3a805955a53421c7300c806b5cad951a29d9b464a05de1e66a7d7b2ea1b282ce

Sharing

Copy URL Twitter E-mail

General

Target
RefreshTokenApp.zip
Size 52.2MB
Sample260629-3kn6eahy5x
SHA256 3a805955a53421c7300c806b5cad951a29d9b464a05de1e66a7d7b2ea1b282ce
MD5 c13b4cb54204ac4d159a63cd9a779f10
SHA1 9e58d2a549619338a83b602a306faabc1c968536
SHA512 b1560ea0f5b512c532e6b03fb54ea3b33ea52d805c6bbe5fd21cc54c3408bfc5784b418fbbdd785a63bd2abf9cf4c358cdbf6bc03a7a1123db229193376f40ae
SSDEEP 1572864:YVd5k7UzY+0Q78753OczL4IbmMNtqk3LQQ9VOHiMXJ8gy:YVd5HEm25BzLlw29SfHy
TLSH
T146C7333A26392910C14AE67190232FA62E3D88B3E57DDF32FF3505E13F803DA69665D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RefreshTokenApp.zip
- Size 52.2MB
- SHA256 3a805955a53421c7300c806b5cad951a29d9b464a05de1e66a7d7b2ea1b282ce
- MD5 c13b4cb54204ac4d159a63cd9a779f10
- SHA1 9e58d2a549619338a83b602a306faabc1c968536
- SHA512 b1560ea0f5b512c532e6b03fb54ea3b33ea52d805c6bbe5fd21cc54c3408bfc5784b418fbbdd785a63bd2abf9cf4c358cdbf6bc03a7a1123db229193376f40ae
- SSDEEP 1572864:YVd5k7UzY+0Q78753OczL4IbmMNtqk3LQQ9VOHiMXJ8gy:YVd5HEm25BzLlw29SfHy
- TLSH
  T146C7333A26392910C14AE67190232FA62E3D88B3E57DDF32FF3505E13F803DA69665D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  RefreshTokenApp/RefreshTokenApp.bat
- Size 99B
- SHA256 8a23f32587a4ee32add02eb48e98587fbdabd210db233845d2fc7def480b2224
- MD5 66236dc342ca40a4ca57be71100df9de
- SHA1 5bc9af15a4494e2d3c34f403f6c0b8c55e121b77
- SHA512 637c8552a2271a7f3a37c6ee2b9f831764b0d6cd6de7d6ffc39f60d1884dbf4f86d76ca8caec15ee01b4fe10bc451147e98538a50f030c6f7440a10e8f27cdf8
- TLSH
  T1A5B012D589A00D52E3832B27F16719F1321FC56A80C4D451D000555D1C8E2095BC5486
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  RefreshTokenApp/app/refresh-token-authentication.jar
- Size 6.2MB
- SHA256 a31cd5be4ce7c85563f582c891831d3ef60fd76d01b9c5d2a9c41dd4c85186af
- MD5 592fcc7b547b0c8ca527ff9b43632680
- SHA1 8eefbf19a17d7b9ae92ec307938b0f5de413fbd2
- SHA512 995a0e03c7bc7bf821e159b1a07460110cb5b3c0cc7d41d9435ab3a929b4570f2056589cc04954a20f7c1f9f42045f40ed366d1467e29b530af25bf98d9b95d3
- SSDEEP 196608:g99jaBv08ac+pdUANKQy0TmfwzqJrNO8II:g99OZRacO68K97oOJrNOJI
- TLSH
  T1E466F16678C5CD62D567A8B0E791E033F42F86CDD007A01B69B40D5A6CF6989C312FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  RefreshTokenApp/runtime/bin/api-ms-win-core-console-l1-1-0.dll
- Size 21KB
- SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
- MD5 9f746f4f7d845f063fea3c37dcebc27c
- SHA1 24d00523770127a5705fcc2a165731723df36312
- SHA512 306952418b095e5cf139372a7e684062d05b2209e41d74798a20d7819efeb41d9a53dc864cb62cc927a98df45f7365f32b72ec9b17ba1aee63e2bf4e1d61a6e4
- SSDEEP 192:xt/cOTWthWfWJWadJCsVWQ4OWKNVAv+cQ0GX01k9z3A1tUXj:xpcgWthW2CsjNbZR9zOtUX
- TLSH
  T137A219D38EAC8546F8AB9D7046E8DA437C3E6BC71950615525F8F55C2CA33C1EB20B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  RefreshTokenApp/runtime/bin/api-ms-win-core-console-l1-2-0.dll
- Size 21KB
- SHA256 c062477ad3bfdc57b0cc402179637a214dab5045c8d644592c7decca7d18aa50
- MD5 5ec3ae03796fb3d461690cf679964b1f
- SHA1 2b1977edb9c4d609ee77320464a1514053884851
- SHA512 b160a5b1fb1e5fd95fe6cd55b64427bb3f39e1d30484743807a18443ce2f90203d5319d75f3d0cb0744b1dd21171ff82cbf4e4fc3141ac3d7abe40937fd8e647
- SSDEEP 192:xGDWthW/WEXCVWQ4OWLtugx6RMySX01k9z3Au1tUkL:xsWthWUgYMR9zv1tN
- TLSH
  T166A22A939DFC9503FC9AADB056E8E9537C3DABC70A00606625E8F54C2CD3391AB2472D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  RefreshTokenApp/runtime/bin/api-ms-win-core-datetime-l1-1-0.dll
- Size 21KB
- SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
- MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
- SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
- SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
- SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
- TLSH
  T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  RefreshTokenApp/runtime/bin/api-ms-win-core-debug-l1-1-0.dll
- Size 21KB
- SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
- MD5 226a5983ae2cbbf0c1bda85d65948abc
- SHA1 d0f131dcba0f0717c5dea4a9ca7f2e2ecf0ad1c3
- SHA512 a1e6671091bd5b2f83bfaa8fcf47093026e354563f84559bd2b57d6e9fa1671eea27b4ed8493e9fdf4bde814074dc669de047b4272b2d14b4f928d25c4be819d
- SSDEEP 192:xqWthW8WEXCVWQ4iWUAURDoSJj+iX01k9z3A0FCH1Whf:xqWthWH/DX+iR9zHFCMf
- TLSH
  T194A23BD68BBCC142F9DBAEB0529CDA437C3C57C71A10D16646A5F19828D33C4EF20A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  RefreshTokenApp/runtime/bin/api-ms-win-core-errorhandling-l1-1-0.dll
- Size 21KB
- SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
- MD5 c2f8c03ecce9941492bfbe4b82f7d2d5
- SHA1 909c66c6dfea5e0c74d3892d980918251bb08632
- SHA512 7c6c85e390bbe903265574e0e7a074da2ce30d9376d7a91a121a3e0b1a8b0fffd5579f404d91836525d4400d2760cb74c9cb448f8c5ae9713385329612b074cf
- SSDEEP 192:x3XmxD3TsWthWBWJWadJCsVWQ4iWozCCtvpGX01k9z3AtYF2LkQ9:x3X0sWthWgCsJZpGR9zMlkE
- TLSH
  T111A229D686BC8143F9AA6DB042D9DD433C3D6BC65E5150260AE9F1581C973C1EE24F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  RefreshTokenApp/runtime/bin/api-ms-win-core-fibers-l1-1-0.dll
- Size 21KB
- SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
- MD5 b5e2760c5a46dbeb8ae18c75f335707e
- SHA1 e71db44fc0e0c125de90a9a87ccb1461e72a9030
- SHA512 c3400772d501c5356f873d96b95dc33428a34b6fcaad83234b6782b5f4bf087121e4fd84885b1abab202066da98eb424f93dd2eed19a0e2a9f6ff4a5cfd1e4f3
- SSDEEP 192:xLWthW6WJWadJCsVWQ4KWeeLrp0KBQfX01k9z3A3WXa0Sr0:xLWthW3CsneRxB+R9zcWXJB
- TLSH
  T1B5A21A815A7C8187FDAB6D7042E9EA973C3D67C72E5090AA45D4F5582CD33C4AF20E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  RefreshTokenApp/runtime/conf/jaxp-strict.properties.template
- Size 4KB
- SHA256 3cc9b87633769414b22c24c97ecded8a15df630fe5ab12abca2398d88e31b32b
- MD5 fd9c1610c84407bf676dc11322c522a7
- SHA1 c965c754dd6e44602d9763c2061a6c5abc95ccbe
- SHA512 a4ea96dcf744d470539bf5498fd0c427d2596652e92ed89751eec68a869f4aa1ec207dc2bb0ba6a9f9b055c6df421e1a0a64e5c3c6cf4f44f00215c5fa9908db
- SSDEEP 96:Wl5e6xCDB1s7Q3GJI9LcvGjLD3Y89V1FZyueAnyRYp:WLe6YDB2Q2rGjLLYO1mueAyRc
- TLSH
  T144A12052B559FBB4038A42E4D40E12DEEAF07468BE3B647471DC566C3309EE066B71CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  RefreshTokenApp/runtime/conf/jaxp.properties
- Size 8KB
- SHA256 d4f45052a100e5aef02b6638a3b9c69b2bdd46155ceb58a52671e5d594c30100
- MD5 80f4a5f43c22b97be120e0716974a029
- SHA1 ed8df3f663c669bbe7d9dffd03d4800fae364ba9
- SHA512 875a099a87f8427057661f1b2463c3ba4f2f1070247ca7c1064b3d4e3f45a878057c374eb80f6d760537fa0c11d30add9bd34e3ee9f70c2259f274e719dc5bd5
- SSDEEP 192:vmeomZOmsWKjL53t72QxQOjLLc12/yAyRc:ueomZOmsWKP53t7HxQOLcs6c
- TLSH
  T1B0024123B64DB774038602D1910E13DEEBA8696CBD3764A475DC263C321AED423F75CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  RefreshTokenApp/runtime/conf/logging.properties
- Size 2KB
- SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
- MD5 c4b74648f229c4b7e62a1061ee1dc3f0
- SHA1 5795edcb624326bbefdedcdb6a11d9c18071d8ce
- SHA512 76ea95402f64947c2784f1f8d0857f0d7c963285ae9ebcd9f5cb407d83a14e4da6d14aeb8641c9d9b1c92af4493a4b10e52ad6efda7ae47f265d43df6b4002d0
- TLSH
  T13251FE5E9B4E2D35430E00AA5A7FF6527E1898BD1C23A5F6B35E6304321D43485DBBC2
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  RefreshTokenApp/runtime/conf/net.properties
- Size 7KB
- SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
- MD5 1f251a36eb37913b696b5be5595e1cd0
- SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
- SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
- SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
- TLSH
  T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  RefreshTokenApp/runtime/conf/security/java.security
- Size 72KB
- SHA256 a86d4ca2038d0978d8b539224e9d60ff55b475fee2e6d113ee24c8a60852c70b
- MD5 25fcce9d59b4dd156d532ca47a742597
- SHA1 eab689f234879082366530e25737fad0f2983010
- SHA512 efa421a738ae79056fb68dbda14aade554f984b110fcc88f4e1144eab3699900d981f3875f6497a731b1a58d1bf0c3bbc6e589302f897608a9b50e6629886267
- SSDEEP 1536:rQMy8R78MRjJPFp5/LTNHu1UoQ2k/gl0ug6YilNndOcA2ZIYy60:J8MfPFD/LTNO1UoQDHiDndOcKp
- TLSH
  T12673D522BB897B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  RefreshTokenApp/runtime/conf/security/policy/README.txt
- Size 2KB
- SHA256 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
- MD5 3d47d94bc4f19d18bcc8b23f51d013af
- SHA1 a97cd312d6a2a9c8c780c15e5af51a2f4f97c2cb
- SHA512 68a031264cf9442526307364ca74b336af55564c233c2f514cac48e910022767562f8ff6a64bb9cfcbf0fb5e755289273382c9246418a4b9207fc7761d03c64e
- TLSH
  T17C4174077E4EDB3204E3C0D36A6A92C1D361A29AB2A5121D750D425C3BDCB3083BF193
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral23 behavioral24
- Target
  RefreshTokenApp/runtime/conf/security/policy/limited/default_US_export.policy
- Size 146B
- SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
- MD5 1a08ffdf0bc871296c8d698fb22f542a
- SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
- SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
- TLSH
  T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  RefreshTokenApp/runtime/conf/security/policy/limited/default_local.policy
- Size 647B
- SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
- MD5 6d7b4616a5dba477b6b6d3f9a12e568f
- SHA1 7fb67e217c53a685cb9314001592b5bd50b5fbb9
- SHA512 a0b98cbbb49184df973bb2c4a506e9bc6e025a696bc0c8054a6352cc3f9b4a38e3baf117c6834ddaddc38498556607ed4eda8f1bc683f662d61da50e0db0c8c2
- TLSH
  T18AF0310FEE49FA740998C1567B3DDE07D175A11771940B69F31CC0601BD8EA0D791B96
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  RefreshTokenApp/runtime/conf/security/policy/limited/exempt_local.policy
- Size 566B
- SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
- MD5 4cbb03f484c86cbea1a217baae07d3c9
- SHA1 ee67275bc119c98191a09ff72f043872b05ab7fd
- SHA512 2bd70518aed6b0e01c520c446830c5f567fa72974548818cac3e1e5c2be6f03db78ce6012f5463b1e19c36243d04cbaad38ec79524635eaae2e427eb1875ccdb
- TLSH
  T1F7F0811FFB19E5F564C4DB920776B84DA3319AD270B0431CF546C1942B94911C3325B5
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  RefreshTokenApp/runtime/conf/security/policy/unlimited/default_US_export.policy
- Size 146B
- SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
- MD5 1a08ffdf0bc871296c8d698fb22f542a
- SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
- SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
- TLSH
  T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32