7580c0f002e14010036977a100be56e6f5e0780bd7f56c21cb188c3dedd85836

Sharing

Copy URL Twitter E-mail

General

Target
speedy_flip.zip
Size 60.9MB
Sample260628-acbwwset5k
SHA256 7580c0f002e14010036977a100be56e6f5e0780bd7f56c21cb188c3dedd85836
MD5 25d6931e57e927acb735c9749347be65
SHA1 71d9ba5f611a949c987063ad67f55cdf39c57e61
SHA512 4338e8d4595b1add608c7fe6bc8ac378c2a9068145b5fd00e01a741b589edf3fef5c8ee04c33b165098d5badc0dbe06962a48f48b2545e5dd96615d8c3684a54
SSDEEP 1572864:4s/iK0UQrdZextc4M7++Avd4Yy3gn7YsxmH4ra:L/D0U7/fmgQ
TLSH
T19CE7336525821D8BFA43F634404B4F29865AB831CEC7DD0EF4AA43DD6E871E49A4EF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  speedy_flip.zip
- Size 60.9MB
- SHA256 7580c0f002e14010036977a100be56e6f5e0780bd7f56c21cb188c3dedd85836
- MD5 25d6931e57e927acb735c9749347be65
- SHA1 71d9ba5f611a949c987063ad67f55cdf39c57e61
- SHA512 4338e8d4595b1add608c7fe6bc8ac378c2a9068145b5fd00e01a741b589edf3fef5c8ee04c33b165098d5badc0dbe06962a48f48b2545e5dd96615d8c3684a54
- SSDEEP 1572864:4s/iK0UQrdZextc4M7++Avd4Yy3gn7YsxmH4ra:L/D0U7/fmgQ
- TLSH
  T19CE7336525821D8BFA43F634404B4F29865AB831CEC7DD0EF4AA43DD6E871E49A4EF4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  speedy_flip/_internal/_socket.pyd
- Size 75KB
- SHA256 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
- MD5 e137df498c120d6ac64ea1281bcab600
- SHA1 b515e09868e9023d43991a05c113b2b662183cfe
- SHA512 cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
- SSDEEP 1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
- TLSH
  T1A2735A52A29050B9D27381B6C5635F23EB70F4C0179593CF1260DA6E2F23792AF7EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  speedy_flip/_internal/base_library.zip
- Size 859KB
- SHA256 f07d295c8ddc3b79b2459cc690312de8f199ee70ac5d6a4e5732c142383b083c
- MD5 20006552526908ff040bf3f2d47ce756
- SHA1 d543752597978c322d20122f90fe18e47ff39161
- SHA512 fd643d21da3459d5a3db731c7f3aceaf56ec6a5e7f5af5a87bce55f676876faffb0af33cbae00fe0347b809b42dee7fc7136f28a85f38d106f3882580b375b5d
- SSDEEP 12288:mEHYKmIBWSxC6S2cXPLA4a2YNyd1VwxffpE94pJSLMNEq:mEHYI1xyLa2SMVwxffpE940MNEq
- TLSH
  T12B153A8069911ED7FD05F278815F8E3C069AB33ADB89D543BA4FC2D8BF472E00995A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  speedy_flip/_internal/cryptography/hazmat/bindings/_rust.pyd
- Size 7.9MB
- SHA256 e25fa336e695553ac4afa83ede76094d03dc519061b56abbf6b1b5f98e721581
- MD5 2e9327684cd21cc35b6788ae4d471ca2
- SHA1 c2de118470c9a60035e0d27b7025392928bed7c4
- SHA512 e0ce785d1ff4b6d6a06c852a800056a721f58c412aa45843a47a943247a7ceaed622e6d4f34095f335b7cd6be86713598e012832dc8e7d147989d23efcac464d
- SSDEEP 98304:8rKBSnfPmcVpw4eDUBcc5aabkvOEUf5E+UjRc:MPmccQcc5aabkv3UqDj
- TLSH
  T171867D25BAA90069E82EC4B8C38752339B71748A1B7476EF49D486B92F37BF4173D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  speedy_flip/_internal/tcl/tclIndex
- Size 5KB
- SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
- MD5 c62fb22f4c9a3eff286c18421397aaf4
- SHA1 4a49b8768cff68f2effaf21264343b7c632a51b2
- SHA512 558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185
- SSDEEP 96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
- TLSH
  T14FC1301AA756C72803F481074999FE283ADED1E4D33DC93E99A491CD10B30076FEE9E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  speedy_flip/_internal/tk/listbox.tcl
- Size 14KB
- SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
- MD5 804e6dce549b2e541986c0ce9e75e2d1
- SHA1 c44ee09421f127cf7f4070a9508f22709d06d043
- SHA512 029426c4f659848772e6bb1d8182eb03d2b43adf68fcfcc1ea1c2cc7c883685deda3fffda7e071912b9bda616ad7af2e1cb48ce359700c1a22e1e53e81cae34b
- SSDEEP 384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
- TLSH
  T1246242C42C34637171FFD22746FABB81FF6990A70595504438ACD0A4BF758B246ADACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  speedy_flip/_internal/tk/megawidget.tcl
- Size 9KB
- SHA256 848258b946c002e2696ca3815a1589c8120af5cc41fbc11bbd9a3f5754cc21af
- MD5 d83ed6ac2912900040530528a0237ab3
- SHA1 2d18e42a8b96c3d71c1c6701010fdf75c1e6d5d8
- SHA512 00b4cd0d58029fc37820c163a4ae1dead22fb5c767bdc118659eace26d449c362189611dfb3fab1ac129fabfec2ce853ea2c10d418fae5aeb91ddc9330ff782d
- SSDEEP 192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
- TLSH
  T1B1123201638A436F37B763B580FAA154D534C1BF9DEB582C3C9EC3D43B308A286A66D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  speedy_flip/_internal/tk/menu.tcl
- Size 38KB
- SHA256 d1283f67e435aab0bdbe9fdaa540a162043f8d652c02fe79f3843a451f123d89
- MD5 078782cd05209012a84817ac6ef11450
- SHA1 dba04f7a6cf34c54a961f25e024b6a772c2b751d
- SHA512 79a031f7732aee6e284cd41991049f1bb715233e011562061cd3405e5988197f6a7fb5c2bbddd1fb9b7024047f6003a2bf161fc0ec04876eff5335c3710d9562
- SSDEEP 768:NKJsO5OhIzOQjJwxzire5pKVjriecYyq4Cp5Zn2:NKJsO5LOQizire54lriecYf4V
- TLSH
  T1530396906F09E3375233D3A583BB9094FF3A82F31346609C745592AC37B58260AFEAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  speedy_flip/_internal/tk/mkpsenc.tcl
- Size 30KB
- SHA256 c5bdca3aba671f03dc4624ab5fd260490f5002491d6c619142ccf5a1a744528a
- MD5 983c7b78f1a0ebacab8006d391a01fcd
- SHA1 7ea37474ea039ed7a37bfdd7d76eae673e666283
- SHA512 a006ef9b7213e572f6fc540d1512a52c52fec44e3a07846de09662ae32b7191c5cf639798531847b39e4076bf9dd6314b6f5373065c04f4fef221185b39c3117
- SSDEEP 768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
- TLSH
  T131D2F91C97858E6E745222624E3744EEE02DE09E6B694534F9DCCF1D372093C4EBFAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  speedy_flip/_internal/tk/msgbox.tcl
- Size 16KB
- SHA256 a07e3a3809ced3c6c9c1e171dca5ad1f28357734cd41b2b9dd9f58085b3d2842
- MD5 217087ab6b2a8f9d7252e311d69c3769
- SHA1 09aeb2bc5b7c7f4ab3de4211d786c519ae0970f6
- SHA512 6e57633c924bfc16d380c014c20dd24d5727e70d4843fcec4d7995b4db21941ea8f2a5fd6e5386df3364b6905d4d66b2b9595dc8fc70cff40a2d49a92a1b6fba
- SSDEEP 192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
- TLSH
  T1787220C673482066B177912EDBE65202EAAD95FB01E0648EBD7D8098EFF1013D1F979C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  speedy_flip/_internal/tk/palette.tcl
- Size 8KB
- SHA256 849b4c57e4644e51beaeaeb3ae59b7ff067e582ecd10f1b2caf6b6e72f11f506
- MD5 4ce08a10cd9ae941654b8c679df669f3
- SHA1 f1288babca698fd18c3bd221e6ae6c02f2975aae
- SHA512 0f37539da3540e9b1da7b0377e3bbb359b71db4271d63bc9501e95931b4e609e8cb91dc2f7b08a6452598d4a0d58c6a2034049a215000eef0f93a9963d003632
- SSDEEP 192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
- TLSH
  T1E1026112A34952AB72B3A2BA0077F084DA3C52BB515A835D3D6ED1F8373043687FB6D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  speedy_flip/_internal/tk/safetk.tcl
- Size 7KB
- SHA256 579701605669aadffbcdb7e3545c68442495428ee6e93c2d3a3133583bcd3d33
- MD5 21a3ac11146ec26784c0e729d8d644d0
- SHA1 c7e0918e8692c42c1d1dd1bbcbfff22a85979b69
- SHA512 724ed83b989ad9033bec4211ee50e4c9e85b51054c518cdf7e02d0ed0416f636b9f38c0b0d29f8f4f7f465b77c7d2e01d0918d2c2c3fec4c7739ea982302fa2e
- SSDEEP 192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
- TLSH
  T104F17490D30317D6327142A25B7AF3A5FB3500A756F762AC7C8D826C7BA7417C22ABD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  speedy_flip/_internal/tk/spinbox.tcl
- Size 16KB
- SHA256 2ff791a44406dc8339c7da6116e6ec92289bee5fc1367d378f48094f4abea277
- MD5 77dfe1baccd165a0c7b35cdeaa2d1a8c
- SHA1 426ba77fc568d4d3a6e928532e5beb95388f36a0
- SHA512 e56db85296c8661ab2ea0a56d9810f1a4631a9f9b41337560cbe38ccdf7dd590a3e65c22b435ce315eff55ee5b8e49317d4e1b7577e25fc3619558015dd758eb
- SSDEEP 384:IMpfy/Ku9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfy/Ku9Tx8WODTp2zPP
- TLSH
  T1EB7222DA2D14632D6573C33792BBE305FA2690B7569F40603469C1943F7AA210ABFBC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  speedy_flip/_internal/tk/text.tcl
- Size 34KB
- SHA256 4a42ad370e0cd93d4133b49788c0b0e1c7cd78383e88bacb51cb751e8bfda15e
- MD5 7c2ac370de0b941ae13572152419c642
- SHA1 7598cc20952fa590e32da063bf5c0f46b0e89b15
- SHA512 8325a33bfd99f0fce4f14ed5dc6e03302f6ffabce9d1abfefc24d16a09ab3439a4b753cbf06b28d8c95e4ddabfb9082c9b030619e8955a7e656bd6c61b9256c3
- SSDEEP 768:Rp4LaQDlJrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:R/K8aymTGs1b0xncn6KR
- TLSH
  T125F2869918095B7AE533D372A37AF101FE72517B06C28019749CD0903FBE46A877EBE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  speedy_flip/_internal/tk/tk.tcl
- Size 23KB
- SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
- MD5 338184e46bd23e508daedbb11a4f0950
- SHA1 437db31d487c352472212e8791c8252a1412cb0e
- SHA512 8fb8a353eecd0d19638943f0a9068dccebf3fb66d495ea845a99a89229d61a77c85b530f597fd214411202055c1faa9229b6571c591c9f4630490e1eb30b9cd3
- SSDEEP 384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
- TLSH
  T1DEB2D7195DC062B3513BC13F53BB2A00E87558FB2776644978DC48B92F6883B06FE9E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  speedy_flip/_internal/tk/tkfbox.tcl
- Size 38KB
- SHA256 595a0b05eb2cbd4cf489e57624b509fc3b4885e6410ca6416e7521d23694373d
- MD5 47635811aaa1ceb26eda3930d91c8855
- SHA1 f071757bed525af8ca21bfa0fca89ec3f95aa278
- SHA512 a374126ec28e70c89ee247a591c2168df55e110f260664f46f470c53cda3a2411c3775391fc8fd575cee69cd1768512e68cddcb335204d00b9eb81906ac79344
- SSDEEP 768:+oj+AqE9cn9eJNgDN0/vsKulXgx65Eh6pSb:+6+ZM/gAEdix65Ehpb
- TLSH
  T1EA038412734C6236A2B793339EF95024DF2AA0FF5298525C746C40AC7F31136ABE97E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32