6c1cee2408aa1a76d1b7379c46b47325c16150eb3daacdff8e4c035118b778f8

Sharing

Copy URL Twitter E-mail

General

Target
R6 External-Esp (1).rar
Size 5.4MB
Sample260628-ew2nwafs3n
SHA256 6c1cee2408aa1a76d1b7379c46b47325c16150eb3daacdff8e4c035118b778f8
MD5 7ef0535f4d24799fffd33f4b0853840e
SHA1 c858f0c9c44e47e64595d058b7d516c3d0ef2c4e
SHA512 8f419add05791f3154a2c83766026cd06c91db8623c0f21c0643cd640d33edb2e3570b9c5bbf8d77e0f9d8983e35b13f11b519bf38dcaed90fd8c905b6daf85d
SSDEEP 98304:+fSV+9iaTgD/3gJk8Nu4WxuQhG2tsvmSUF0Wl4WV5yGrmveHKiunn4yOGK/Q8ZpU:p+JMj3gG+0hPtom/09WZmveqihL5/bk9
TLSH
T1C0463350DAA580451B39FCC8732CC7A2C5B0868FE5A3DCB9979BDFBD006690355A863F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  R6 External-Esp/imgui/.github/workflows/build_windows_vulkan_libs.ps1
- Size 1KB
- SHA256 56b63e4c9e209569e4f74dddcf34044c12b338879fa143a8f8557d41cbc95ac1
- MD5 e2417af0cff74c6542132532eac039a7
- SHA1 362086c040885447a52c4b642271ac1c8472cae3
- SHA512 8175b56626488739f8a22c1d571b2cdae9f253177314a336a4e4c6332a403d54a21ed3fcdfc9d6f50418784a195be58977b596aa3b5a6e338d21148e6c34d792
- TLSH
  T1F6319E38275E23B14DF1AF94DCEEAFE0CE0A97464B98E64FE012552C24B38C1D4A1C2D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral1 behavioral2
- Target
  R6 External-Esp/imgui/examples/example_null/build_win32.bat
- Size 263B
- SHA256 7a70866dd8a926f746745af416bac03e4bc6654314fcfff3fc9d28f44d229ddb
- MD5 9d479708de1ba9546f8718a44f26b3b5
- SHA1 8d44e06057ebc13303e1e260c2e70bd3b0ccda49
- SHA512 b85f22250acfef72716168acac25d811e08735a322a8557989ad9ffcd795f14358dcc922285379623b0d3c8f10bb955d9ba1b01b6a8724585b4bc08788bab5a3
- TLSH
  T178D02B5E544E3C43B3015A46A42D852BD381B9070A618C405091157D8B2B647F73DD62
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  R6 External-Esp/imgui/examples/example_sdl2_directx11/build_win32.bat
- Size 705B
- SHA256 e30a6fc37b70c021b50df5f5b170cdfe86f6ce5a1adadbe1c29cf51ce5ac7ec6
- MD5 a1fcc750f49b97556e1fdef7a11f8d51
- SHA1 f0b7136c123c4700f672c76c24635e1d81ffbecd
- SHA512 0834a60e5200c053d9804e8b528fbabcbed60cc44e681a0f91febdd594b6208eaab24d7627e433bcc083170a1a574d0b680c1e53f9257aa99877c192333f9ec9
- TLSH
  T19801C5196C9D3E4612353D7D275DC747A150640B0FA054DC2481D1AAF15D783113E573
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  R6 External-Esp/imgui/examples/example_sdl2_opengl2/build_win32.bat
- Size 572B
- SHA256 da199d36e6d705c587d9f407f2edd4bc206c2e3ad550daf7f2961e15e8c2aba4
- MD5 5b59e42e66ac9f64dcae2d3da64c73e7
- SHA1 438d0f2d2bdf77b1d071b05b4bebb706c4f210e4
- SHA512 70a4530ca126d71fc19790727c27a639c6ef419a9ed6a2f5a154bee7533edb2f7d0771c7dedc63fb4e093dfd9df4de70cb24b02b8433c9f08162448577c05368
- TLSH
  T1D8F0E1156C4A3C83236A3E387EA9C727E15514070FB0C0DC1984C0DF5158783553C527
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  R6 External-Esp/imgui/examples/example_sdl2_opengl3/build_win32.bat
- Size 572B
- SHA256 0193b5f3495c4067649e5f022e91bc68367652b8d8bd24561d2e3c673233e27a
- MD5 f8de7039e036bc869974211f8d2996c3
- SHA1 d859adabbae7d1d36324529563ea3a67c1b8c02a
- SHA512 c3854b0b47c8bd924b8091bb50ee626163a206cf6bd0bec83440c352052cae523fbbc565bdf84c4baf0c20056d92323abe72e30f2e5ee1c1271887588f87d4f6
- TLSH
  T141F0E1156C4A3C83236A3E387EA9C727E15518070FA0C09C1984C0DF5158783513C527
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  R6 External-Esp/imgui/examples/example_sdl2_sdlrenderer2/build_win32.bat
- Size 557B
- SHA256 e8f64cfb1f4ff1a2a3c2201eb6b36ec264c2158ecb34b8344d342645a8917e8b
- MD5 5bf9e707f6cf01eec6e8444603e9417a
- SHA1 d44b492d52d18dceecacd77b7e6ac430c77eeebb
- SHA512 ac403d8b7a0608d6f3358e8b5b1d668a65b8792d4f28fe370e6b521e64058b8f65cf7a9c62bd949c67e35e65c7e29f557cbe23ad42f151ba6b6948305456f28f
- TLSH
  T1BEF081156C5A7C8211643F397BE98717E155140B0FA8C49C5881C1AF415CB83513D527
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  R6 External-Esp/imgui/examples/example_sdl2_wgpu/CMakeLists.txt
- Size 9KB
- SHA256 e2ee733d64e815de75c3ee25ee513a52817a0d48b950a1ded4f273c1202afad6
- MD5 e36b1c2baad518fdad2bd5b18089bcc6
- SHA1 0662438c687a0c2cd1e358bea79d9f42946149ab
- SHA512 d58e6dac3443fb93f50de3cdce220af634b5ecc1915799ad707feddc6329c7b8ddea2cf71634b7eefec9647995bc15e7ddcef7308cb1eb3fd20ce5217dcb0944
- SSDEEP 192:cWxjId+/YK7R4A34kO+uy7mps661uBuq1Z2lECMyy+xgohahH6Vjp90ti9iPxGbp:cWxK+gK7R4A3+y7mps661uBuq1ZbC9oU
- TLSH
  T16912A5735B20388167F341A57BEED182D33652239EB400547A8CE2856FB948DD3A6FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  R6 External-Esp/imgui/examples/example_sdl3_directx11/build_win32.bat
- Size 692B
- SHA256 da71a3b8cbee80a590407e8d91085f1ec72c9b9f11345b88e63f8c10f9ef6585
- MD5 0fee095f71d88efed9221471517c908d
- SHA1 49d39bd8ed2f2cea7db517805047d833b8e3aa6d
- SHA512 671f94a08f35d7b0a8a69a43c905250a702b1e4c6fc2ee2c350528e0773d1631c9b1fc3ba2edf6faf00edcf814d43bdde54008c71dd6a5e4d4e601d73317a91c
- TLSH
  T10A01F42A6CAD3E4713353E793B9ECB4BE164640B0FA044DC2440E1AAF19DB83123E1B3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  R6 External-Esp/imgui/examples/example_sdl3_opengl3/build_win32.bat
- Size 743B
- SHA256 b3e5afa25a098c92051e673fe20592b9b77b38167d1ccdbb9a673d1f7f13690f
- MD5 fe9794decaf76f33709aee09ed26c28b
- SHA1 4e3587bb02113385cc0aa530508b81ffbc66ada1
- SHA512 715741fdb2e35a7eefa001fc6752b441ee9c3d8dada72840670e9c1460b8f2f955d9ca2f6c34374a582733f5fb6415578bc8210a04059e118292464dbe21b4ef
- TLSH
  T1610110289C8B7C83623B3F366F654327E1A528070F91809C2980D4DFA26DFC3623C02B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  R6 External-Esp/imgui/examples/example_sdl3_opengl3/build_win64.bat
- Size 743B
- SHA256 e769ecf4d6ce66fd128a24fd19c58c874af5faa924f5230f7f94ede9dfc1d00e
- MD5 4872673da755e4744a06fb8ae0992671
- SHA1 ce57574ec5c3d9082b560a1fed104a14a125575a
- SHA512 0717bb50c9b9417e28b580f15bbb561506fd098246a970fa3a286f8a6068273bbc1e4205447fcf03cc1817071df2a74cdadc7cc9520ef38c469f5c7a2aadf921
- TLSH
  T1910110289C8B7C83623F7F366E655727E1A528070F91809C6980D4CFA26DFC3623C02B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  R6 External-Esp/imgui/examples/example_sdl3_sdlgpu3/build_win64.bat
- Size 730B
- SHA256 561389a5067aea05b2292028acbde1e6b493132c3aa721a3a3e9dbdeefa4a33d
- MD5 b6addf0f7a2f9370fec56812c681ece1
- SHA1 607cb824569056be5d29a620533cdb8e8af959af
- SHA512 42dd172d2b2023cb7c4a766793a67d9993463e2c7943713092ceb8aebbb3607e43e44e2c2cc1ef32299b85488a20402140650d873ae4c23e964df5f489fac7b1
- TLSH
  T1AB019C286C8B7CC3617E7E7A6EA51717E1A528070F91989C68D0D48F525DBC3A23C46B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  R6 External-Esp/imgui/examples/example_sdl3_sdlrenderer3/build_win32.bat
- Size 544B
- SHA256 0287659726b7e77f37c2e30c509db7d6c778385127da4bbd9b74ed11da166f01
- MD5 4411e9cf833cbe3515dba452e344517a
- SHA1 2c3495e09dcf1383276ccc3cf5304353942456c9
- SHA512 d6db2f965c063804d0e192cf4b2090dcfb1659de00869708499cf4bf91dcfb7e96730fce237720b1adf6256bc192e040167b093c48156812c95bc549b27553c8
- TLSH
  T11BF08B296C9E7C8212793F397AE50B1BE195180B0FA884DC5890C5AF425CB83927C627
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  R6 External-Esp/imgui/examples/example_sdl3_vulkan/build_win32.bat
- Size 793B
- SHA256 f5de59230f5946b0a0c03c08bfcec9cbebc681c69c6e81d6281da77dcea33f73
- MD5 df56459eb15d9cfd4e524751edcffcad
- SHA1 94044ff55ce760d4a24a2fdec3a0405290da0c83
- SHA512 11bdbd8272beccf56b8753b822d60cdbd48c7fd9b296a7068cba5d40feac4fe3d16be9882e00d1f5605b865251759993e040b78bb49b04ec58f123a8e8306fa5
- TLSH
  T1DE01C9186C9B7983216A3F766E694317E1A425020FE0809C6890D49FA36EFC3622D42B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  R6 External-Esp/imgui/examples/example_sdl3_vulkan/build_win64.bat
- Size 791B
- SHA256 29693238fe0d4dacae0c2f65c0711db8d56bc8aeb110314e9aa0da72f984bdf7
- MD5 4b3b10d3d5bc165f96b2b11186aa760d
- SHA1 e376acad402384c06c20fdd1a706f85facd0d91e
- SHA512 fd45218f1ce5c58015e85e3975962896975c0e956d1e8c439d98e263ff8c2ef5099d94155680146ff90901228ec16b832c40e6feb7dccd18e9df861fa128c3fb
- TLSH
  T1D901CE186C8B7D83216A3F756E655317E1A425020F90809C6890D49FA25DBC36229427
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  R6 External-Esp/imgui/examples/example_sdl3_wgpu/CMakeLists.txt
- Size 9KB
- SHA256 89f69c42cf6009e3ad00769b50afd5f26efaa02374df9f4218bac9988e1b1d2e
- MD5 6dd5c13b672dc2991f220c5dd19f757c
- SHA1 7ee9f33c92e947101105049b05b9a3d3e8cee8e4
- SHA512 da7f1d2ec87ec6145cfaec67991b75364bee3832850f9c0d0e9782def7213a622207946fc854cf243da3d10670454cfbc1f58d9f46cfe983fef79f0d2ff8f5d5
- SSDEEP 192:cAxNIdcmhRGnR4A3tpO+uy7mps661uBuq1Z2lECMyX+xlmhahH6Vjp90ti9iPxGv:cAxscmRGnR4A3oy7mps661uBuq1ZbCN5
- TLSH
  T12B22B5735B20388167F381A57BEE9182D33642179EB400507A8CE2856FB549DD3A2FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  R6 External-Esp/imgui/examples/example_win32_directx10/build_win32.bat
- Size 628B
- SHA256 12be7fdbf4512ddaf450bac20644cc4dec0d8471a30c5111b5a22aaecb746b2f
- MD5 984e2bea3cc9ca00bc343b433014eb1c
- SHA1 f6a3a193b4a36ca9cd6bfa3674b948cefe9144b7
- SHA512 4a8dfd050417a994faadb71da0668be7b3f458293398d3449ec5402913dab80d34b71db7ad21232b54585349c163e540bce45d1bb50abc2ea8b6baf85376f8f2
- TLSH
  T189F0D32B6DAE3D4653783E2E1A9A8F83A150A40B0EF4988D2480E169A19DB43513D5A3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32