3bcd8bf3ddc243d0225f41f0ca66b5588f7cbf19dfb23b2cf9447dd3cc2ad0c5

Sharing

Copy URL Twitter E-mail

General

Target
test.rar
Size 7.6MB
Sample260627-d26dkshs9j
SHA256 3bcd8bf3ddc243d0225f41f0ca66b5588f7cbf19dfb23b2cf9447dd3cc2ad0c5
MD5 5c2ebb00187ef37d5c0a9419c718ae4a
SHA1 7cec6ffb7e25a390d824c7bb2a7b8d389ea5e0db
SHA512 ac878c918edfb99d1c016228a06937d798352c5fcb20b63e71dd28d8272931c753a682bbc7584b9e585d478a85541e41d25b1288e22a863d58a340b786b714ef
SSDEEP 196608:94QyETmsNmaGE6pM5qmlAEBIUARNRqeUnT23HhdyVqcaDWPm:qQ9NAap6K5qmOzLRpF3HhYZaDWe
TLSH
T1F38633256E387F3C5BD04EE8E5BA664CE0D27FD43EA0585362D42E653A327485F3B092
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  test.rar
- Size 7.6MB
- SHA256 3bcd8bf3ddc243d0225f41f0ca66b5588f7cbf19dfb23b2cf9447dd3cc2ad0c5
- MD5 5c2ebb00187ef37d5c0a9419c718ae4a
- SHA1 7cec6ffb7e25a390d824c7bb2a7b8d389ea5e0db
- SHA512 ac878c918edfb99d1c016228a06937d798352c5fcb20b63e71dd28d8272931c753a682bbc7584b9e585d478a85541e41d25b1288e22a863d58a340b786b714ef
- SSDEEP 196608:94QyETmsNmaGE6pM5qmlAEBIUARNRqeUnT23HhdyVqcaDWPm:qQ9NAap6K5qmOzLRpF3HhYZaDWe
- TLSH
  T1F38633256E387F3C5BD04EE8E5BA664CE0D27FD43EA0585362D42E653A327485F3B092
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  KeyAuth 1.x UPDATED/NEW KeyAuth/KeyAuth_1.3_Patcher_and_Dumper_v1.5.dll
- Size 865KB
- SHA256 529706eec3f50d2c1b9dfb85b2f007710f87294996a4a38d5bfa16224adc88e9
- MD5 db1c9c995ff0e089e31d331547bf3d9e
- SHA1 2bd3fd83054b32d8f3da1c6ec51d004c4eebbba6
- SHA512 c8ea3d40c0c60506d3456b3e6604f73b79f79addf5b8c0c115c6d0841533696850fb888d8dc0dc64648bf33fcd041de377997688cd7f1565d14227299e8d6126
- SSDEEP 24576:xhiTtH3iDdf1wTxKnq76hy4H/gXIrAtjMDDK:mtH3iDduKA6d44rAtjMDDK
- TLSH
  T18515CF1E2A856079EA638436C5C60351AE32B1B947306EFF01BEC3355E336E51FB93A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  KeyAuth 1.x UPDATED/NEW KeyAuth/Scylla_x64.exe
- Size 528KB
- SHA256 e6b99c1d90533d35db800c4cc695fab29f279829607706c258b8486740556e62
- MD5 d3d41a31d07b3c4ab4b90bc87921fc07
- SHA1 ba718a897c1ae7259b72b2d8b038c3e4c55b94a7
- SHA512 26779a07b649cffe884faeb8ce21b7d61ca611d55410d4caec1519420c1954c0c53d97959d0a583e8e9f3c62ad2b32023d900e5f80da617dc5e970bfd0f07c37
- SSDEEP 6144:6d9KNvZ68asTMq/SkEIuAHPqZrcRPJX7X89CZvSyhEzxZjTxOrQk:QINvjBtEIucPAcvKCgXjN
- TLSH
  T175B47C1673F844E8E1778238CA63CA17EB7274560760CBDF1694D67A6F23AD05E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  KeyAuth 1.x UPDATED/NEW KeyAuth/Scylla_x86.exe
- Size 447KB
- SHA256 9e201ab72c1eb90bcd8e755e3f26ea5b2adffdc7fb67961a638d0a2167434696
- MD5 35cef0926b285bf88b08e445f4d7436e
- SHA1 0031751deaadbbef73754f085a6ebb7cb6dcf5d1
- SHA512 270ebe2fe559782232842cf994829a3042f960a3f7b769a9ce4247a549d5facbaa65f7291aeb9b6e69ffd5e901610f149a7a9d977d39a9f9a4cd1fd968ff3e56
- SSDEEP 12288:jbqFD/dlOITq/3/Z0GIF27sKA72TALaXmljfuUdr1mYdEE:jITU4u1DGaXcPZ
- TLSH
  T111A48E10BB82E071E5F206705DB9CBB6593DBA340B3186CB73C41A7E6E246D25F31B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  KeyAuth 1.x UPDATED/OLD KeyAuth/KA-LicenseKey_x86_x64_v1.1.exe
- Size 5.3MB
- SHA256 93679af51f96edfa02cabea6801aba4484a90449745e2aa78afbd3e13fc1e070
- MD5 efab4965da18f638ba67ece790fded62
- SHA1 27687605909f5a885d78268a5fe0112723049581
- SHA512 66e86dca1427245f6ea454287012ece56d44315310b531dd625c2336b26ba4bef2e9f0c8c70649f7e8ec3c3181ed5080c0e72833ea9b43bd742bdeb08b2691dd
- SSDEEP 98304:t287e9Cg7HpxtbymElTE89gcTaqNTP3f8aPWIKz86PB3/dnDc5Fy/OIkvU:887ejpbyVlbD/evz8cxaFePks
- TLSH
  T1194618FA61B62002D94FC5B2EF3D86EEF655E4C4C79D63651234EF48002B5A9C6C2E93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  KeyAuth 1.x UPDATED/OLD KeyAuth/KA-MemIntegrity_x86_x64_v1.1.exe
- Size 351KB
- SHA256 b0080c00e9fbe13df87806bd20826eb9735a8b67f3f6aae58b3b370ed381003c
- MD5 877a111203c6c66509c6a946822050aa
- SHA1 bb88e7134729d0fa32335a573881f0bc73c298fe
- SHA512 2723aaa1c12e7c64617da1a543c22f7a92a7df42cd825b78585711aaa650b330bfe75716fd5924e1b5b3d17ece2e6c9c2d69641ae1cc2b5e4889eff8cbef97a7
- SSDEEP 3072:v+iP3g1kBnFMYuOiFUlTRqg2VeHeKj6zJW9HTfYCf0ctQ46YLQhruyF0gXgv:v+tkFMYViFUlTRzye8NWpBYRwv
- TLSH
  T155745B01F6806DE4EA6342394711F6B9D9A37C654370F90BC3A35F8B4ED7AC10978E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  KeyAuth 1.x UPDATED/OLD KeyAuth/TUTORIAL.txt
- Size 261B
- SHA256 d434c8c67d64cafb64f6f22b9c47abb41c4c2f6b80ebfc1af9e19b3b70416f0e
- MD5 9dab0aff498ee916d2f1d9e74523fc3c
- SHA1 1e2ffd3ca26a5b8172662ba5f7ef7266513d1a5a
- SHA512 b93fb0f96376f02988369cb5ff0782d3e60de77a8cdf9fcbf7dbce778f800526f0f0b45bb9ddbd1635fc2855d245308fbb8cfc0270a154278c2e09a105c56610
- TLSH
  T1AFD05EBA6EDF827210D04060DA0DE8870302842A058F0522B9AC802DB2FB1AB77E05CD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  KeyAuth 1.x UPDATED/OpenIV.exe
- Size 2.1MB
- SHA256 58ef8d2c522640f8aede76b3b913abbc7184abc9f7ea8519dba38bf24297882a
- MD5 7966f49ed196a24568e0167ce0d43995
- SHA1 6a033f00efcf853f103d0e6a8a085fbe16773f2f
- SHA512 9a3ff5032c5b6d9646a0935a8e6a93e18268a01ac708a5c09a7589298b8c58491ee8286f75b62be81e91f3837faed91be1bc7f3b58b99d7170dea370bba52fe2
- SSDEEP 49152:TOfG7uhDoNpkxugq1NTxoPCdIA1sITLl3oKJ6mEO2l3Gx6iUg:TiuXxo3W
- TLSH
  T154A5C0BA72587358C02AC9389423BE07F175381A076586DF73DABAD02F9B5D09E35B43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  KeyAuth 1.x UPDATED/TUTORIAL.mp4
- Size 2.9MB
- SHA256 61b101eda49033d1b4c77ce7a796a6ec814110c4587c4fe7a13e89292619c917
- MD5 6ad6fe5c5ed3a09f285fde3d8e7b7bf1
- SHA1 e46a7beff013d994855daf5ded1d67f43ad8c026
- SHA512 ec986c06c6ff279063c0cb6fdf6eee336e040178fd143fea0be99456de23ff17ce6c8d65c10e16e827f5941fd0823a2a4e25d9b04d802328a92969b74f5b0e45
- SSDEEP 49152:ZgNmSA0gInoBtALaMWDgy46UiFS9GYf/asuEZAi1t0ncOA4wWo6etGzQVrTbQIwO:Z0mSA9InDaMWDgyzaDAiHMvApWoxbtT1
- TLSH
  T1F2E5238D0FC3D616CC755130D8F277127BB2E4B402AA53CFCA4DD6A5AD973A2AD812D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  KeyAuth 1.x UPDATED/bypassAC.png
- Size 175KB
- SHA256 f27cb4eb1c405adf1b1225ae8dc0632cf0affdeb688719b102d3dfbc05d54786
- MD5 e12c1dcbbfec5700126dfe8557d7ccaa
- SHA1 1a7b7f44bf366ce317528e16fd4902df8a2b8b71
- SHA512 84496307a255b32d5308e6a64ff8360b8e5861d1850ebfb86f1daa0886058df1b168229b3e8971967faa03219eea2cc30157eced356de3b227a3656f869cbaeb
- SSDEEP 3072:q+k0QR9Y+17Cn9UO2lyk7fLf6229xLo+GLCy4cpfBj9z7Fe4IFkY4:K0Qg8CScifLfZIFWLLBz7Fe4IFkN
- TLSH
  T1A20412B2007CD01A5EE291397DF8ABCB704B826488FD5635E2B7F98F065DDA21C44D66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  KeyAuth 1.x UPDATED/vacban.wtf.bin
- Size 34B
- SHA256 49f65d3a736b8a335051c8c8a2d8689631356c371e2391e474f80bf2cce937c0
- MD5 70b7948d5083dfad8a3cd974a7989a4e
- SHA1 3284e8ed8f669f8178989c9253fa8b36ccfc2f89
- SHA512 a8aa3725a45767a6bd8acb426826748726adc7eae66711753205952ecf45f426a413917459df4e1ef9acff5707a6ec3f6e3832d624d6e19f368d0a72a76ba24b
- MD5 SHA1 SHA512
Score

3^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22