6fff225afdb1623405b9a451c24d800b5fafb0e450fd66cd35e980259f4a08cb

Sharing

Copy URL Twitter E-mail

General

Target
znjt0ws.rar
Size 1.9MB
Sample260626-bapweag14q
SHA256 6fff225afdb1623405b9a451c24d800b5fafb0e450fd66cd35e980259f4a08cb
MD5 341744d46d8f76753f89a942506828ef
SHA1 b7274523f868d0a800612b6567d4947fe4bc2038
SHA512 d665032978f5f5e72587dcccd23ec4f1789b69db965e4e64aa34bfb37d7b5960d1aeab3681fc6ad82586f12f746d39a9a9064ae2f3b5ca5a792a6d9f488394d5
SSDEEP 49152:23fK67oBRFeE8Q+0Mdvko0kXHCZrZ4t1ZYgHQEUPm/O:23fKmmRl+06vrCZ+5nO
TLSH
T18F953378F03903A7A95DBD92322F5F8850B43B7A9B5ACB5DFFD45E4721EB206148180E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  znjt0ws.rar
- Size 1.9MB
- SHA256 6fff225afdb1623405b9a451c24d800b5fafb0e450fd66cd35e980259f4a08cb
- MD5 341744d46d8f76753f89a942506828ef
- SHA1 b7274523f868d0a800612b6567d4947fe4bc2038
- SHA512 d665032978f5f5e72587dcccd23ec4f1789b69db965e4e64aa34bfb37d7b5960d1aeab3681fc6ad82586f12f746d39a9a9064ae2f3b5ca5a792a6d9f488394d5
- SSDEEP 49152:23fK67oBRFeE8Q+0Mdvko0kXHCZrZ4t1ZYgHQEUPm/O:23fKmmRl+06vrCZ+5nO
- TLSH
  T18F953378F03903A7A95DBD92322F5F8850B43B7A9B5ACB5DFFD45E4721EB206148180E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  rocky-external/rocky-external.sln
- Size 1KB
- SHA256 132ea6649b030b74aa71c1214bee72868ae31f976633213b539fb5bf2200b7f1
- MD5 38c797d5bcafe59925d95a43698b7abd
- SHA1 e3e4ad75bf6552a1420a2acbbcf94f796c1584ff
- SHA512 92190382dff717dc3daa69dae3504b1b3911c7811822e242128fe16daa4ec61937bb62439d83ee0534485201caa5a4d4f06bb2a9b50601ec973090617427cd9a
- TLSH
  T10311A098303F9490B95E13BFC4B60CE67E738279A1AD1A3D17DB60CC2793A09816F55B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  rocky-external/rocky-external/core/cache/cache.cpp
- Size 4KB
- SHA256 8ada4589d59540c53119a4d92152fce280d5866b20c6a749d30f5eb304528016
- MD5 821ffa29242e4e133f433603b2c30350
- SHA1 86984f84a53fd1a489bcb6e5ec6573c34725b39c
- SHA512 4d73c23aed61c9c166ec94fd5c0f2f9ee67b3a06427ab17a02d1d29c3c0d7bd144541838d030b5eb2d597bbf1c215f543b98e457c84a4106a24adb5b16111599
- SSDEEP 96:r0PKYFC6/yrHOTCorMCz3lUgD5CKfe9C1bSnLGD:oPKYFC66rHOTCo4Cz3Oy5CKfe9C1t
- TLSH
  T10DA1AD893D2F140EACF597DC017C7910F970B0729AA59363F89CA2A8798C61C5E7A13E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  rocky-external/rocky-external/core/cache/cache.hpp
- Size 1KB
- SHA256 f7439165b31e7994ae37f0c70fa44bb6028d17251cbaec40d1b2b6cbef4bde2d
- MD5 55e8de781022dfa2126f18f8df851eeb
- SHA1 51104015f44e035f6a3910a748158b3673e5551d
- SHA512 ea08e9d1e7f0b320acad760d70322b821b9edd38848b96509e59604b9b9a6b519fe93c72538560983fe4f0f89869ee9250fc1db38680ec3b7ba5b583b5368884
- TLSH
  T13811A695787EC1098CD33BFA85B92634F01178A15BC77392FC45E1F828624189F7646E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  rocky-external/rocky-external/core/core.cpp
- Size 2KB
- SHA256 306dd3aa9470db0c142fdb06731f3e7c2ad3d1a756ffb5b8d516fa17d9f07e3e
- MD5 e98b515203d2b00b10546981c222ef4e
- SHA1 6ea2a4305ab5f1dd4565c559762e14c75bf988be
- SHA512 e1e88aa5a50e96bc105d5ae209bd5821683b25377243c84a0a8f370e38c12343941a3ea122eaf3393fa7cb50e977ca205ac569fd23a0a76b7371aaf1e31f4e5e
- TLSH
  T1FA4101C338BF6D7B8A70A694D832C844AE73D52903A6E316B58F4209E7741965337478
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  rocky-external/rocky-external/core/core.hpp
- Size 129B
- SHA256 6f3ba0b309e0f52151f15fead160d592ebb9a5fb10cb2360828d35617a0bcf06
- MD5 b653a76788dfdff01e62912e9ccb62ab
- SHA1 c2140868e86402881deeeebaa4e52b3edfc4fe76
- SHA512 22ce8969d5cf0b65447da5f7089a070cabe5ab2cfb900a3dffec819419dbdf7a610ce7a2610b595d48eed948954a4cd5695f516cd60746511a437cd544951d09
- TLSH
  T1A2B048A19E8685F18A22869FA4B04682665036AA8A095B077EE2427E4A228C1D1A0429
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  rocky-external/rocky-external/core/drawing/drawing.cpp
- Size 4KB
- SHA256 f35e2e8418de50161b512afa4b80a90262e3f2e478a42a5633b7c61f086473f5
- MD5 6e0a90b27ec5a336bc87587aa73c1d0b
- SHA1 db7ce704beade15fcd83232f56dc4f7dca679026
- SHA512 189c117c70c83f28bbfb531ae9d4a50ef7198deefcbbfa2c11a5e7b032381cd8f7d7996bcc2423473fd85665b50081e2d55ac8caa6e83ad7a391862cfaf3d8ac
- SSDEEP 96:FMfDMsY2Nr4qXyTruF+XcTvtYfDVbfElpW23r+2a:aos/r4qXyTruUXciQaJ
- TLSH
  T1B5A19D6F0C9306551E51A018FC7B7C8CA78C34A9FB7096DE9BE609E2217A054C5E1BFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  rocky-external/rocky-external/core/drawing/drawing.hpp
- Size 1KB
- SHA256 632cdfdf2d77bf6fcbcb6fa7bace5eb73344dcee5a33009ce615a668d371e699
- MD5 e3df5115141ade9bb9c6b11e4aeaf695
- SHA1 ffcd10eb12690cf271d08f4aa1ffaeead7f0d1f7
- SHA512 252d959410212985ad0e88cf783a2dd3d804253d01aa0b19b69954812de1e72cb3254eab55c42a67c6738de3705f4bf5d7cebf7cd96e07e751808d7838e94239
- TLSH
  T1A111AF4690E700824C53F219AD35BC4D734C39E1B31D6428EA8E6296911D1BFA1E6BEB
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  rocky-external/rocky-external/core/features/aimbot/aimbot.cpp
- Size 6KB
- SHA256 41033052bd591e1bee449adde097cd73364895ed750c80c5ebb9a469293464f6
- MD5 ccf1992566f7dbff32466f3df528531b
- SHA1 3e671710169dd2018ffd2beba9c438e3d72b61ee
- SHA512 95898567afa5f4f8a0d9c5b0a93a32acf6920b19ecb1963ff9e055004a5a7dd19f4e45a949d6df32be4e9f4a945fa8f85afb550392a073187c531fd1301a41f8
- SSDEEP 192:aZ1JmakYe8b3D7er/JXGnfGs67/rii2GcWyNe86BSXaU9wsUxde8j:aZ1Eue8h2Ke8ue8j
- TLSH
  T13BE182D572FFD40609E72BC590390542EE6DE4F2AA296216B9CC808834EE104B7FF8DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  rocky-external/rocky-external/core/features/aimbot/aimbot.hpp
- Size 1KB
- SHA256 27ed749ca1a2b1f765b9685525c6ffc9c195abd204bdb1bbec86e951391a849c
- MD5 053c2bfdeab8a3aa36475c42c5b20c03
- SHA1 e8814ec2231a4104c2e3a09d751221bc82128ed2
- SHA512 fe7a7d51227ebf8aab1f1fa4cf64e14a4c62420e53d2dd9064f524d175da9bfd52ef5458e0b125b11d6aa6cead0513c37e1e4bb04f89604550f5bfdd3e41bb8d
- TLSH
  T18A21458073FF145488C35755D639A258ED2E64F3668316A374C512E16863000DBBA814
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  rocky-external/rocky-external/core/features/esp/esp.cpp
- Size 10KB
- SHA256 9218e76e0d4e83ccb5217de0c7d0942f257fab0b3610de32ae1b6baacabbb5bf
- MD5 fd3bca89ff9b26a2d15456138b943d9a
- SHA1 78f343baed7d180f5e588ab335bccd0cc294c597
- SHA512 70a8749a525bfdd4cce740a01c371e86ab1e28ef200f241640019ac17bbd3619bddbf11b57f7262fe93d1977feed5df5bbb6e1af8e92ebd5e4e8d8739555210b
- SSDEEP 192:OzEU8ZqDZ8Nbj6BDSsKAF/4KgBI2V71YvsXXTiOTe:5UHMrsKAFAKr2R1YvsXXTiOTe
- TLSH
  T18E2281C5B26F98026FE316C225358818AF7ED5F6BF51D3AAF89D809431F6016F30C298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  rocky-external/rocky-external/core/features/esp/esp.hpp
- Size 3KB
- SHA256 23dca517f35830c2fefe46012b122392507f9efd4dd7a6406f123586af7a26be
- MD5 d39bea2fabeb2b485bcce8bf2d6b4f8e
- SHA1 f98dd9206a3432ad67c1843a4250699920be952e
- SHA512 99c7c5a84e10e584a9cc3eb6ace8fbb2c4710b648c2656605e5f699f7dd742bcf9225042731044d0b11216307b087936481f20bfb53e602f60d3ee88586ca510
- TLSH
  T1C0615EC53BF7FF024396056714F0C002F6BDB8E9190BCA4D9EB69451B566253D2B4E74
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  rocky-external/rocky-external/core/features/features.hpp
- Size 4KB
- SHA256 74a5dfe43cf4d43b03b04aa219fcf7bb550088714aca5edbd02d5fbb3a4f7855
- MD5 9abb9f70779373548a0b399884f5f88d
- SHA1 6eaab57cf9c4a12e021f561e49f3a7db2a30f11c
- SHA512 9dc734ec1dcddf6dabfac7d284f6824bc6e0ff4c4a22517e11cac67d2ee77e38863ec9a9a12373af2e9fdec61b269fafaa86e178bd7e3ad96c29d4fe22580c97
- SSDEEP 96:iHJUuSPdl/OC1cFPnnuwfIG8R04B8BnloVwQcR2StoB:ipUuSPdl/OC1mFIG8R04B8BnloVwQw2f
- TLSH
  T14891B08992ED95FB24D3A8298E384B453E1CC6E1A5DD2375F1ADC87B3055644E2C88CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  rocky-external/rocky-external/core/features/raycast/raycast.cpp
- Size 12KB
- SHA256 41ce5b12b16d15eebea4dba1e7fc098d084a590d86e0119e48de826079bb86bf
- MD5 339161ad569985d39ae8bb2f04471dc9
- SHA1 c79b8ecf4d853269b48fda462dd22148ffbe8c1d
- SHA512 9f5ad002bdad163b71ccf4ffa59ee4c2edf6bf62da8df5b4a05aa4a4e3280a06fea057fb9b7bef963144a550acc9112a1c48c72c6ea561d937c6361e93273bcd
- SSDEEP 384:rbejRXRvSYKrS8lBKKuRAyyqzvZp0H/7lAEp:rKhvSYALDHH/v
- TLSH
  T1694240C4756F6C0E9FC6A54550370109F62DF9F3BAD2E3EAAACD426028E2909D3794DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  rocky-external/rocky-external/core/features/raycast/raycast.hpp
- Size 1KB
- SHA256 c59618997a0a5bcb93ecd948e76ac15d6d225b0e11748f502d00dce2879c7be2
- MD5 e55c15fb75867b07c5069e7ea5d5f808
- SHA1 1b3b189f994064c0c6013ff5ec5487d92ef1cc2d
- SHA512 22373bbdd30e3b16e317474e7b486baa596d1051e060eae375f90dbe16c2cbefeee5a280cd1b4b4ee1fb0b5a65caf503c8bd636c5597dcfe7901ea4c2d6c6543
- TLSH
  T17631C180B07ED9068E43EBF154B58043F92071F3B789C1D1B65895785C632A9DFF2E86
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  rocky-external/rocky-external/core/features/triggerbot/triggerbot.cpp
- Size 2KB
- SHA256 1b91512936485d232ea835e6dfeb9623dcb2460169654396021db8433d655377
- MD5 9d0ae7ea493920313e68cd4a6eecabb2
- SHA1 1b948038ee8ac48cbc9f52f122bb7e1ae0006ef0
- SHA512 b3d1ed162b041b15070f0c3444aeba43ffec5fa3f5688205f6e3093539a85d08a1196b754bc5d0063c5ae909869581640578d5e514cfac5b8b2c37c8ebd650c0
- TLSH
  T10B41C0DA765F744E8DC606D5C9311319EA2CC8E9A65BA3E4FCED429811A420C83DD89D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32