8c649dd599da1ee2245581136b4701a5e920f2b41ca8b7f309e1a38512b732aa

Sharing

Copy URL Twitter E-mail

General

Target
Archive_get_425473.zip
Size 781.4MB
Sample260628-n72mpagy4v
SHA256 8c649dd599da1ee2245581136b4701a5e920f2b41ca8b7f309e1a38512b732aa
MD5 7227052b28e5d6beb37b2db1aed55246
SHA1 885fba6af3a6244272d721884bb6a300823a3da0
SHA512 e7632a6216ab80023e40b28274006965e198900cda928cb6b8034639cf83b61a875b2bbe4de320b5bec6edb5adf4eee4dd96825e74993abb2a3b2d659147e7ab
SSDEEP 393216:Y83UP9uovZoG2hQJWJQgYgOOiSH2tw+0rnZVjO57CUlJi/YX0RBtLW5gHLlR5q2I:Y8aZo/PYz5SQH0TZVih5X0vtRaJx7LZ
TLSH
T1B6893301CD3DE7D6FB9336B4B8B0515BD63B90B1329D919978A831F46D8AF046F2890E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  renpy/savetoken.py
- Size 9KB
- SHA256 85d5d1969488e29f41cd083882f338071ae372ce40c2c2a1c6c36061610b90c0
- MD5 64e38a4d1219796f141482fbc2fb712a
- SHA1 a0c40fb2973ea37b3251ed7f177839a544b33273
- SHA512 57024236399ff31340ce497dd6624de16693ecae03c33f0777f7591b2b3b5239d9d160bb271f442e27d02fbce3f981d3478bc877a4c8086bbff6bd89a1bda76e
- SSDEEP 192:w1dwQHjkddByXX0LcFQ5d8t5YTnVRTU+k+qt8CMdU3ESYfCzR2TfGs:BKYWEgS5d8tqTnHTM+JmUSqCYTN
- TLSH
  T10F22404FFC4656A1C65F886D89A3C050BB6AFDE7129056347D9C92FC2F8522093B35AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  renpy/screenlang.py
- Size 3KB
- SHA256 79d2b81fbc698b974d16a103a9302ff30bc4c195dfbf5d0bd65eeb9f344bb6f8
- MD5 5b446b955eea6cee60797f139633a7b6
- SHA1 91a9bd44d30613ccaecca93160e96bccdc304f93
- SHA512 7035df60c0df7f2b405c0842c48ed46ad69c7eb029e055ca4b1e0dca1def4f18f135760d68d1a197e30244e494c2dd001d723565c67a0ddb24c65b423767b07f
- TLSH
  T144616279F90346A0308F5D6268AB2847723F9457359C30C678BCC35C2F1AE1DA1EAC88
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  renpy/script.py
- Size 31KB
- SHA256 87cfa665f08f093a2c51ec9ff4cb176c120629b911c72d541d6ea4d28a1bc432
- MD5 4d8f391a7c95fa1384856be4a1435073
- SHA1 94b2160decc7dfe2637a29360fae553b63c973f7
- SHA512 014b20ce69f32d7a53aa5917529ceebf89603ca98d399c67e607facd62e64bf58bd5b8362708b972a5bb5c6bfb7963a440aab21cb8e55bcb71d27c5ebd44a99f
- SSDEEP 384:BKnN2QDtd+5IT908WK8LEANmQBXXxJ9sHv86Hc5TM3VnaK75QA2e+:In9DbW+wHdGJ3VaK75Qz
- TLSH
  T1CBE2D70B9C055962C383A8A88DD7E426631BBC0F76541178BEEC929C7F00635E6F5EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  renpy/scriptedit.py
- Size 11KB
- SHA256 a53b8d14faaf9fd01e3e0fb5795cbf5b6f0d5ecf62a9792f657d6c28a1a05067
- MD5 e461e6f16196ef9fde7898f9f3708f51
- SHA1 7b5b53a8287ea318c9ee0b09c33b11c6979f28a2
- SHA512 bfce590e3979b55374a62d5787d1efbbf396492188f0e9a0333f87dfb41a0d16c443088452417a47477eb0652329a9ab4ef3b9d0ef117122eee33205b7c28faa
- SSDEEP 192:w1dwQHjPNon8Qp6Gtm+5+XwJ0+X0Xc1DiD5kut+Brz+wGYACYzugs2u+fArmztdV:BKPenbBwAJ9X0M1GdkzUNYdYK/+fnDXl
- TLSH
  T14832120FE8099ED6E35265396EBBA50C6138507F924641B5FCECD1483FC2210BAF69DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  renpy/sl2/__init__.py
- Size 448B
- SHA256 4a101f82bafccb48e884aa68764d588a573b101952522e567393bc13052232c6
- MD5 8bc9ac25dd079a65697db8f08a3f7168
- SHA1 a95ef093fa868068608e54c44876a85a4804bd4e
- SHA512 561c9aa066d5789fc9b676da9a59edbaf27723d9f716fa0bf6554096e7f581d0a75f2a470756adbdaa675238ead7efa4a4748cbaa0209086ba9fcbd21f116423
- TLSH
  T122F05C2FCC41DF440AE991FC44DC013047FB402A6B0911A4DC811376AF4266C1F31C19
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  renpy/sl2/__pycache__/__init__.cpython-39.pyc
- Size 664B
- SHA256 e903af8becc0b1ef01ef40af597a77c0270b8c5e82140df9ec0dea58f4ca6ddb
- MD5 e1f5116f3aefd38aed20e07d2ef9e2bf
- SHA1 540e6ffc6af3a86fa412a4b3c8e4c25f4fc504d3
- SHA512 f13f6cf010acc3c78cd12040007002c9be33d2b499d6416e5a0913173db9ae98d0edbfee5123e4143654b151b69efb01f2e9159ebf35ea0600d7478897e5b826
- TLSH
  T16801DD83601AE774F9CDF1B840AB2636D874222157F462A33A0C99AA8D0AA24591588E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  renpy/sl2/__pycache__/slast.cpython-39.pyc
- Size 50KB
- SHA256 1fc5733ef53a9fb5393b404616f74cb0405ed9a343c8e10a7fdfe5ca806f95da
- MD5 6b389b134ecf3d92fd0f952e2ef9e2da
- SHA1 8bd5fbfc11446f21de35046b47880595ff2b4c58
- SHA512 09e85561c89a753dd1428a2366621827fecd43afc4f003a1857a6fb08666f8954b80961f8c1f951ae68ea449842041a46270bc9d0fdba3c162deeb720886b8ac
- SSDEEP 768:2bkQa/qWWwy/y1ZL/5CmEyABavE634NR1tJpyScVU2kVdytkjLraiAj9Bb:2qS3W3VgyAYDanpyxs7lAjX
- TLSH
  T1A533D6E4B5621E8AFE36FAB85C880351F624967B238C7143701CD56B3F4B3C99D29D98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  renpy/sl2/__pycache__/sldisplayables.cpython-39.pyc
- Size 9KB
- SHA256 03481b5e90de07df29585036222aa8a94aeeea7d5a7a29a2ce2de3faad9e23e8
- MD5 5f3018e4364c1c3dc2bcb037b46d25b0
- SHA1 5b2ded0760f2e1614c4bf3ba92169e1da1d8da10
- SHA512 dbbcceb7ea0761306938a2647dc6775bdf028797c940bbf18820909a9dcb7f51459209c162e717ecc511f8fc5c74beeb1d57fabe8643e79d366c463c6bf2493c
- SSDEEP 192:wdsN+LG6EJu6RIoaNxG9XLj67y1BdYzk0j0Oix39XL9J8TZCUDeii:wuN+LGjJc0b22oh0Oix3979J82
- TLSH
  T15712A343E34B6959FE89F27998631230D760DFF9E3E49211AD03B71E0C8A5CC962558F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  renpy/sl2/__pycache__/slparser.cpython-39.pyc
- Size 24KB
- SHA256 4397e46a268f42f2f6ba5caebd506ccda89f98921df4e978bb50cc6278f0f0f5
- MD5 f29c0d5885d3dabeb7b45b0c8f246669
- SHA1 7ba64c52acba6bdfdf022e23fdf4ed1917eed6f7
- SHA512 9273a6e92d08aa95cbf817ec469ade474edcd188decc1ea42578ec3c4906e73f8dfada644541789a1d008087cecf1492f83b54069ebdbac1ee8e4b492a1a6d36
- SSDEEP 768:vh7dYPX4Xq3q7IxLjD5+sZ/VD6ZbojsdjnRmjG91:vYoqaUxLjV+GDcsYnReGz
- TLSH
  T194B2D8A1F0C11E96FCD5F1F898AD0219E035C22F23988155765DE36D2F0A9CAEC3B9D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  renpy/sl2/__pycache__/slproperties.cpython-39.pyc
- Size 4KB
- SHA256 0334650970e84250ae1b397c158b3bed510931f8ce95bc9c2898a8b1d6266bff
- MD5 84e81d06680fb25421106168d9c1ab6f
- SHA1 70ee65796d82610ae549a4dc19d913e02b4d2bbe
- SHA512 5d1ee43f0624bfb7a1571da4860c4aba83b6d3a799b73c7944d8a603894e15860a287f204eafacb8046b4e8ddcd77536b5d47a98639e669b17a04fd7801f8b8d
- SSDEEP 48:QdJZTfDPG9oU7ve3FHOpLB/rnyGcXhdiUJBDtCeT3bL9WVO34KH/NvqfylwJq02m:A3Dk7ve1HO36dHRNxLfNCn2N5t9zGp
- TLSH
  T1D8A18581A958CCEBF4E2F37DE3D71381FA52B06BA3B7A341D62742F60DD16C01122066
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  renpy/sl2/slast.py
- Size 78KB
- SHA256 07734025bebacba4b2dc1a429200c2f9db968b0c5cc1c310bc09090530c93557
- MD5 a2f895ab0843f7de142ff40560af1c28
- SHA1 25f8f839a2617026a8cc09e0239f805a8f1029ef
- SHA512 5fbae234dc9dd5a307a5369875f32b1f7b8caca9a656ea2c421ba00d445212a9655298f925e1884e810ee8ed4e797095034884931c33007be6146a01a215e348
- SSDEEP 1536:MjC+mM+L6B+4HLpFxPbm6OeOq7Aulu/MZ0cKv5/3PNU7cKvaokVree:ym7LvopvAqob6Oree
- TLSH
  T1477365369E175AA1A21B8C6A48C3E503732ABD43718C50B97DBCC19D1F8171981EEFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  renpy/sl2/sldisplayables.py
- Size 14KB
- SHA256 fa1e2cd546913599066d68b1cbc9f280f6028ca4c2f2b530b71e402cf1ef208d
- MD5 e322efe4d56f6b0b9653b8c19b0174c2
- SHA1 6588dcf17d8fbcec5e8d1e82a9b8a131744e0053
- SHA512 703c110a4c3f283e2668629fdceb5c82b7eb9f93f6a60098105c877a6865e243996cdd2487ba7c33b8f58b8408c0e47ad41ef8d9ff43f54c2e58843c63c12832
- SSDEEP 192:w1dwQHjYn1FksFMKxOGVMV+OhCHORyhCHzdDUzbKU/bVQQWJXwcECzCYvvmb:BKuTnzxOGWk2UCUuwcHHvmb
- TLSH
  T1A6620101E0817DE007CAE61994F6E60BFA39F803464952FC7E7D4369BF67238419ED9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  renpy/sl2/slparser.py
- Size 30KB
- SHA256 e8a7ae205118e462e1b74dfd3a7ee6ae87eee0ab012eacfb6eb5e9c52068d3f8
- MD5 ac8afd904a23b6eb3803b89f63b94d4e
- SHA1 3fab82748ecaf58b8937c29e11abf933c380314f
- SHA512 c089bc43f48ea41033583e64b3745e7460c24d9806a2fc80b32ca7ea18224d39b83cd9dbcaa8b964a0e53c92ed3c34a737bac4453e9c1edcdf75161a79cd8fb9
- SSDEEP 384:BKXAjCVSjz+lSLcq0COBKMp5aPHIaUFgYnTcZiU6JVrpepAVRXg+/4GNvVP8dXM:I2CV0z9oTp5L1yZ/6JpUtM
- TLSH
  T16ED2A613E82219A15B5BD8394CEFE5137727B807590851A8BCBCC2983F55A1680FFEDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  renpy/sl2/slproperties.py
- Size 5KB
- SHA256 232ae8335fbafc7d647011501348a240f6f520c80565146447c786dc36f3ab83
- MD5 65b8a5af0ba2bcf98b9d55eed4be390b
- SHA1 3634c6930bc82212a8278ad6bb0be0605d7b83a7
- SHA512 cf6e062254b64aaaec9cb8fcfccd221a58c2f0ad245bc074207d331782f745332722a2e9f8c3055828c40a828e6dfcb02430c9d13c5beb3365837f7dedcbec40
- SSDEEP 96:w1zPjdwQHj162/7HRjDKfu/QQlNVuQ2UrfqOzzyMrG5yRxhT:w1dwQHjkS75Wu8cPydylT
- TLSH
  T189C15127F6099E5106F3910494CA4806B32571478DF1752DBBEE63AC8F2D92F11FAC6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  renpy/statements.py
- Size 12KB
- SHA256 50b950a69b458cf38693b3745f21a7dcdbbd728d4c52e73b5268c965d1b7e88f
- MD5 0dfb94f6a34c0dcbbca6714fbd0395b1
- SHA1 a724111debba04362da3cf9da34c119ff771d531
- SHA512 574ecda6b0b14a4096e127fd257db9a941b6902293c256940e980d2c0cde660ff7a0b2b77661d44a0f68313159ee41b9c77047d975bebfc28929b2b29a37ef1e
- SSDEEP 192:w1dwQHj0XsY5Ot7AqXE6wEqW5xHbx9O+C1LTMeLbI+4fqmpirgkZDc59IReVIpS7:BK2kLjO+sTMeLJ4fzMNUzVIp+eaJ
- TLSH
  T1AD426317385163B3591E5526CDDE62E8D31784AF062070E0F8CCC59C3F1A91DA2BBDEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  renpy/styledata/__init__.py
- Size 2KB
- SHA256 a48d53e36c4838da6abdfa5c74ca0897ccfed60bcd2a9dc1e67287515e75c02e
- MD5 6da63a90ff249686fb38e414bd41309f
- SHA1 960e89aa22d4d3fc124e2d09f7957a772bc330a3
- SHA512 da9b45198c2a81bbf2bb656f44f7a75b3d6d0e6aac4cec97b19165b757a18cc97f452f5f45731a0299e1e65618c21be901d9f4895c5b523ddf48dd99679cd18d
- TLSH
  T1A4517A0EF493A32E90CA89ED88CF045D62F354233B9522C56535A370BF33A5C7676D2A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32