c069f01d82fbca9ed26334e8e41b729ed8c000c1f1236b101d0f04d306ba074c

Sharing

Copy URL Twitter E-mail

General

Target
S_re v1.3.7z
Size 10.2MB
Sample260625-dth83sg14t
SHA256 c069f01d82fbca9ed26334e8e41b729ed8c000c1f1236b101d0f04d306ba074c
MD5 0740372671f67e4356f1bc3ce06db3a7
SHA1 ff966d154ccbdf6e0e3a20d603efb46bf9310ba4
SHA512 e41715d93b0d29aebdfd0891f2a5d572d69ad81de384fc16b061ec4726bbbc1d797aec0c72c9d30cbe1305d467e0925e76b77223d9960d6695e54cc93eb74be6
SSDEEP 196608:CbF1+Tw/0DmTTFZ9QKLVSDbA/O0QjfZDAmr7Odcny+GgZzyCkncaHB6+I95OICH:K+cfXFZ9FZobAWJzHDyBi7kcUE+I95OR
TLSH
T1F5B6334A4D6AE1FA4DC908F9C91B9C6F066AE2FB83419CC08531FBC96C96F1D11BD172
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  S_re v1.3/ComposableAsync.Core.dll
- Size 19KB
- SHA256 d428f7a0729f47c171b5373e8ede4b5646f094b32d4b5bd9e0b9f26a5e3a9d64
- MD5 85aeef93648cc608d72ff8fd6366d201
- SHA1 24c482d27b62b21d741aa7afaeec8c78bdb5f658
- SHA512 dfe32ce450981c65bbccc13592c7d331dbacc131a2547dd7968e59bca4cabe5b4ac8365abbe3b51eeda0dc91eb831083a9f9442f8bc9d71212922052486c44cc
- SSDEEP 384:MX6aeNXZcJs1L9BKQrZxCAGrS64Eu5KHcT:MX6aWXZis15BK2ZxCAGWT
- TLSH
  T1A4920829939C8633CF6F577E77A606018B36D701A812F31E45DDC2E0265B39D2E2629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  S_re v1.3/DotNetBungieAPI.Models.dll
- Size 1.7MB
- SHA256 fce8cef0e3a44618a6fe82b2330e4d5c695ade8ebef5a1a2f31b205535406c4a
- MD5 2975a10f1c9d1636adac7e006da3d3f7
- SHA1 fbea8e57573f528181bf85cc1f3b9badc8be7be4
- SHA512 c547d835caa56dab7ce9768f068ce10bba452008057eb4f6d9de535884b3d0e4cf9ae4b48ca95c6aef0cba16b3172fdb9b376c9c9950a1aeee94d80a41dbff27
- SSDEEP 12288:RsH6ASIvWI4wCFi+p/7tFjiFDC19k/o0Sl/0VCkGTrqbRYuHc5fXN5fucO4zd3O:Rx/wCvuDC19k/o9wO3tNoO3O
- TLSH
  T12785D89137690F96D28E063C903B026517B5E08EA352E7EF4F10A8792DD67D4CC6E6B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  S_re v1.3/DotNetBungieAPI.Service.Abstractions.dll
- Size 31KB
- SHA256 3d35a742575effeb26d6a400bc0bca85cc1f9f1638d6d6c266d7c09b8c55f281
- MD5 23713d949d37eec3b26cde218ee191e0
- SHA1 d66eebb1477a401e6636eb6254e412447700e440
- SHA512 9f1e47b18590c67b0d91d7a29049ebcadb1a1bcdbfa3fcb1406a6e29c9ee7b4c26135b2d2bc5b9860c81b55ce5829331b9924c60d6a19bd5bc43585d9930a674
- SSDEEP 384:NChUko+kxaqvQ9213daFc76FPPOLaexebelXu4S98xoDg3dM1jUGlPkME7:s5NqvkG3d76F3qQepSeoEG1jlW
- TLSH
  T10AE2D821538EC12AED66433FFEA35E023532C6CA911BBF55464D8C5A3D0BF2B6216772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  S_re v1.3/DotNetBungieAPI.dll
- Size 251KB
- SHA256 fb1952f62bf4b166a1e536cf2356080a458518cadb55badaeaf6eaea310ed5b8
- MD5 37587c7882a6d5d12dc46cc3e4e1af3c
- SHA1 ab5e2732c0ea950558609511963eb50fd3156fa6
- SHA512 73ba403e32472914cc8eb0fc5165aaebacd98b4df9a50fef228a6395bde090b344182d39d8e5f07b2b0cfcb8270dd57cb564d75ec638b9d3a17b178f5a263ecd
- SSDEEP 3072:TBtm4Ck52zzKyvpBVps4+U9lhhh192H2Gkyf+YLp6LOJXY5fGCaRIjcF2g:Vz5mBVpselhX19sbPDFue2
- TLSH
  T121444C41A3AC8B12E29FCBBEE634461987B7E347894AE7CD1C8CD5E4349B370A854717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  S_re v1.3/Hardcodet.NotifyIcon.Wpf.dll
- Size 101KB
- SHA256 2059222c4ae5d0291fce13bd296adcc448d79b6fae27746aedf347608ed3090c
- MD5 2cfde828cdbfbb545be5aa61fe1e62a1
- SHA1 d376bde7322118787f6f08131ab34a17eb711789
- SHA512 2a1215dde4bfc4626cc4fe9696b6465a0893a8787ce4ff41ca0c08908bb8aa52a992a156c3320deb0fefb225acb4c3132286d8c04a0caed93282b86adc011cda
- SSDEEP 3072:5oy+75OQW4pg9xXsGQTckaX4kGsdO5UInM34:5+75ON4pg9xX7kzsTInM
- TLSH
  T1B1A3CF8523FC405AC1FEA73478B532148771FD837A61CF2A498262B849B77D91AD07EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  S_re v1.3/MathConverter.dll
- Size 68KB
- SHA256 0ebb64f0e7258a22b0456d0ce1ab9816d7ed582dc99c3a0af5e4dc8f017dcae5
- MD5 91380061eed023ef733ae34a3a6fa9c0
- SHA1 ab4a8a9a50113a6dc5eddbd5247b1828cf6b9053
- SHA512 fed2881e2e053f45e9b381b1cd43ac11e7c993fd18785f52538db3c0f537909d8cd9b910f360d64d9421ec6bea836acbe3537572d12219fc809188e040cd34e9
- SSDEEP 1536:wh2grVDdTBeXBHYSsK/+Q0N1hilfwJaTZXwW1m:whjDdMB46/901wTZXwwm
- TLSH
  T18963193467EC6327EAFEAF79F4B412110B75BD97687AD349498811EC0A237900D61BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  S_re v1.3/Microsoft.Data.Sqlite.dll
- Size 165KB
- SHA256 04d0d2926c6c5d1a7d3a3f368edb2be8d4873c81b06fb1f3f11991664510c694
- MD5 871567c7e224cf72f5e388592e487997
- SHA1 e8e0761d71d2e128d795337405279d6abf7f6094
- SHA512 4dfd4cb188e8f3fbd5d99721abcc9f4c705685c4c8a392123f6b65ef0dce566741b01cde95a001d6ce1ec7320d49d3feba9a93cac53050ee660d5d9210c203c1
- SSDEEP 3072:WngRUDRwceUEEDDGSsK2Dp/CROtt+9IIlFFWbjvIS4dmspbZy7it6ygICa4xyFzn:zU91HGm2BfiIIlFFWbjvIS4dmspbZy7s
- TLSH
  T16DF3296D0A885023DBEECD3661B99D8507389146D5929B4BAC50ECEC3C637687F843AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  S_re v1.3/Microsoft.EntityFrameworkCore.Abstractions.dll
- Size 33KB
- SHA256 cfe1f58e224428ed72b27603032a0c59c7051ab947c50031bdad6bc816477a7f
- MD5 d81b62f7a79926ac38a7a690ada3b2e7
- SHA1 3456afd784795e62f7c8e6398aa936e829778244
- SHA512 e8868ea89fd340e648d26d61a63350c2e426fb76a0fab49ff3fddc1aa20529eca385daa61d5fccfa624f0a36670f0b650e73a58c7072111b9c47cb36dedc402c
- SSDEEP 768:tbOu2/CELb/ksbp5gtMLu9+9FwW7t5nG7Yl9zO:1OH/C6d5WMQ+gW7tP3zO
- TLSH
  T163F26C92B3DC4323CEFE1F71E570E4421836EBCA7411CA6E4A55B14E0D63B849A71B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  S_re v1.3/Microsoft.EntityFrameworkCore.Relational.dll
- Size 1.7MB
- SHA256 99f31761f7579be9cdb71dc43fbd6867f69631eb79ce4e7eb3315813e686caa3
- MD5 6f075dea584800f4f241bf30fa879f31
- SHA1 68a559d2ad4d01c804e38461f985761f90d69595
- SHA512 25c99c879762d2978dd32057c4125d391097ba719e2a45a39a32b8fac60e2d977c197e10db786ed60186b2902738f1b1949fcd9f02c03044afda622cc7b9d711
- SSDEEP 24576:Ne9+z555N1ietCoWRT9EXSN0Bf7213pJC:NegliuWQAJC
- TLSH
  T195856E91B3FC7F23D2AF52756131040C62F6D91A9722E75AAD04EAB91C9F3818F4225F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  S_re v1.3/Microsoft.EntityFrameworkCore.Sqlite.dll
- Size 199KB
- SHA256 4e5d8943fa9183f905be48dee336ae31228524eb1888eec2d38194566801a7c1
- MD5 c861d15852c1ca73305cecce0337734e
- SHA1 4c984fe8a22a5183b6d6e7ca0b81cfa4438a25bd
- SHA512 832b02d7b1463ef11f4f868c81ff7607bffbfdd433f6ce9542b779d7044de20456be0b90e065ea9e0a9a03d4ae71cb0c68cfac53a66d5955f1b2ea362bb7df37
- SSDEEP 3072:iMxLsQupX72oMwMqzIFujF47RGt+l+axHH5l1:iMx9XgsF2BwT5
- TLSH
  T1E0147C5D23AC532AC6BF9735F0A854404735FA0BE5D6EB9D4C8C64ED2C62B817A083B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  S_re v1.3/Microsoft.EntityFrameworkCore.dll
- Size 2.0MB
- SHA256 923c252f91d6e8e3c01116c39f16e64fb3e85ea70ef7816f6e2c442f71d9e1b0
- MD5 cd1c2d9c5448b281937c91375781cbd2
- SHA1 744d9fc9fc9978569c3d8771da773142c78a876a
- SHA512 5dbf8fad5d989eecf4c579681bbd2cb1e794131b8277c7994f36a16ab754f9a7747912fa5b6c499ca515b6c994ebf285c2f777e23676061ef5721c1d4938d7df
- SSDEEP 24576:+XLddrC5CB2QBdE+WTVlyBcIM/98eF2+nwxJtit7+JMrDTYtSBDsq:+Xv+5hQBpY8vTt+7+JMrPgq
- TLSH
  T1EEA55CC273BC5AE7D1BF3279A0700414B7F6DA4A6332D79B1514AEB86C9B7805D813B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  S_re v1.3/Microsoft.Extensions.Caching.Abstractions.dll
- Size 31KB
- SHA256 c004f78d9f8378c5f79ac3a88e90625a117b9700a75f5f02266289dd4d28e451
- MD5 89f216cf8eacb39551ac5df4df726d7f
- SHA1 cbb5349b9ef110d51ab28cf6e9ea8acca6c16e2a
- SHA512 2b4517149995a75d188eb195f3c53331ce4119e6d516ed385fcfcc1e62676997c97ba66b13c3484f4bcab8509d566f17d3b58f5b146911644811a81c1ae36d17
- SSDEEP 768:X2z8YAqmMe33Qy6uOje1T45wKIG/N0Syo7ieSuo0lEQP9zMKY:X2z8YAhHNROjeMwK/N5T7iio0jzMn
- TLSH
  T114E26D514BB8435FCEBF2A75AAA5C1850D7ED3C93403E72B198DE18D1C8B388953273A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  S_re v1.3/Microsoft.Extensions.Caching.Memory.dll
- Size 42KB
- SHA256 9ef11f0b594d5be76341ca65a53bf3930aa807c312a278ae22043dcf4db9ce25
- MD5 f60f3d61ea68254b8a5ee1f50e95f56f
- SHA1 0cfa3f1be8f6b8f9a9439dcba0bbed12db4d58c0
- SHA512 d14792db1abb631c9f1532eb1575ce63786e888bdcc4625f38a4e841a9315e95659d4634dba592a37b4dd5441f1fe58f27df91a45a6fbaf7ee09db69ddad7429
- SSDEEP 768:M/Lun0cK7s4dFnRmoFSTzje6EEYcu2Epuo0NHkOQ69z7:M/L4bKs4dFnRHAjyERu2Do0Dz7
- TLSH
  T149134B00A77C4327DEFE1A7696D4F4011F7AA34BA511EB284D8DF0DA1D637C08A2663B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  S_re v1.3/Microsoft.Extensions.Configuration.Abstractions.dll
- Size 28KB
- SHA256 893f042b8bea61e3e56091ee6167af61bc38a39d35cb1d0f9b222aae4493146a
- MD5 5edcf3dccef856711d35e0afdbdf6d0c
- SHA1 fefe0a4870d36814a45f8e9c63530f1963cd6c0c
- SHA512 de9b23363d5fa78b45c96295713e392d24fa8b0d5a78cf6d2a2a8d04a071fed4f52f4b3559e36c829cdbfcb318c2a81b0df3cc3d46eea766c88afe5f16de5718
- SSDEEP 384:R+q+2Vv/+usFlLVyKo/9ETG/DwzzRjz69M1ZVMdWs6NWsY/WyRIHRN7eUBGQtR9h:R+EF/CvyKohrqnYuo0eUwQP9zV
- TLSH
  T114D24B9653EC4333CDEA0F71E5E5C8416E37D7993816DA1E688EB10919677C08B32B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  S_re v1.3/Microsoft.Extensions.Configuration.dll
- Size 40KB
- SHA256 c301bfcd6a6a2baafd81425be273c7f29afe726ed6b6bed54202aa7376860b2d
- MD5 991ee31ef4e5138a558b096249c65e1c
- SHA1 3d89f910e18773882c34f8e86c4ed0bdfe49c420
- SHA512 b11618ef12f725259173b1e4ad776f44b5d4530209af62289798d4fba9f307976c61bd5a5c2762d262b513690a406e43b1bdf55507d42c2b04a6d41e29c1a9e1
- SSDEEP 768:r054t3ibki5TCk3jqEr0WBum6qofqk+xLVNe9zx:rPtnUj/LkmGfqlnNazx
- TLSH
  T165035B52976C8327DB7E0A71F5E8AA462F36D70B7652F7194C5EF04A09733804B6223B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  S_re v1.3/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 44KB
- SHA256 087813b2f9350b8c2d31e5bc9a5410fab198fadac87bb1269f41de6e6ad7ee62
- MD5 6c8655836651933ffa4c253b5fa72939
- SHA1 b75730d6c1ef5e0ca6d7f7a1a5ee540aee940836
- SHA512 afb2a83b58eab2eb00116ad790110884d53391e6a88cca3fa7bb8bf8837257db1aebe07af63417a23e4f37aae9dd217a2b4a58a8f25528c7559ef31582babe42
- SSDEEP 768:2q+RszBJV7CkN9YxrIvw2DLBjYAQP0+lyJ9PPguo0eKW9/9zH:2q+SSkNNjdQc+cJNBo0qzH
- TLSH
  T1C3136B80B7F88322DBBF17B4A4F261015E35B7476902B71A2A45E01E18E77C8ED62F75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32