c62c2b3095adaeaec3971ab29b3519cf688640c6fcccf184ab587bc952cf2d3b

Sharing

Copy URL Twitter E-mail

General

Target
rose-builder.zip
Size 83.5MB
Sample260626-h161yaav2k
SHA256 c62c2b3095adaeaec3971ab29b3519cf688640c6fcccf184ab587bc952cf2d3b
MD5 ad2e2970cf663a18d319e38ec96c3c22
SHA1 7968434ed1ba3bc54e5eea47cddcca69344d4306
SHA512 db41999f297d1701c42617338b66ed0cfa9dfa52fddf2951f5921eba850bddbdd94cb64ca9c2d27c1a01cddd9357ad1d05b083703f5f155d724cbab0a7e29374
SSDEEP 1572864:nfjPsWmD8mLnfnxNeNlNQyvvwf49r+4q6Y9ROMdwDxFnR6R9K:nbUWni5WbvIf49aDHROJng9K
TLSH
T108183363D6D81B73EB017F3B72A612A7E298E8D5B30131933ED107B82C927A6451771B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-HtmlTestRunner.cpython-39.pyc
- Size 354B
- SHA256 853bc5b34e04bea407405fa47f4b573989ea971827c3e851b356f69b2b100217
- MD5 a5edec14f2f424482506ca275b5b4690
- SHA1 0371beaa9fca9c1f83fb3c2323276d78adf35b32
- SHA512 42f761517aa99abe8b002030b53e58f5875460749abe9fe03b6b26d66d4c3749d667042f49471996c6f92c9652832f35a7442c369df26956455327c28aa78d96
- TLSH
  T182E07DC763604633F35D373F91A6813D24DD784463C840221E48FA35E944B1398E3543
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-IPython.cpython-39.pyc
- Size 600B
- SHA256 3fdeecac4b5d030eaa54d1d55f6269abb43d55b993775018ed692e82611f8049
- MD5 69267c6f1d60b1ff5113cd4f92052242
- SHA1 11eca4c586bb817d7900690f8592c46c1af60d74
- SHA512 ac2c910cb8885dbf7f7b65c82d6c2edf0f8e92c55c2124fef27af15911220fb51ef1c75249fa3fc689386b8aa631618db24ad25d5eb759feb32b1a215a34bdae
- TLSH
  T108F0E1434E216A35F6D8733AC32C803C94A876046A8510194FC5B7B09D8895B64F3CA7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-OpenGL.cpython-39.pyc
- Size 855B
- SHA256 3a003eedaa7c37d01e18a7107930c0cd920f52766672ebd6de5d13abbb9c95cf
- MD5 d4df20b37625af14968aa595786595f2
- SHA1 53efa0ee9af6abd796030d957277c2fc11850713
- SHA512 dc25a718fa67440837bd9f8c98441a8baed185d599edc6df63259889f13f55f5f02ddfd4b3570fa8e62fde1cbf30e9c9e922dbc98a0e8ec61f7c9a108da44063
- TLSH
  T10B1152032B009A34E7B523BF5B4B407926A4681024C080BB7D4E75644F8050751B352B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-OpenGL_accelerate.cpython-39.pyc
- Size 600B
- SHA256 181757d1d1598cc9c80030f1434ce7184324c0b6180178c92adccb4afb88ea22
- MD5 dbbf01221e0b2f1a76d314cd032f57bc
- SHA1 a9a1bd454d6f57a0787db1cfea87421bd24351ff
- SHA512 6549cc33780fa0b0a78eb35f630f6b8a1573e06d7c705e7fba4ef4cc383d143add829fa79adeff214a3a8a53aa337eef5d5e7366af437874433cf7693014dc3d
- TLSH
  T1E0F0E1071250B11AFBA623FFF3C7D27518DB4C54D3410356918CA4747A41EB11CD6006
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-PyTaskbar.cpython-39.pyc
- Size 344B
- SHA256 892b5d388c958c66aae0264474aef9e95b89ca4c8be14403583cf23ed0096920
- MD5 a83c2b44c2c92650f5d7351d075a44aa
- SHA1 497da9b190c8ae8fed4929fbb3623b53a7d65e91
- SHA512 5284b1247731b4b953f31daad35a24af51c4bf1ab3b9a377fc8f13006267a641693a116c52b42116081d0f1d89d01e5333641bdd17533b92c55271136127cbfa
- TLSH
  T183E07DC363510A36D25C333FC2A5C27928D8BC0093C901621E447631ED44B5398E3493
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-Xlib.cpython-39.pyc
- Size 342B
- SHA256 ce7da92eacf5f40d108169c4daa5ef22ec19b214ac79f9737e95df3edfc5c721
- MD5 01b9bf0b11dee39972708f51f1d5b22b
- SHA1 5086de49f800d6659f21c3b0eed2e02b04a4e892
- SHA512 fb4f1d9a8f54b18fb1ff58480e40f52d81f974f0023ffc140742c36f4f7c6fd87939c45d5cf430aa31d13a04e9071e28ff9c7f9364b6d4c45637035dfe500034
- TLSH
  T10EE02D8383400A2BF29D233BC224803944D9942093CD10221E88B330CD88B254CE380B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-_mssql.cpython-39.pyc
- Size 271B
- SHA256 947ff0bb70789f09109b014850c00e23413edbb246988de6a809f533cf8a2fee
- MD5 c3eb4c283512bb18a0149ec419c1de8b
- SHA1 9cef74c3f3d3bc66ebb079308a194632b82546c6
- SHA512 30525d67357b0e2dd97346203eac927f6046feac578abd79498212e1771cd0d324b2a5d266f45549442c989bc86b5802123660b468ca3ef43b6e83ad9bff5468
- TLSH
  T12BD0954347502111E351573BD139C03914EFD850E3AD011115CD35344C45B0528D3D0B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-_mysql.cpython-39.pyc
- Size 379B
- SHA256 086a04e7ad203d71f7911daa899e350248a7986831d90be949e863234bfd077e
- MD5 0de9656620ff9b2816e4a8d3e5391b4f
- SHA1 aeb0c56e7faed3e82cdc4044d77d06a7dab51a73
- SHA512 69a93bcdf22859574651695bddc16e23a1115d325bbec2dd3734a39e723eef4b23783dcf1a166853dbb192960242cc34bf01657240172ba98a54ac0886ef573a
- TLSH
  T157E0C08343503152F607B77BB11EC13715FBC5E2530422D24A8E56796C89A111DE384F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-accessible_output2.cpython-39.pyc
- Size 450B
- SHA256 08ac37ececb2a2e13ff28e09a5a4fdd6a0ae263cdd55baaf0ec28a8fed973a22
- MD5 f5d65a5bb1c973f6a3f0d2d7b3af5f06
- SHA1 6e1fc32c7bb27aa36bc1312b8e94465447db8fe5
- SHA512 6c34a48cc7b209d3cef1bc7d89fd8250ca149309e0f37d0297593aa91398c76c0951a35b01fdf565e16f30b15585f96a1d97f62e09cc5249582b19f07fcfb028
- TLSH
  T1C3F0A34343083515E72117F6D115C37D11D9F442A7AC0831ADC42D3125C524A57DBA87
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-adbc_driver_manager.cpython-39.pyc
- Size 355B
- SHA256 f7429b310b267afae9779d996648dd310b7e35d34918053efaf3fd4e7b777889
- MD5 2c1a949fbd0b93ffee3a04c4ed675692
- SHA1 c935178a9afefbc25e3076900b9a023ce98d1660
- SHA512 3cbfe81486511727bb9587d221f1b6d33907c7e35e40fe2a906284ce8548a205af430010c47518203743df5c407ab8a810a4abde4308bc40c9c6db969c4f4377
- TLSH
  T1AEE0C046AB251523E56F273BA16E443471FA4855C396001255089A30825464A25E3087
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-adbutils.cpython-39.pyc
- Size 487B
- SHA256 93518ce52c1237ba825b9d9db5b18c5335d4f737a6cccb6840536c71086f0f95
- MD5 9a5cc26650fe84c68ddb48b90a0a85d5
- SHA1 71904bd2dfabe0f8b8a59f1addcf556c5cf519ec
- SHA512 9e5a78f2e388584835290dbe9478f2f47b276b9116123273adbcb304689124d4eb7b82ab9e82f86af192def4eb3d78a02b70e959d6877059ae2ae56d17c99856
- TLSH
  T119F0DCC3C6E04F11EBE4333A8332843D11CE65A8935810311B893772ABC8ADAE2D3923
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-adios.cpython-39.pyc
- Size 348B
- SHA256 5bd0de5bb8597993f30a9e48b2441435aaeae5be60725a20166aba0643f2fbaa
- MD5 dd2491fa03626c14183f23b00d64ace4
- SHA1 65c725a63a52de89c352cb7c21debeddd7c7826f
- SHA512 92b62b1d9c84cfa8cb8ec8cc3d774bd9f318b2389bff5d8a22b59358f5a89339fdfa9385a98a233b028ca7576897342a89d5a685d3a5f4eeba4c046ab699cb3d
- TLSH
  T161E02DC212002203F3262B3BC36EC2BA10EB8888D38400204A4B78382D0870235C31CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-afmformats.cpython-39.pyc
- Size 346B
- SHA256 b1a584212cbd77304496437cc1c9ac78754720ef480c4ccf86939b43330edccf
- MD5 7f0ceb3ed874d12aeeb69cf553a9b63c
- SHA1 7b85a18c2c9cf14d65d835169ee4382f2b82e38d
- SHA512 872ff0564a8a3e9463bb785009b650ce29e8fed22ac20026a39913410a132e411fa5a4ffabedf836a59c060f4904a35f6b8ee24dde7c5042f4a777e3fe10ad32
- TLSH
  T12EE07DC3E3505672E26D333B91B5923A1EDC6850A3C950231D84B531DD84E5258F3943
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-aliyunsdkcore.cpython-39.pyc
- Size 352B
- SHA256 ad38fbe5d3ca0aa25f7e7deb881619aee194732b97f1443e1fe69f2df189cbf6
- MD5 dd020c6ba7ee1967d591670050795352
- SHA1 9ae12b67a6e22573c6b86b4edb467a5f5b342085
- SHA512 ceac71f739e77a5b00efa12ef475615aa7e01151492fca01aa03d5ce2c556eec3823d858336bcc827b335276ae04fafa612f75a6975e46b76a878bcc96827a3c
- TLSH
  T176E07DC3A3541632E75D333B8179813F60D8B41493C910A21E847931ED84F9298E3893
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-altair.cpython-39.pyc
- Size 338B
- SHA256 69ce8995e33103c82ff491b250c605e21fa7acbd7e91c0eff703a5f1036cf054
- MD5 dcd1cc146c626e117f5461426f8b7e37
- SHA1 bf2fa3bfbe9fc00fa0d07528a6fa1d23fc0a12b0
- SHA512 148570d7ad775698c7aa33fe4395d120785bb0ee814a0dc4d81d7e3ccff2376368fbeba419827bc1ee905ba6bdb41dc37e33223e4e40a117368e4cddd7af7e59
- TLSH
  T1ACE07DC393601E26E25D373B8165813D30D9641053CD20632D44B535DD84A53DCE3543
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  runtime/Lib/site-packages/_pyinstaller_hooks_contrib/stdhooks/__pycache__/hook-amazonproduct.cpython-39.pyc
- Size 738B
- SHA256 2aba50df714be882c46b3f7b04c081f3e0456d2c6f05d50eeb5a1d542592f5ff
- MD5 99b3f8b6dc25bc3e7d3b87a2140f15a5
- SHA1 11cc2ebe3b5042091adc7e42b3b8ac1dcd26e850
- SHA512 452d57f648b4691a275a4f0fabc7cc81c947aa7376244cd4a3d7ab52bd4326242a6820867ccd2f822546443763180148026855668919139378c2e75754577612
- TLSH
  T13E0176C2DC394636DBB82B39F13482D63CEA9C34F3E0C021E611B9AD390663256C244E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32