44655a2a5ccd87bf1c080b77b683abce67c25c18443073151e027b84367bbbe3

Sharing

Copy URL Twitter E-mail

General

Target
windows.rar
Size 983.5MB
Sample260627-e56zysgx51
SHA256 44655a2a5ccd87bf1c080b77b683abce67c25c18443073151e027b84367bbbe3
MD5 d50c65b0ccf235bbcd89bbd40d1641a0
SHA1 77ba94608a8ffb5d2eabe70d8a2e3b819fb51eba
SHA512 ae8d6a67c5873986186dba5610965fb10d61a8a6ab1c052a113a4e07ebfb3489a16315b99bcc2de354b3794a6969196950757a5f127a9a3a442563ffc617e102
SSDEEP 25165824:l01mzqad9bbI1s8qtMpYsmi93yCMCTf7LUyVJ0HcP7:l6Yd9bbI1s8U3iltJTEy7mcP7
TLSH
T16BB9335B7230DE92D1162E143FD58A6AB7F8C43C81596427AB84132B4E6A334C6FF6F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  windows.rar
- Size 983.5MB
- SHA256 44655a2a5ccd87bf1c080b77b683abce67c25c18443073151e027b84367bbbe3
- MD5 d50c65b0ccf235bbcd89bbd40d1641a0
- SHA1 77ba94608a8ffb5d2eabe70d8a2e3b819fb51eba
- SHA512 ae8d6a67c5873986186dba5610965fb10d61a8a6ab1c052a113a4e07ebfb3489a16315b99bcc2de354b3794a6969196950757a5f127a9a3a442563ffc617e102
- SSDEEP 25165824:l01mzqad9bbI1s8qtMpYsmi93yCMCTf7LUyVJ0HcP7:l6Yd9bbI1s8U3iltJTEy7mcP7
- TLSH
  T16BB9335B7230DE92D1162E143FD58A6AB7F8C43C81596427AB84132B4E6A334C6FF6F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
- Size 2.1MB
- SHA256 cd925637c43f442d984a4f995b6c7f75c4c60327300a35105e860d072188eea7
- MD5 61f56a83fe19db5c4f56a271ea2426d2
- SHA1 e90901e8b213f00797ee459345726e46568b2f9d
- SHA512 cd4a541081e68c1f911aeead61c40daa1b2e1a074158ef7b3091dbcafc94ae9a0f661973637f5eb6e561cb29ce5c01d42f2e78025730813d5612674ace2b08f4
- SSDEEP 49152:AwocwVH+umtSiRFXIrZ4mTQHuEnmDdE51pa:AhcAH0r+OFrmD01pa
- TLSH
  T102A58C4792EC40A8D57EE13CD657821BD7B234450330A7DF52A887AE6F23BE51ABE341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Engine/Binaries/ThirdParty/MsQuic/v220/win64/msquic.dll
- Size 2.4MB
- SHA256 dbd289714164554ca5c0cb84ca3a8864b70f4edfe66afe4b7f1b0a6c91bda448
- MD5 df2da478484837e41994e218fec73028
- SHA1 faa8f1b280ccc7c8c4f4de2bf84a9c50cfd2e3a0
- SHA512 2ea67e42c2e79081a3f406a46dc78d9486dbe9aa1eed6550c0184a90413561f95f9b951b02affde2be661ae89a6d7da61778b0fd1e71db2c05e60846b17cda7f
- SSDEEP 49152:/VwASO0Gtlq1IU6idfp1s7NJt0fegH1yZWxWT4ttWDGyPj8VVT:T+FC0144b+83
- TLSH
  T162C59E17A7A811E8D877C238C9678137E7B1B81513B0ABDF06A4C6B90F67BD1673A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
- Size 1.8MB
- SHA256 490e158814e620b29d46dc5a44117a940e55cd233017a5346e48de988bb560ce
- MD5 a86f83b49884fb50a3d7e0fae69203ff
- SHA1 832d9bddf9038a804d9f2933b52bdde2c1683b51
- SHA512 176fe070e00f0b5b39fb8aa685d4a0328515e9f976a24839d929e98060c8ef124e8184e3d095e7a529e06bfbbdcbce7ec41bd07cfd6998260eb68b140023bc84
- SSDEEP 24576:ldVzJv5XXORlp5P6Rk0PZWw+d7di1zNiDVaSBZN25iAKu2f5Kq6I6397Szdxfawq:JE90BGKNsfAmKqB6397Szdv0fGTm
- TLSH
  T135954916735940E9C16AE278D6435E4BE372FC02D7206BEF03D1A6A91E223ED5E7B710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
- Size 63KB
- SHA256 79e018496871af6f3cc26124541c3615b020ad2313262cb8d91a10b83b5b47cc
- MD5 328c3d9d86ade8667b58467813010230
- SHA1 58eb04200a390bbf71d9e5c057ba741c68fcc511
- SHA512 1b065f95d8ec5a6ac45f5e0a2216a7e121fc9b9c96a64fa64ee97521c43b34ff7e5c830cfb67b3ca2cea41d5e7a19cf40c3b35524951f3bde678d10c05ad9d2d
- SSDEEP 768:JkSQyQUuFq19HAhjXu4DGtLAMxkELDG93hQNu:TXHAhjXuZrxq3hQQ
- TLSH
  T19C537C574714786BEC6B883E70E8D32BD971BA41A36047EB435CC3450F53BCA3979269
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8 behavioral9
- Target
  Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll
- Size 1.7MB
- SHA256 72605b9dc51e6de7b7ed01e22133ed2d683db1b024eaeef12e72f71ff99d4f9c
- MD5 18f354c2fab2afdab301741ffb49ddb8
- SHA1 22174c130d91edf1024d41e5969f80788644f12e
- SHA512 aeb29ded2bdd93afb7a4d5119236f8cdddfcb3a5dd181dca25b1b264bb845bd0cc7062983b7fe9721d7d8fc5cda87e04e0229b1d192529ca5c2d7e4f989f10eb
- SSDEEP 6144:CbbUbUwlPxtVNA0ueMSMMYGUXoz0A1VoqxRCvNg:culPcDe2XNS2a
- TLSH
  T144851F0759928B34C1BC50B588DB557853322C4DAE800F9E7BDCE67434D3678BEA2BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll
- Size 52KB
- SHA256 340af1505897396c9b7d9982d7a232ee2628c7566c57b6b315f2dc75cbd34868
- MD5 9afeb925ebe954d09b8c86bc956615c9
- SHA1 e527e4769c43646792f5eb29d57fa388f8d5595d
- SHA512 f391e78b49d458921bb6c75d9698ac1b1d512323cf650244a637ba13ac56a916588f4c9c3a7d1a853bcce06eef9aa0d37f6e98188be6df8c43bc3a380c59ac81
- SSDEEP 768:LDnv89iBswdSAQS7kWW/BeADGAAMxkEucDGf3hgKe:H8ks7SDWoqx23hgKe
- TLSH
  T1B2337CD697B138DADCA7CD3AA1DA5A2FFE717242532055DF43A8C0614F52BC2333A225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  Engine/Binaries/ThirdParty/Windows/WinPixEventRuntime/x64/WinPixEventRuntime.dll
- Size 71KB
- SHA256 221811eaf317d1d800d3b66cb498cbd3f66fa431ed692f689c0fb6b325d888c5
- MD5 971542913e8595e8fdb50964c5bdab3f
- SHA1 585581587bc93b6ddbbc76d95e3f2d33672e9ccb
- SHA512 6198d6fd98bb048317c42fed7b0176101439b69b2c7a36f37acd862e8415babcd15f9f6b80f77643e7643e798fdf76c5abe2c0111c75ef2ff49246262df7c431
- SSDEEP 1536:FlHpRe6E0nhqtHAEuEM3BJ0/lH3zSy3hSMxnbPR3zS:F1pHhqdaBJ0tgiBO
- TLSH
  T1F2638D9687240486EC9B9934E1F5EA0BFD35B7D26B1182DF0375D2950F93BC1BB38229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Engine/Binaries/ThirdParty/Windows/XAudio2_9/x64/xaudio2_9redist.dll
- Size 843KB
- SHA256 dc580c75fe3e4cafdc2c2d534748bc07f8c378e9b6a28c4612ed00893c262635
- MD5 83e7432aeb6379b383307c3c38bfc62f
- SHA1 3962320f3e9069d67706a43e08b3cfa799af1fdb
- SHA512 65af1db2789ab7029670c9c8d36db96b2ed413f1acaa8be95ed828f6c8488578e3563a387c9c09f81686e7951f964e9b2ba283ec5a0106c1ddc4e424aaa8f53d
- SSDEEP 24576:g+6PHmQBNmTqtEcl+4n0wcktNvSRbESez5:ghBI9InQMNvMo
- TLSH
  T1C3058C53F6E549F5D16B51359167BB1BF672B40027254EFB02A086283FF3BC01ABA3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Engine/Binaries/Win64/EOSSDK-Win64-Shipping.dll
- Size 17.2MB
- SHA256 9263359d36f327ace6fb335d8b0279524a9ba28e13d92e397047c5560b1033ce
- MD5 16e2afad320c635035de4bb164063a8e
- SHA1 7d222b6b2a9026dd2d387bdef74edaa903b190ca
- SHA512 3eb19f4ec14efef2f4e9deb77c42b001162265c7475e66b55db52b62990198d1baa3841d8cc3d1833d65959d42f7157e3944fc428c29a8bb24710dfa28bf045c
- SSDEEP 196608:Y6eBXs1T0hdy9OuH7zHMSzo4RGNjP6l7PmNdPQqNv1sgTXJ:FwcQWOuH7zHMStGNjP6l7Pm4qR1DXJ
- TLSH
  T13407385272F40098D0BAC2BD9B27D916DB7139890B34E6CF06A0999A1F77FF459BE310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Engine/Content/Slate/Cursor/invisible.cur
- Size 326B
- SHA256 fef3980fa567e9c45d5d8dcaa432a2c1a3f3bb17fe67d7ab198164f56c142aa1
- MD5 2eada1ffcee14930f2c53a4d31b95c91
- SHA1 b8133a27e01a74cd5936a544b4473e77d13da618
- SHA512 ea02e51a3efd5cc5c10618ddc49784bd69ac9babc6c246afd1293d5150a2e9558439c488c4624931bcc93201f4e747f18240e006064537e4b02e65cc2a7f1c53
- TLSH
  T1DBE002413340C15AC0010334048387852B79EC519E66134335623F1D4C317445C25640
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Engine/Content/SlateDebug/Fonts/LastResort.tps
- Size 930B
- SHA256 0f775fa99d05e21d43d2d06d55982b23dcdccdb512a9a5a07aff674f212c41b8
- MD5 e15c3c2ad82c41935c7ab27b76e58964
- SHA1 57161fd8fcfc3e071179f48a9df67971c2dcc94b
- SHA512 37a08007fb0dfaf06347df72e5bb823ff1dd00997e0d62f785b717d394661feda132f1af7227bc3c350659cbe2ff1649ecf92d3d1c5e79e674484efd838d2803
- TLSH
  T1DE111068F4DA61296B93C232B4678900FA21F2DA95DC1F70F890E4FA116D7C53177A15
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Engine/Content/SlateDebug/Fonts/LastResort.ttf
- Size 5.1MB
- SHA256 fff0f8de0b868b964950fe97c9b60f893e9bc85a4f90b3629c5693db058b97b9
- MD5 89454f173319872a5fa975b26d028f9d
- SHA1 e4cd182c152c7d50c0ca230c86033d63b3fbd057
- SHA512 3ec278de92e326600e4a0e238311dbe9168416eed0716118c00ed146ddd1f9b0dfcfb27dfd0b6dda89fa49376ce208961d6b6d672b7bd922af8e262a3ff7b69e
- SSDEEP 49152:BB4Wu7JPVO/zNwHLLY2cxqPKHUBNRnNn3nm191d3l8WcY2:0WcF7HQ2cxHj1d17c1
- TLSH
  T14A469E9AB281DB37E21DB3F9AB626BE14786244E86E00CF2FC55B70971194C5DE3D0D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  Engine/Extras/GPUDumpViewer/GPUDumpViewer.html
- Size 176KB
- SHA256 da40fef04ea84bf9194077e0bf352b5cdd3847c0184b44d3d38bc459f0a97ed6
- MD5 f1d7ee558865fe2f7774ea6cf9eb2f65
- SHA1 fb01d4094a177f9231d61a07ae59698322bd11dc
- SHA512 a8e55e27f7594e5ff62f35bc65d8e0ad12a78a9cba6c564d3f68614ac5ec43a47b205d52c75e07211d0d3476f7f003e17c7b04bb508283892c6006100e099e3a
- SSDEEP 3072:1loPsMI00TsTsf3p/UcRROiMGmA5FXZeQFR1Zq6w9EPWIuPZ8EUsK:1loPsMI00TsTsf3p/Uc9MGmA5FXZeQFx
- TLSH
  T14904B483BE0F803A85A3F25621780F49EA3DC155992091EDF87C5A7890F1EA5539DEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  Engine/Extras/GPUDumpViewer/OpenGPUDumpViewer.bat
- Size 879B
- SHA256 e8f7ef9c88697041bd87902b76e52558979ca866c7450b1da108a94a027f441b
- MD5 7dbda1f0697d023fe931feb4a3cf75c6
- SHA1 91b109182fdcbda1e523d39f03e0812da29964f3
- SHA512 cecb09bc1bc7b915a89becf42b2dd56f6ce1f129cf5b2d7de8e1fa1063330182f50a22381c4f30fea461906cfe5a00db139fa916c6a557b0663a20d2984e8fd2
- TLSH
  T13F11C0DA790192C834A37CE53B402B1A2F0FD52DB395CA4F3695110540C046993DDAF5
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral27 behavioral28
- Target
  Engine/Extras/GPUDumpViewer/OpenGPUDumpViewer.sh
- Size 2KB
- SHA256 1b222b5d5aad6dd9b5b9f0a1c72d38635149540f2c7a368600ec76c1d304390a
- MD5 414950e294df62d5981a768ecc61222c
- SHA1 f00e4e61c907ba56b8a1886a85a68047e7d9ccb9
- SHA512 bfa6db51efd7748781f75155b9704648c70bfde15e8986d80d0774f8ce42ad6954fc1a47ae2f98ed7bef9f56ac8f5fe64d519a06b1bd04cbd5db02abd52b912e
- TLSH
  T159418419B18F63324CCC28C1AD3D04233A858274EA3634B8B168A91F5B3EC7C71749BC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32