087ac28f7ba08f10a651e4f2efe1b2e8
- SSDEEP 768:0njxpnuGVwRooHVoE1QRGyK7om5dK6wyDK91NjulWHcJcBQ2YAtcie:0jxpuaAVrKDK7omi63DK9nQW8JQh3tne
- TLSH
  T1C503D0B2D58A5C5EF4908481F52C3C1804ACF16B5BC834B76BB4C20DAB1D865FA3B6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  5091-5169/A-9006-2025.pdf
- Size 36KB
- SHA256 c0d79a2e02c89b72dbd6dcba8a3cd6cc07c837ebf727322464696a4fff16e693
- MD5 5b3babef979aa39e301ece4a864b4f90
- SHA1 a4400962e38ac83583c84cbfb26219b0c71aeb1b
- SHA512 be5ad2be293249d0ca996d9b70197f483b91b82ebaa2dee4417dc3af588a5480fb9ab48b44bf34582ab6c2d1caa4e502153aa087c1765e8a176d48494bacac2f
- SSDEEP 768:0hlaxooIVAE1F0GyK7Sigwkp7ZyDK9pvSfqF+Uz0iGA+DA10uLR1:0hBfVz70K7i7wDK9pvUUb0A11LR1
- TLSH
  T17DF2D0BBC9891C4DF581811191CC3D9A90FDF17BEAF83973A274088B5F194097E369B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  5091-5169/A-9009-2025.pdf
- Size 35KB
- SHA256 31322434cf74203c2a8b40715dfebe156cbad0bae2480ef46f89b2ba9b1ab71d
- MD5 092fb0d36a3a4e262b90185f28919538
- SHA1 038990d06566a01abb03d287a5caa6052863ae49
- SHA512 6abfcf79649c4814e695645ddd2dcd780f3662db6daf4528da0fe6c75f27acfc7cdd5ec49641f7cfc5f4ea7f17a6425d9580437ac86ad591c8d6986187cca729
- SSDEEP 768:/HTzQgtooIVCE1dyGyK7jf3J3x+gyDK91omEw1HfrvNJXIw2buBaiilC:/3PqfVlLKK7TJ3xKDK91omNtvbI9lC
- TLSH
  T1ECF2D0BAD7856C0FE1C0D916723E3919809DF0AFE7F834F22674068A7317418A56B7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  5091-5169/A-9012-2025.pdf
- Size 35KB
- SHA256 47da5ed373b66c9aced9c9c312049bb289cc2208d49babcdabe9f8873feb05cc
- MD5 04f5403f283e26e3882b4eef6a33e6e3
- SHA1 e6c939c3599dae6d7fea47624f67313f53f379b9
- SHA512 7c29879fe1ee569ce92139a7faa550cc7052b04bc3a20d8667b9bd7f2af21957a6d0638840e069a86ab4598eb87034e492e1608c4bb6910450859bed7104be90
- SSDEEP 768:NTp0zhooIVCE171GyK7V4zLHLMEVyDK91omEw1HfrvNJX+hzYEbRtLsN0:PhfVlhXK7wfBUDK91omNtvb+hsEw6
- TLSH
  T12EF2E07AD6431C4EF0E9C646A56E3CB441BDF03BD6D83CF362240A46672A4247D3A9B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  5091-5169/A-9013-2025.pdf
- Size 35KB
- SHA256 fb15ea96a807bd5ff279c58bd6b9738a406910b8aa98c0ed8ab743106e4b8933
- MD5 35322a72e6ddca4ee74455898e75dc5f
- SHA1 511c76780e1991766e15cfdbfb854e8ad7c9d5b8
- SHA512 91b6ba63ca503e22352bf7fc20ee73ad338b90a31b36da178bdc992981f7f6e3250647ba4d3c2316a972b381c01d752a36accc941010ab872229a77971294af4
- SSDEEP 768:C+S0SnLWLTooRVUE171GyK7Q3kLLcxyDK9uPEpL/c7IMPE4+hzYEbRtLsNM:CRqLcuVfhXK7Q3yDK9of73F+hsEw+
- TLSH
  T1E9F2C076D9899D8FF05544C1F15A782808AEF4A3D2C43DE22F680E495319418EE3AEFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  5091-5169/A-9015-2025.pdf
- Size 35KB
- SHA256 2d9c5e0283b4a21d4c7d22ad7bbdb64026b66aa87852ab84415fd265617c9f70
- MD5 a226348deec6e518adb46f5c90b30a98
- SHA1 cf7cdafdc8233e6015616c7881a7b44f5ba8e6ca
- SHA512 7b2d64580e0827f5e03d7e7b5bce29a2a9cf6f4131873421124b610e5a321e3bc63e5651735b5eba8945eac7625db884f649eae709b525d8efa8ce63aef222e6
- SSDEEP 768:z1IJL+sooIqyE171GyK7AZ1wE2lyDK9Yw9TlLxMNGm6+hzYEbRtLsN9:y+Nfq1hXK72wBEDK9Hd9F+hsEwL
- TLSH
  T1AAF2C0B9E31A8C8DF051C051F678784581BDF12B9BD528B326280E4A6B5503EBB179BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  5091-5169/A-9016-2025.pdf
- Size 37KB
- SHA256 7d245c8ae30d2bd98666d13e518867aa76be17d5dd218ff39262059c30dca236
- MD5 92372ed6bea2bc4e0cb60689b15bf8fa
- SHA1 eae7a93bfa75833477810108abd75adef6220c18
- SHA512 2f32b3d8f3ab0246094d2899e99c33d334a323f909a9ac929c01544c52579e0e57e3a84f7de5dd3568b66a5d976ef3423096454a2d60f093054f0d9d04bdd7bf
- SSDEEP 768:Hw5xbaoolVwE1rFFGyK7EHGz7ujVyDK975pdTvEixVj2zyH45EyYkj5:QHDEVD59K7xOUDK975pd5kmH47PN
- TLSH
  T15703D0B1DB40594DF840C396919C394D09ACF2BB97EC38F3687A4C0E270D5A8F926A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  5091-5169/A-9017-2025.pdf
- Size 37KB
- SHA256 5746292a8477421f6128119d11fd8fca7e6dfd496dfde48feecd702e2cddae8c
- MD5 e51dcfecc9200fb92c75a06a61cd5a98
- SHA1 e6e8365970f257511de8a2c2996022db4cd02780
- SHA512 a0522d0facaa6b3ee33566f27919a42c264420619dabf638e1728e954662ba1a1c12d3964e53b262bdaa637b81355d6b71d3aafe481ed39bde3dc242c518a173
- SSDEEP 768:fOFJOJFoolV5cE1OFGyK7lRehMGGWgyDK9jfR6GR0McQod:fcREV538nK7lMhMGLHDK9jfgGRRcj
- TLSH
  T16F03D175E329A84FD8D4C5D0BA393C8A09EDF1BBA9D4347322684182A72D4543F3B5E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  5091-5169/A-9018-2025.pdf
- Size 36KB
- SHA256 e12a558f44a8c23362f747401dd07fe4c29b196e83caf35adfc6c08972da60e9
- MD5 696be3b6b621d25d375fce5f0544036b
- SHA1 d156eeb1f98a1292de14e4f6390c5ad6f1105d67
- SHA512 c30301518d3d8fccbfd39bc12aa05716e75a519689e49431c17e4c590705ff27b5cf6ad10f36f55464c829489ccfaf4764523d62249f312e84fe0ac1b8b2093d
- SSDEEP 768:60LtlKh0FooRVrE1hFUGyK7KCzzWYyDK9jj4ML3nXSlJnwPTEGs5+ZFe:6qlEruVwjOK7fzWPDK9jj4MLSnnwL5sP
- TLSH
  T1CCF2CF36DB44CC4FE840C0A2A29E7C5E18ECF1BBE7D461B21639094A675144CEF79AF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32