6c4cec8ce8fdecc8b52dffe2b47b8e65d46bac18dea44b012233bf8499cbb8cf

Sharing

Copy URL Twitter E-mail

General

Target
BLTools_v2.7.1__PRO_.rar
Size 4.1MB
Sample260627-2bcwcadz41
SHA256 6c4cec8ce8fdecc8b52dffe2b47b8e65d46bac18dea44b012233bf8499cbb8cf
MD5 c98082f3c157b7e13e16aa88edaebe34
SHA1 5cbde75fdd25ee1d7b0364b138323433c0b4018f
SHA512 52240ae494a870ab1f0fac4fdbd2861837164758f8a6d6a145936b2cc4a142677160e9c09ad5ab6b8f4365d55dd1ca6e9561c5b80dfc652b3619975c2a437c89
SSDEEP 98304:1+y+NcEwVayd74XsLQnt7jghrE/5uAIT9mo/sc+XkPQkGP:0oJayd7GsMnt70ZE/cAs9c6PQpP
TLSH
T1CA163379427B58DEF8142612562E311DF033E0E92B3A43C96D4206AD3D7F5DC4AB94BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AlphaFS.dll
- Size 359KB
- SHA256 837f2ceab6bbd9bc4bf076f1cb90b3158191888c3055dd2b78a1e23f1c3aafdd
- MD5 f2f6f6798d306d6d7df4267434b5c5f9
- SHA1 23be62c4f33fc89563defa20e43453b7cdfc9d28
- SHA512 1f0c52e1d6e27382599c91ebd5e58df387c6f759d755533e36688b402417101c0eb1d6812e523d23048e0d03548fd0985a3fd7f96c66625c6299b1537c872211
- SSDEEP 6144:QDyJst+jyCnzLp9hvHsPvPvPvS2JQvlojidPp:QDyJsvCnzZf4U1d
- TLSH
  T11B7429202BEC412EE79D263EE4A16516A776D1C5132FBB89744C9FF76C8738D86012E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  BLTools v2.7.1 [PRO].exe
- Size 3.5MB
- SHA256 15902937bce71d868eedac8de3e2c865935b22ed4c66ffadef61bf2d29238d1f
- MD5 1be3cfa8f6a7f61bb6cf420d94ed6465
- SHA1 7a0b6b3b641d52a399918531a15be2c69ce39859
- SHA512 67fa714d46fa5b01cf8f6fd899239615e8b1c44a3d80f483aec447a280ec00dde27da38f0857d83baf9d86087ecfb2bad96245c483555cba80031201057e4722
- SSDEEP 49152:C6w//gr6sYjp0wFhlMv6DSdsHXgzSq0Xll2JE+b060Ilw:C6w//gr6sYt0wFrNDSGH8Kll2K+cmw
- TLSH
  T1F5F5C50D976F7225D3EF283A885772B6A7705CE1571A830D3E9B3C2EF603684AB951C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery defense_evasion
behavioral3 behavioral4
- Target
  CookiesCreator.exe
- Size 200KB
- SHA256 a61fe2cf0e51860f3bfde5b6159f926748f7d2d0b7b397831bf695f63cf99106
- MD5 aee127951627898ff120d3f4a3ada964
- SHA1 1da0e77703872601b7cd6b74a5696d286a7545af
- SHA512 221f166ba5dd946a51301bb254a433f76c6d9cdd616d8bb3c07d88a32e3be845d348975ce0166e0a004be25d696acfce84573676f52eb79951f897302ed13866
- SSDEEP 3072:C/lXPYzLKksPnCWBxfI+ieRR0bC9BxfI+iek:mCCxQ+ieRuWrxQ+ie
- TLSH
  T11C14C75739434BA2CA6CCDB1601F40F203617D7BDDA5C6A9EADCF2D909223C1B50EE69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Extreme.Net.dll
- Size 121KB
- SHA256 8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd
- MD5 f79f0e3a0361cac000e2d3553753cd68
- SHA1 4314bcef76fddc9379a8f3a266b37d685d0adb79
- SHA512 c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355
- SSDEEP 3072:bdoECIgjBibgp2tBqL0Y++ruXqMG4ih3lbpMqc:bdoECIgUrG
- TLSH
  T10BC33B6C67F80E1AE2AF57B9D47042408739B60AA20BEB1F1D5874EE1877791C901FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  License.dll
- Size 5B
- SHA256 04cc5b3b49a7e9e9b6c66c7be59a20992bf2653746b5d43829c383fb233f88fa
- MD5 b08a5c34cf0a06615da2ca89010d8b4f
- SHA1 626a77d86d9d12d1772f788cf67c8e77fd9f797a
- SHA512 5dce742cd0f649461b08f8f8018e0fa39ef19e813a74a91f434a15754a4fa8be83096e8fa49cf1828ac011220b7ad3724e7e4ea9cce7937a3168169d8e561b2c
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  MaterialDesignColors.dll
- Size 295KB
- SHA256 b5ec30c93b1d2b4631ee2b178750ec92e302e2e331090ec9783981b9572354f8
- MD5 5c108c4da6d03f0fa2c3b4dc7890cb52
- SHA1 48af67b6166068b6f138306bbd1157c7583c6e73
- SHA512 48d055610eead361809bd839c66ccdca1d5e0d9dffe15af9d15afa106ee7791c8b17acb91f2aba5cf3dda2997b049bcf70b43c3b56b8b01f1fc7bb845ce6c91b
- SSDEEP 1536:wr1In+fq1fDfDemxD0EsXpGX0EOAcTtU7fKoVxbzQcV:G1WB1PerAjOAj7fKoVxb1V
- TLSH
  T11354755C1250E0FED813567A5838359972277A36AB948F8AEEAF71FD8C1600B4F331E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  MaterialDesignThemes.Wpf.dll
- Size 9.1MB
- SHA256 344e2cee979e979932f504dc76bd75e97ae1ff46caa3fe2795adfe0a866347f7
- MD5 824cbf63999f954aa1747f79586a4d3c
- SHA1 5f1cd6346a45024bbbe09e304c12b6f6bf227d5c
- SHA512 d36149f7cb5ffc62dac6bb4521105d09fac988de567e181fdca4f23e5079aca5f4292e1d314f797f1a597263ddac0210060cb71c111565717e3a288a47770c51
- SSDEEP 98304:PW8EOPXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCRM:PW8lnJ45/9iD54+V11bFv4z
- TLSH
  T100A6B72CDD05A727E2B7C164809E0A1BF1A2856AF5395F0E70CB1B693247A433E85FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Microsoft.Xaml.Behaviors.dll
- Size 142KB
- SHA256 8e77a1dd5e2df4d4af801376cc3428b082eb49fcb6e647b933967fae12ad9d5d
- MD5 95f46f34c099421d917d5feadbb33edb
- SHA1 3d1cb9cf59000012734901a35baeb3d9c1dd5db3
- SHA512 c9c9f72980316c68ad2a8dbe2c6c563c0deddfc9e845674d0e2f5313a0ae285d60a755e2ca04164f78b37a36521259307b3eb7d43f5ec9a9de5507bda7e4c1b8
- SSDEEP 3072:lN+EM1X0WlL9JAn11M1dXcGkOsizI35rCj8SIP:v+ll79in1h6
- TLSH
  T10DE35BA553FC8A2AD7FF0636E0B011144631F797B923EF4D1EC4A1BD09A378166126BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Ookii.Dialogs.Wpf.dll
- Size 103KB
- SHA256 285aa8225732ddbcf211b1158bd6cff8bf3acbeeab69617f4be85862b7105ab5
- MD5 932ebb3f9e7113071c6a17818342b7cc
- SHA1 9ce2d08bc3840632092325abcc8d842eeb8189d4
- SHA512 6b6086cff7b916c0c4536e3c7cba4ba17d6c4be2e4a88a5877be852e197f1f9c9c120d1295acf2b4277a9badd8cfd229ef3c1ab2049d0aeec22d3033be156141
- SSDEEP 1536:qgoPBGuyAy52V+gtTLq6ZUc68h8O0SB/XBboIawHUPV5bKLh8sm6b0gl:qgwBGu2IV+ghd68WOxXBbx+5of
- TLSH
  T181A37D36335C4BB9C9DE0EF8E91555998330E9442267EF1B8885B2791DB33518BA32F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Projects/Ebay.proj
- Size 493B
- SHA256 51314174405fe1d723621c67c12c03550426f07a83ddcab9e36e6d992498d899
- MD5 a57e89250a50c010b2b6edd2efd0b39f
- SHA1 0cd0236fb5ad6ebd00ce2a6796f8939e7eb1bbb2
- SHA512 b5a14908361331da0ebf1651324149419b20806a36ea25916a57be072cbfdf7992575a5d64e8335bf8d4bc9060c948d12a54f6be0a31ea39ad972a3289bb7f92
- TLSH
  T10EF09E036C5140675750844DFC26CFBAE3B2003EB0F6E8728894451939407F146E8585
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Settings.ini
- Size 3KB
- SHA256 b42e2475300f4f45b9c9c6d370f9e4e22bf374d20e546b71e5b81e380c2e2947
- MD5 f7b5808068d07a82ce5e96ccd256edd3
- SHA1 dcc621478ff5e4d2d4be50b9beb033a29209d79a
- SHA512 1be6e79dd976fb47f20015b05cc6875c9554f5eb9ec66d28429943b7b0fd085ff7931e00005120d7a87925c634fd824034116c574e2e91a46ecf3c5d15c18468
- TLSH
  T17951960C393F998437DB42B559C04EC2DACCFD5D8E8A360673B9A69116D97B230BB472
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22