1755f3b8e2b09fd7a2fac95e1af0e884f3d1e631d924331ab676fb7b7446a98e

Sharing

Copy URL Twitter E-mail

General

Target
MS.rar
Size 37.4MB
Sample260625-qaf1tsct5m
SHA256 1755f3b8e2b09fd7a2fac95e1af0e884f3d1e631d924331ab676fb7b7446a98e
MD5 ab4e6fb8498f02b78e2917c10e343ce2
SHA1 1b712eb8037060d2aee49a5d7654ccfc80479fb4
SHA512 950ee9c10e422d0ea61247e1c5816f5982ae9499b005efb4c3ed2e2243edeec2810e8b2283236e0a41f98e6e9394ce7eef1881fdfec70d14e32c126749c3d732
SSDEEP 786432:0r6Fw7J/TkR+KKGt4r42CWnHnp7yZC//Mzo576bCMY4ac:26Fw7lT6+KYOWnEZC//MEaN
TLSH
T1D587336FF0FD49DB6E1257CE1F1DB7CA22BF84DB111BC94AA11A2DC6C6C89A1C120271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MS.rar
- Size 37.4MB
- SHA256 1755f3b8e2b09fd7a2fac95e1af0e884f3d1e631d924331ab676fb7b7446a98e
- MD5 ab4e6fb8498f02b78e2917c10e343ce2
- SHA1 1b712eb8037060d2aee49a5d7654ccfc80479fb4
- SHA512 950ee9c10e422d0ea61247e1c5816f5982ae9499b005efb4c3ed2e2243edeec2810e8b2283236e0a41f98e6e9394ce7eef1881fdfec70d14e32c126749c3d732
- SSDEEP 786432:0r6Fw7J/TkR+KKGt4r42CWnHnp7yZC//Mzo576bCMY4ac:26Fw7lT6+KYOWnEZC//MEaN
- TLSH
  T1D587336FF0FD49DB6E1257CE1F1DB7CA22BF84DB111BC94AA11A2DC6C6C89A1C120271
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Memorysense/Memorysense/Memorysense.vcxproj
- Size 13KB
- SHA256 f8451f7db34669477c9294924836994f78f09de7084d4b2bdae57487a2f038dc
- MD5 c48909e6020104a29adfca713c7add3f
- SHA1 d2ff0ea81d3b4971971b351f6cfd1050398b7973
- SHA512 ebded32855bb960ab7c661bb2753a4b99a1aeb8fcdee562dc50a4d6a0a6d7c4a0db59fdcea4737af1bd3b53057fc41e9760c234e688392ad6c08dc1b958c0150
- SSDEEP 384:G4af/cD/dw/k2/lo7lq1+fawnGqbk6Tu7g1z7mbD95:G4af/cD/dw/k2/lo7lq1+fawnGqbkyM
- TLSH
  T12F522F6AE1FC1E6E02725127E6D3D90AEE21B3C349464818F64D979BEBF740C1223727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Memorysense/Memorysense/ext/Clipper2Lib/src/clipper.offset.cpp
- Size 21KB
- SHA256 da4a68ca4c17e5dd1e9886ff8ab0dc8567952713ecacfda90a72bd6e0830b4d8
- MD5 82a638fc94ad914c8288eac8526ef000
- SHA1 bd49aec36a31960e59b84cac9abf003f006e35b2
- SHA512 1af48c75e8b9192f33120d2300634b5ee216358042f4726a36240c99ef1e2ea9a79f0cbf94c10cd9a35943dc48221c0bc3f62728d08e25e450e53bd0d2aae6be
- SSDEEP 384:5frprTIHY7o3/axxPRWKBWyWKBiORVCpwVodBnxcdgVQB/+aWaqkS8S8+olix2+i:ZpaY7oCpAOD5/zLqOhZFZ
- TLSH
  T12FA2B81A3C99692A85D2F3C7913301C1D93DC0C1BAB259B7B48C65586F1E82F893DBF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Memorysense/Memorysense/src/features/cheats/explorer/http_client.cpp
- Size 7KB
- SHA256 83938042856e5bd891eed0c068257bbd5eb47931fc8f418ceeb5ca8377b3d5dc
- MD5 e13c431468d8ef1048c6b462e0d4cc7c
- SHA1 e57c8025c305ef3f693f98f0454e3243e79cf458
- SHA512 13444b4d532842e6462bba82afda5d26f8aa800d52237c1cd42fa625e21f7915fb2e20ad5963bfe8eac3d4613ce30571f94cfaca565beca89d0ae9a071bbf89f
- SSDEEP 96:rmd0SJo0/hCQg5gzlRZNpNW6We/hCQg5gzlRZlpN/6W2TFb1k:id0ihCQg5gLrhCQg5grwhk
- TLSH
  T1C3F100454956BC128B72935AFB13CD0AF7B3481367868772B89C07492FB4E88D1B4ECB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Memorysense/Memorysense/src/features/cheats/explorer/http_client.h
- Size 1KB
- SHA256 aaaf47e80a7968c1e4dd0de16b082982841c4ef2861ffe601fe2dd43eef5ee66
- MD5 7596fd7084b886cbc269a3a3c12fd342
- SHA1 b6e73c5fbe03459989dccdbb52f19bbfc0e261ef
- SHA512 454d0f736e95822759797b02d342039ce9846224633679e3a6e87a2afb31de4b5b9d627330224a2ebcaa5a51161f41ae37e1c0ae0102aee7761ba11a2a0caf31
- TLSH
  T139115750A8FBBC51CF324566EB624003F6197147B79297F1F88F01CA5F724846A731A9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Memorysense/Memorysense/src/features/cheats/explorer/lua_dumper.cpp
- Size 8KB
- SHA256 65fd417e40a0bb260e63834dd315e7a158b7d9bd948fe1ab95a3fc10b3868778
- MD5 fc7b0852f9a6ab5a7f5d955b778ad2d5
- SHA1 9bc426e5f1edf7a197cadb8673a314c357d915b6
- SHA512 eb5bed13498bdb882242bf558f5da36738ea5d7320ac7f0877ed41e6069b5e091fbb202c85a7f3ab610f5514fc9f95cefe37bd104b070ffb7a923cb5c6ac72ed
- SSDEEP 192:jEOwv+N+xjpMiiaBfx8Wprs8jjsDgMErPzR/B4DOggLlQeb8:pQ1pTfKBUXJB4DOxJb8
- TLSH
  T11502EE484C92F8640C3767379B738119FB1B4453B635C691BCEE82592FB16ECCE68EA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Memorysense/build/Memorysense.exe
- Size 933KB
- SHA256 214973dfe9f883098d34456a91268bcc480c6119e1d1c1dd48d04a5fe4d0a029
- MD5 5995bc5e1c65208751f5bac18ded86fc
- SHA1 c69858b8dc70c6da8005159a5ea30acb67211be4
- SHA512 d789762e5240ce346912a9f17e306be91615adda42f344174cc0aa5429e1d2328a16d4cd908312f6a02bf0a3870d5a16787d7943488043330974c2e97c4a3c18
- SSDEEP 24576:KKuSi0PiEHa5irq6e8M7LOk1nqMJbUsE:KKuS/PiEHaYo8uLOkNNtUsE
- TLSH
  T14F15CF42B2E545EDC07BF036E156722BFA753869032156EB33D4096CBF966E06FBA301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Memorysense/build/brotlicommon.dll
- Size 134KB
- SHA256 4d2db9fd5111dd61d2ac3fa8eb07e4f3c55e869ee50b0deccf80f387aa80e5f5
- MD5 128071b58de021c3fcce8d26949fd74a
- SHA1 66bc2ba66698b749a1b2e5fb96f17a1d7e8b554d
- SHA512 3d83ac962c8f35040e12f206fcbdcc3aae010c0d7046cd5b3c2a2195d94617fc6b4555a210cbd6135bd84f9d079461de2649a3f2079458793d74ab803de46608
- SSDEEP 3072:Mg4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBFQ:Mg4AhdNorGvHdbi09GJfQ
- TLSH
  T1ADD37CA1F3051736C26B627AE45A6BB9F33582B493670551B4A9026D20C3CE4873F7FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Memorysense/build/brotlidec.dll
- Size 51KB
- SHA256 7afac7ec571e069c30a1cc1b20f36a86b219f26ca2da552ee083b7c959793610
- MD5 2fa46a947df7dc607596b55de895bcea
- SHA1 59c5deabba3aaec7b1d61f0b1cad55161b01b035
- SHA512 a92f223537d479cfa548117316f2eaae7d60a8ad3317f7eb31a6be7722d09e6d38c75ac3fa98630bbda7bc79a95fc2a77274760c7383bfe4c8b3aa7f0cbb947a
- SSDEEP 768:TywZHqMsLxvfJPjTVJC7wI1jOUUocHgWoazQxARbYs3MXUHG:TywZKMsLNNVJ4p5cHgWvzH
- TLSH
  T132338D42AAD55D9CED53C03C8267926FD3BB788E9305A3EBA290F5762F177E02379110
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Memorysense/build/bz2.dll
- Size 75KB
- SHA256 729dd998c84a7eeb97e8f537002b6397d84d1d78e457a4c265daef2348b2ca22
- MD5 b4fc9cb69d16a664dbd254a071987446
- SHA1 8dbf5698ae95cfcd74541e0719734facd23f5ed8
- SHA512 17654b93cf56d40325ad68cd6b0c60351715277f6438773004e68ef821f3dc3958d389c2f6f79eec46200e3c811eb66b8d945992fa61908497d69e005eddae22
- SSDEEP 1536:IxVEJaODufsitWI2HNkK+13Ta5c/aBPEDDc3hT5kO1rJ8Ti:LuMV+xbrYV5kGrG+
- TLSH
  T194735C4076E3FBBDDAABC0399623074BFB35BD680B1117FF3560867A2B22A910D74516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Memorysense/build/freetype.dll
- Size 676KB
- SHA256 451243bb4bed6705d87bd13031deaa208e3bc8806d20af53b155c4488cfeb34e
- MD5 649b398e2c5acc4601d97198360e93b3
- SHA1 62e98b0b9bea81667c6ca88cff498828cce1bf70
- SHA512 84d7407213274c2b1f23726e55e6cfc0822a8a1ad3e0179c68efd9a0cf09c2d44c51c6745e34ff4ef9e8500dab5360110c0f147def1a373fe00172102f9a76d8
- SSDEEP 12288:hw26xNKjG1+cpOtwbZNoJYkNy8d8XEPSUHoeddqCfLfEWm+o07:hw28NKjG1Lctp2oYE/P0Z
- TLSH
  T1BCE48C82F3A4069CC6ABC2788717831BE77574061311ABDB16A05B6B7F17FE16B3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Memorysense/build/libpng16.dll
- Size 192KB
- SHA256 afa724aa1848b8124a5b4ca9222b267b8c4214c103f442cbcd3df2d477db6e79
- MD5 cc2f820a8bb3acc54e8643d2e19e13f0
- SHA1 1ff77d1b89d570b6f4349abaf5ae3a65e84ee54b
- SHA512 11847b8be077cf93ead4f34deb25b3d2d8e8c6d40a532018cf841ac5fb356fcbd5418cd027a297221c26412d9fbc4f0b150a8e22b8aaefff3d7ab2d6aa0c15b7
- SSDEEP 3072:OAVQI7V89cq1aFGbwvh6USzWMGFm2xiQDwC6Jwu:OAM9cy0Z6USzWhFFCwu
- TLSH
  T173147E87F16400AAD897C03C8657A517D2F2756417649BEF0BD08BBD6B23EEC7A3A701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Memorysense/build/zlib1.dll
- Size 88KB
- SHA256 c351e70d34ac020e56853914dc2139299364be66ae526de2276335c1a4b002c1
- MD5 c778a7509839aaf8c0b7ccf6b6f2feeb
- SHA1 a6a4b30dd9faa6e03ba3d00d0484273154e16088
- SHA512 c3d47d4630b7028f4ac2d231e3d0b11c269e1731fc55d711330f1c42752e8009fb4db5aad41b8c98bb74672a6ab393343e18976e774c3902d74690ade3a80bdd
- SSDEEP 1536:0vkS6XmTzqbKxfXOTBpp/foyUaDmjGI2naIOcIOZpFBhkxUOw2:zdXozwBppnqGnoSZpF/kxUOw2
- TLSH
  T125937B4AAAB412A5D6F781B8D8D3079DC331702007A45BDF5648A76A1F23AE41F363FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26