64fe0ecd49ad2198bd91976b966d68417530a9f9ccfc05092939427f949b3ad1

Sharing

Copy URL Twitter E-mail

General

Target
PikiTTS_v158_win32.zip
Size 1.4MB
Sample260626-alcjsafz91
SHA256 64fe0ecd49ad2198bd91976b966d68417530a9f9ccfc05092939427f949b3ad1
MD5 e40395327735a23bc7f0aa9a4c99c522
SHA1 1ea5442e163f72bf1ae4ed32b21d6d1cdc426beb
SHA512 a32f5a10c34dbbe21df25a0267b6f9af64a998df159f65112f17fc08be7db3fd8eeb11bc63bf99f41269aad45134b9845a6f93128e2d2b8aae5770b5d3aed54d
SSDEEP 24576:IrYcmECEEPxNhikbhhWyWniRO6NM2eJs+VJV2D1dss7fO62Y6sJ3t9dur2:UdCEwh/b//WnkOqmseJV2DIs7fHX3zG2
TLSH
T1CB6533DAB0C51F03D53933340AC4B62FD6C8FF68CC95C8303E19678966A1AAD6539E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Microsoft.Bcl.AsyncInterfaces.dll
- Size 26KB
- SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
- MD5 ff34978b62d5e0be84a895d9c30f99ae
- SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
- SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
- SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
- TLSH
  T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  PikiTTS.exe
- Size 120KB
- SHA256 3da4685140844cb18246a6fb36c15d2aec1578844218ab9166ffb95987e52b11
- MD5 abfc6b8b443af270b4e67091b01dad4a
- SHA1 176b4b6d9191b6cd08b82438bb45241cedb5741a
- SHA512 1bf7b199389d993eec1e59a814e94d4fd33fef68120848649e127328b1e3f7d4f478db8df86577ad9870895e735bfd9999f59bcbda786f4ce3965d05a7d05184
- SSDEEP 1536:t4rtLWjsATIadwUHkYYvWHez1oxazD7+MUu6NyL7EUL2R3ntohkXXXXXXXXXXXX2:t4rtLtATIayvRp2bMXL7/L2htoQE
- TLSH
  T1FBC3291433BC8F52D6AFAA79A070015603B1AA1EE537EB8E1D5E74D924F13907C23B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH
  T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  System.Runtime.CompilerServices.Unsafe.dll
- Size 17KB
- SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
- MD5 c610e828b54001574d86dd2ed730e392
- SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
- SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
- SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
- TLSH
  T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  System.Speech.dll
- Size 663KB
- SHA256 59aa7929fc874d5b124cf86995c0c66d27e4c9b0340c43645cd897c3162ba8cb
- MD5 58bcf3b4a615e6e7594a6d6f6b7c5a4d
- SHA1 21bacec46402102cf6305f531a48784595d84797
- SHA512 02508c963cbe00d08f7c9cdba1ed1d45690b3335c9bcae7d7f6d578bd4a27388b26be103383d433e7e3e9072c9b3103d7c6ecdb2d1c1613f154ca3111600ba9d
- SSDEEP 6144:nLAeJ9LdkY3smWuyXUHntEHVPon75+lpGrCvMa4XyEOd2EYQjzXjqL9JwV6F:LAeJNdbKHkNEHpcJ4EnEYQnTYqy
- TLSH
  T125E4291937E48613ECBE437CA09A59357BB9EC0A2A13EB1F0345F97A3893750EE50167
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  System.Text.Encodings.Web.dll
- Size 77KB
- SHA256 e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
- MD5 fa9d0d182c63c49a4c567f7c1652b6e6
- SHA1 55ddfbe80762c02f9a9c65809f9ec3ef8f7f2ccc
- SHA512 58f468c982ab66930ff37efb5a941db116e8c1aed66ebc23720a7b18f71bebe1e929bea76680294edb25f430c23d520b8a87e3a22064c5993d0396819a21cbe7
- SSDEEP 1536:AOOgOOOc2yQDmBkKQh39thfavqcdUIUdu4OzfocSWnO73TT+zo:KyEmXQh39HfavqEUTjOzfo5WnMO0
- TLSH
  T198735E12A748C75AC75E153256A085619BF0DF6F2313F782585CB81E2B733C9EA0E2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  System.Text.Json.dll
- Size 629KB
- SHA256 86c3f263ae9b4469ab1266c80471087082447eb4a38e6b97bf5e84de15c07a1d
- MD5 d7e1e8629da31f3482045f243edd50be
- SHA1 d3ad7f529c0b9232206348842e31566ad7347135
- SHA512 0ebfcae7cf17ca0c4299f6d1cd850f0f8959b49e6bbc05079fa6679838abff9eca3a09ad8158f7b0395dabb20a0b9a25efe1d8f645ca9ef69bedce45606a23d3
- SSDEEP 6144:oQ4zRvmmBhTxZOnAHqBfFgICCSToJkR4mUfimb7MVM8iHtoqurICVLeV+kctqWan:BmhZBAXM3eVcTQKiyfVtQ1RCHe
- TLSH
  T1E4D43A0467E49F3BEADF5370B07941249BB5F81A6329E78B520844E93C937D29D837A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  System.Threading.Channels.dll
- Size 72KB
- SHA256 a42e45a1bb8e6528d244f8611cf1e3e731cab481a67928c1be815e635ffe8ec7
- MD5 4170c197a5296849f9121b8ba58c48b0
- SHA1 b21001c8614c9fb82b0cf98200246530413dc221
- SHA512 2deb59c942cda0b8112ac37c1f472e20f42c7715f390fc7ebb428b73209e0e9e32194869fb7f8da618b7408c185df84b5f0fcdcc156e7f47f0cc4e13e11a7eab
- SSDEEP 1536:yQtHBHSlEq5KNB9wGicFvTblcE0riVuzvQ6:6lEgKz91NcE0jjd
- TLSH
  T185730901A3E81319FAFB3F7AB5F465214A36BE51B935E76D158856ED09B3B008A70333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  System.Threading.Tasks.Extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH
  T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  System.ValueTuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH
  T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  plugins/text-to-speech/aquestalk/dvd/AquesTalk.dll
- Size 116KB
- SHA256 ccc08d2c6cb9eb2851ed90abf4882569d30acefdf7a902061f39292e6d2a0c10
- MD5 cd431c8c86c1566e73cbbb166047b8a9
- SHA1 1a6c5dd76492ee7ba0bad6aecbf442b6166e038e
- SHA512 6667da5eea2e6877e62197a4fa315b6c5c2660904b6e3b7c066f32897d70ee45530d496278da9ebf241f2bc7e3ce8406b09ea2aaa1ce6de0ef4408670301b545
- SSDEEP 3072:w6Zbq6TtB+5HCTWyFEc19s5t2PTgMBOdqJ2oNy6:HFlULyF7LsT2PTgbdq1
- TLSH
  T122C3C0039F6A84B0DD4E7B780DAAE7B8B778CC95C70685D7622CFD50C835258EEA1D21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  plugins/text-to-speech/aquestalk/f1/AquesTalk.dll
- Size 108KB
- SHA256 454784d7e74cca22b8af90c52967818bfb43a4e072d129abd70e9f7d3a3e76cb
- MD5 f97a031451220238b21ada12dd2ba6b7
- SHA1 e10c64e62e79ee1ed1d9e5f0dadf7a19299fb1c1
- SHA512 78c233ff97bd01c2c61639da3c17f43110de4aafc627a36723f8541d0b44c04a5c1fdb7a9fa8557d0163ac86f3eaf67f6be032dad35cee013a74dcd63736162c
- SSDEEP 3072:vr3L1q/Gb2PSC0sG0AyvdXKMqNRo47PdUn+h/U:Db5aPKsG2zOo47PdU6/U
- TLSH
  T179B3D0219F578570C99D077CA951E73877394CC5C346C7928228FE3AFA712EAEC1A683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  plugins/text-to-speech/aquestalk/f2/AquesTalk.dll
- Size 108KB
- SHA256 d5b2f85bc260bb5f55cd8d09a6f99fc7a0799af9f4e7287df1e43dcc238d16fe
- MD5 8bfacc9e1c9d6f1a1f6803739a9ed7d6
- SHA1 70e8fd005be25641a0f6dc5b78d14b49cfb21bcb
- SHA512 5d59d1e83956d4e282dd134fa02e91e97caf51e80735a7c93b0c9cc4131d4600f7589ea52ab652fdf59118203a5e99dbea982666487fecf0f7b6eacd4e4f5698
- SSDEEP 1536:J+qeOL+rKHLwdSuA3d97rNArg0EyVLFjt1HeoOX3HUNd+hyy21tH0AnI:JdTLoKreR47rClEyVD1cUn+h/34
- TLSH
  T16DB3BE117F42C4B0CC0D9278096EA774F37988CAD74613974768FAA27936BEDEDB9801
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  plugins/text-to-speech/aquestalk/f3/AquesTalk.dll
- Size 175KB
- SHA256 8e11ea034d4111800da11292dd8194eb234e09137c4f220931ee5b309c4183e9
- MD5 438a5ebd2259956d97b7155a35ba26d4
- SHA1 7a60e3599da8fb00a562cfd4d2de176973001feb
- SHA512 1df3ea45293bd94de64442b729f35201a7e114866ee4e0d4474d4c1e5fe8837bbaeba2085a6c140c25dbd462516e8679f7a74d975ad3d7e3d6be511c3605c4e0
- SSDEEP 3072:kpwMaPy2ylG8BfBI++d75ehpXEDrvTBmKsrPtiWxx+XmX+qZ:JPyvzY+tH8vldsrPtSXnqZ
- TLSH
  T15C04BF346952C671E96F85340538567867BDFA10CF61CD5BA3288E3B0F28E91CE36A37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32