0ced50966af027b094a596c7babbe66c05e20489e7c5a3a4fddfa1badccd6288

Sharing

Copy URL Twitter E-mail

General

Target
blur-1.8.zip
Size 141KB
Sample260626-qw57vaby2v
SHA256 0ced50966af027b094a596c7babbe66c05e20489e7c5a3a4fddfa1badccd6288
MD5 1f0b5ac618746f88a58c216b291f158d
SHA1 23f3073c471ca223ffab2220b99a405c515147dc
SHA512 99fedebb9e7937880c5ba5bbacdf6605c510f7760fe6f9abc7f37a95a42ecebfef97ee471c21ad7d8fecff3911b43479ee438699ff50243e6f79f95e18533e9a
SSDEEP 3072:teritM/pbBhzHRNy+o8mq8miy51dou4EOLgr29Ld3pexgdECGdWNH:0riIhjR28Kybau569Ld3ugdRGdW5
TLSH
T1A4E3F1B249DCBC62C06F18731C94A295FBDCE855118DBA8645CB21783CDBC7A2F41BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  blur-1.8/blur/blur.cpp
- Size 6KB
- SHA256 c8ea55081db4a0bb27b3a7d8f6f5fa057ceaa47b1fda5b256a528ed19d1b5382
- MD5 1ecbadc0061d9e850e823959592e26f9
- SHA1 fb876c74b21bfbc7dfb4578cd0b8a4e824915ee1
- SHA512 4c301063555f3d224b27aa970ed1e1a0534ab421126294df0156345d081d7716be6b3fe7ff246dc2aaf8ce7d5a057725b49d0b25c238ce10f146e013b3e9d5a8
- SSDEEP 192:LTADiA/6LWi2Wty0CPg6WM4hxMVxfLNe2m8eBuYoEIY:LTy6aixsg3MUGm8I0Y
- TLSH
  T129D18500FAFC3D165F853538DE94488F196E35F65BA409B2FDDE54AC0098D3983BAA70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  blur-1.8/blur/config.cpp
- Size 6KB
- SHA256 55f18554942489640dc823dcf2ca5402e079ecb0161b0c600411cbe278ee9e7e
- MD5 7d7f192c80e8bdeadba806867e137b36
- SHA1 18e4064c6f393ece86ce9b5f6e3f8aae4f11b6c0
- SHA512 c58d0e5415f75dfed62e7712bb161588a848c1fec356cbb80185d94278763fba872cf2ffd9256dd4abee707cd662af69d4faeab82a490b10dcee175bdabf7e33
- SSDEEP 192:oPOB2WPW/24L+RftnodmLUCB4n6dmbvNZwytIuY:vB2WPaitnMC8bvNZC
- TLSH
  T1D3E1F293E82D6C3A91965D31E2A422AE3D380340FF76EF758F252D1D784F4C89366167
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  blur-1.8/blur/main.cpp
- Size 990B
- SHA256 3f19eb23b643a30f8a9350f206fa7432346c08e3a1589a6647da6f04a60cf856
- MD5 4a801c9e6d69469c8323aac21633f205
- SHA1 5d11c2da16328400eedc7a18fe02a834386b2320
- SHA512 f2abc736d5561a76a88a078a4f83ef3fe711c5c084afeb0c8add8dfb6cc6287c9cdfa6d6c89f88abde1590b8446657414b44e08c4c07b3c8f45674430e2d83ac
- TLSH
  T10511CE20E9F86A4614D31095255148800CBDA2DA574B0F9BCC0F88F598BD83AB7F3AD7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  blur-1.8/blur/preview.cpp
- Size 8KB
- SHA256 0dbe63954041d13d86d2b88a0da0aef3b9174a785d31aacbc5d49122abdb209f
- MD5 06b67f91689d21983569b5b90a8206ad
- SHA1 f01ff41fb9b44203a99d02f8a3e31a4d09528a65
- SHA512 e4e0ad8f99c05cacf35b312f9d9643e2054c8b4c62bde059ef8c9f9d07a95473756c95feb1ca80e83b97e61ad81fc0d7c1ece3a91eb76c7ba13dc563294b0a02
- SSDEEP 192:78EfyWxRz/fFyRz/fD1iTRz/fHERz/fh3PkQ6TcXcLEiXinLU01la3rJVz0Mlkjz:E16TcXAyzsj0WkjTqFaRc7+
- TLSH
  T1A112FF1248B62046A423892F5F9FF211316F92638569DF05BF8DD368EFB10E3C5A17E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  blur-1.8/blur/rendering.cpp
- Size 8KB
- SHA256 3a6f96a1d827b31ec970c3ec8b1db75ef2dfa3685c2d67672cdf1289d7c0f2a9
- MD5 45964f94dbdb19dcbc8ad7a0c8e11b9f
- SHA1 54ea52a97f75ba2f25d5a638b099fce0f95b58e0
- SHA512 f74b6dabf53d93dd534cddb28259b906a1124d02acf8301bce54eae0f59637656459448452b7cdc27dc63ee72d2221abe87c9ea074df90093fc3ba005ccee915
- SSDEEP 192:w2CUKClorQt9Rl5sulyG+6Q7gXHFQe42jPR82q+f8x0WB:w5UDuulNQ7gVr42jPrq+fY0WB
- TLSH
  T1B5027642BBFC189512502578EED054CE0B3E25B207BCAD77AEB9663C505CEB8522DEF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  blur-1.8/blur/script_handler.cpp
- Size 6KB
- SHA256 7d0574ac9258851dadcb5c0df380ece2b0b37b7107e4b2b86e717dae0457f64b
- MD5 a54bd3beb0e1ea3a5f661b28d0d379c3
- SHA1 78e6c37063456737eac8d0f95ce7dd7085c9a892
- SHA512 dcef0e87c6fe7eab4d599c73f551394041147e639b750d4c97abd498965b2c9a4d3cd83268a1bc431115a3451f3f0d635e2777b9e2c78047b6e757bcc81e02d1
- SSDEEP 192:a0z5kRD6CnrfgxzabP/5MibIwbI64ZMKIBMpvTN:a0zPCT1EwE64ZUih
- TLSH
  T194D1D292AC6FF48C05919D38AEA8809D3A7C44009E36DBA2DFE30D3D7C519DC67257D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  blur-1.8/installer.bat
- Size 6KB
- SHA256 cffee26063ab9fbc2703bbdf5b1c7c05af6332309876583a6e14590f68deac49
- MD5 4358a511c3b2a83caa8f38fea2d458a4
- SHA1 3c52d8fe7525afe0483da969109c0e8611dac093
- SHA512 fb2bbee346b8d2e06ea6be50daeccff37c76de03cc5fdabe2809603c24bfd330baee138265ab1e2c62ae4e8629ecd4a26bc99c5ac057bbc5477b9424fac44577
- SSDEEP 96:/zA6QFzKF3h3TLN21MV9PTzqn4PaJ2UtTSRWE6rJOAOV9xI59JYesvwCJNH8WSCE:/El2XV9r44SNtuRxkOAAk5KoCJNcWSR
- TLSH
  T1BCE144575F195B7C2FDCC96EAC8A68E8C157837309A94C5AB2BF0019BF424E502BF1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  blur-1.8/plugins/filldrops.py
- Size 718B
- SHA256 ff4bf5c0d24cd45f227f55242d5ecbe2d01bc1dacdb49089d591b8456d713720
- MD5 480a787b60dd3cbfd99ce08c5a2a759c
- SHA1 1c1f244960f35b724bd11834e81f855f19e933da
- SHA512 9b4d1dad75476da50c2090c2b5195a9540177628d01f7b98dc2a3320a85d3cedec5bf29910160afda66d58ef8e276c1e76a0602ae983330b672ab0845e40c03e
- TLSH
  T15B0170846B832420CF57841E56DF8127714E6EC769084517BC8F0259EF21DADD7E9465
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  blur-1.8/plugins/weighting.py
- Size 2KB
- SHA256 901253b664da6427ed7e83722a903865a613ac78d70b0cb6b994e97b5f0df409
- MD5 ad74506e935ec445273ebd2c0ecb30f0
- SHA1 468405bf0e394a5803206662021106738f638d45
- SHA512 d5bb108515371bf7f1fb29200ed14fc8c2ff87224ba034772ade79dea3fbf76601e4e66deb219ae2270524d9e6401c53ab76a492d306988582fee361d75b4198
- TLSH
  T11A41E22F8E4325DCE547E02E54EBA9017F6F6A43740998AF7BDE44201B81C25E3A5EDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18