7589676c8c31f9b79278c2f164ad77b270e883fc52dacd14add1449d4a0a7f09

Sharing

Copy URL Twitter E-mail

General

Target
rage newest.rar
Size 15.0MB
Sample260629-e23hcscz91
SHA256 7589676c8c31f9b79278c2f164ad77b270e883fc52dacd14add1449d4a0a7f09
MD5 7ba1ce0358c9618d2620942cebbbf908
SHA1 89f662c6fcb98ef8ffd75518a30a3ce42178fe62
SHA512 4e6f9a1442da9c97cfd3a99bd8f165be97b4385f5457fac5b8193b1b6514c692785a6bae5afdc1a85cc2c274040fe18857d29cdf09e8225080e45a7765290ac0
SSDEEP 393216:5galo7AKHTtNKG9R16PcJaEXp7+CFneIXHvyKIS:5gaa7ttNh9G+pK8PyKIS
TLSH
T1AAF633A03A14F863CCD9A9C66632C661080D742CB76DD52057B26CBFE0EF55424FBF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  rage newest.rar
- Size 15.0MB
- SHA256 7589676c8c31f9b79278c2f164ad77b270e883fc52dacd14add1449d4a0a7f09
- MD5 7ba1ce0358c9618d2620942cebbbf908
- SHA1 89f662c6fcb98ef8ffd75518a30a3ce42178fe62
- SHA512 4e6f9a1442da9c97cfd3a99bd8f165be97b4385f5457fac5b8193b1b6514c692785a6bae5afdc1a85cc2c274040fe18857d29cdf09e8225080e45a7765290ac0
- SSDEEP 393216:5galo7AKHTtNKG9R16PcJaEXp7+CFneIXHvyKIS:5gaa7ttNh9G+pK8PyKIS
- TLSH
  T1AAF633A03A14F863CCD9A9C66632C661080D742CB76DD52057B26CBFE0EF55424FBF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  rage/dependenices/imgui/slate/x64/Release/imgui_freetype.obj
- Size 329KB
- SHA256 986df0f435408d072b56170da160a6029b4b01a232bf9e0b5b04b0b140a7ffbb
- MD5 68a3424d4fc60e662573b5c57ca55d27
- SHA1 b83b8bc6620d4a88a51a793051f7acfc54e22de4
- SHA512 ad04d26188f0b65795a71cf2a92f9f0e72fd73adaff78bc64ed76a7639b05fbd3f56ea1fc0e6af251cb51f1401b055ad1a2d341509828e4d549fca2a4a331cd0
- SSDEEP 6144:76zxdHxiVcAKkF9gLrBLYgWld4AUHRxqLWVlhUzgNOCUu8kT29unC:gGFiLrBLYgEd4AUnigNOCUu8kT29uC
- TLSH
  T14674B865D1F4C687E62A5870D05F032D6C93C4B99464CB56DABFC01F8CFC38AA4A96B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  rage/dependenices/imgui/slate/x64/Release/imgui_impl_dx11.obj
- Size 549KB
- SHA256 3a8d579c562704aa9fb557b352fcaff4f0614bcd762f3f0f990c87101078b10c
- MD5 b2ae8bc9c91b6ab35d3ff1d1bd448fae
- SHA1 66e801112da495bf3f885f9dd4b4b92a577dd54f
- SHA512 c73c7a69a00d871504d639bac43efe20002e7ea7ad7b388b4473ba455ddef2a1239366ea732a33553af0ba514b70b2e63429db4b21356cf00bfa17dfd4d88a6a
- SSDEEP 6144:Eq+SGbEHqYySgDwgLrBxdmtwy72lmM1neQTGo1lHVXhWEaTPiF:12Q+JLrBxdYw+GmM1neQTVsLC
- TLSH
  T131C4FB1280B8C9C7F6B64D65E10F0329BDC1F2669D76432790AF8BCD4CA435E996C9B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  rage/dependenices/imgui/slate/x64/Release/imgui_impl_win32.obj
- Size 283KB
- SHA256 5a0e4759d059794f63a85b929de7d6947e3347736f7adab9c190618b50a5ec89
- MD5 ba84c1309d5ec0a8e3420144c223e0ae
- SHA1 9d502bbb53fe7e9d131f1622dcf21f2bdeb48d08
- SHA512 1013a6e9fab5ba9c26dce6cd8a2d9c5758289be29eb93c8a5dac1fde0eacc6bbf8f5fa172bacd082944172a5744bded572c017eb350a6e6c917c7fdc2bcf8e1c
- SSDEEP 6144:go1T/7ENgLrBVG19+TYrOFJKGsvQNQHQBKYIJs:11ToSLrBVG19hrOFrNQHKr
- TLSH
  T16354A656D0B8C7C7EA2AADB1D15F032F6990C4BE48F48746857BC16FCCAC38941A9673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  rage/dependenices/imgui/slate/x64/Release/imgui_tables.obj
- Size 546KB
- SHA256 8b1f18c1a8c2bd6203e8e16e3929166e0ed2ffe8ecfb6af4c4867b97a5be4d0a
- MD5 fa670e7d7bd6b2d1ff67a8592e047c7e
- SHA1 129853bf8380fe643eb3397aba5dbfc6e5ac3e82
- SHA512 c7588900a5099ed97129ec4d8927b978d3a677fe8289c39af95fe0cb15e51815be9d13060d7260ec39fd2beb903fd90018138bddb5b8ff2b69ebed159bb10c09
- SSDEEP 12288:jIsLqJLrr6CEPUS3kVuGeiPr7eTeP41gtOHeIa2Jufy:jhqt0a2Jua
- TLSH
  T10FC4F799E1A0C287D76A59B1C05F033EEC63C4B580A0D652DBFF905FACEC345E4A5DA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  rage/dependenices/imgui/slate/x64/Release/imgui_widgets.obj
- Size 1.1MB
- SHA256 02f0a9a568b23399c22bb4efe8f6efa34d655ecf63b248801f53a9b1fde4a4ad
- MD5 7fba18a3c42c306e7a474693200bb9b4
- SHA1 38531d107d70693bac1ecdd910dd07d976b3b205
- SHA512 e961733dd1d3efa3eeba48b61671b845952654e4f0702d3a3d74c801253ae88a1052058d0ab5e48e17e5feb06e54f0beca11267c021948c24328191849a730b6
- SSDEEP 12288:+Snpi9b9ED/Lrr6CEPUS3kVuGaOH7bk4PhZ9XzirIQcWwQGA9EImsbbgbyYgw6T8:+Sn8ZODbnNN5piWX9kzNQ9t
- TLSH
  T1FC3509E6F260C147EB7D6831D04A033DBC53C86A51645653DBBF80AFECEC249B4A5DA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  rage/dependenices/imgui/slate/x64/Release/main.obj
- Size 1.6MB
- SHA256 842996e47dd68d855128c53296513d3536ba6d6ec6a4dc87113f09b648ff482a
- MD5 17ec369c960d16b85396af15a947f9f0
- SHA1 2b986b5e477ee1616ebb8a183448ba8a3e6acd91
- SHA512 b0d88dc268d9d21dbec2fd41dd80525c738a6de88171bfd2067c8ebb50d8ca9757899bd24b5c6314566b95c12b9e114906f2dd1d4d184470c4f22d6e40885321
- SSDEEP 49152:WWBVgrqC8G3CdJxn8dG7G5F0TzNrEbCOVgvycER06Gx/TwQ9HljNkVHOZPFb84EQ:ntb84E2DddlB4fLf5G
- TLSH
  T19F751A12C8B4C647D6766D60D11B033EADA1D5AA59348AC3C1BFC52F0DAC2DE82E7973
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  rage/dependenices/imgui/slate/x64/Release/slate.obj
- Size 14.8MB
- SHA256 cca6bee3712e12c79766d8b86e39fcf7968bacefaa8a066f0094f93da704c7b4
- MD5 0dc95e2c9d5395aa6984054c59d12e18
- SHA1 56fb979ab890d5627bf330bc5af524e22c2f4180
- SHA512 52bca9695b960839bb7b6662a1dbf04bff037e39027f7aee51ad2f02e2abc81f65064b1e81096c8ed4b3b686bc63113293becd1770be83bd30f54362df8d91ef
- SSDEEP 49152:C2VghDqC8z3Cd5xU8dp7Vn5X0YzYwriSbuOVgvyGGvRPd62j/GovLOFvzQRpCYq1:lCvLOFvbp4l9C5FvJNRe5dLXah
- TLSH
  T1D7F64047F0189B43AAAD13821832877E285035929F6C77EE517CC69CC9B22FD417B5EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  rage/dependenices/imgui/slate/x64/Release/style.obj
- Size 1.7MB
- SHA256 47409ac84da6e7739a10c5d1f04253e5b5fec8ee89a6d7ab225a9dc2b59cf4e2
- MD5 48da414485f4401fac58e80858113ce7
- SHA1 0588bfd7ee1897e4cd150deb4578cbe57e902b5c
- SHA512 bf61b1c0ea79b4242bb9b06ae0ccdd617dc6b1c162ff96f2b032548828bf821e9e22b0b112f5f64bd37904b82ebc4a92fb41589144fab4ca9ce24a48725ef949
- SSDEEP 49152:mDXgjqC8G3SdJxz9d27Xf5s0hwzWrKBbCOVgvyZFRE6xL/hHQ/mzUZCFT0AuR8gc:G8ZCFT0AuR8geImJKO5r
- TLSH
  T1E7851A12C8B4C647DA766D64D11F033EADA1D5AA5520CAC3C1BFC42F0DAC2DE86E7972
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  rage/dependenices/imgui/slate/x64/Release/vc143.pdb
- Size 2.3MB
- SHA256 0c5946148745ba0fc970519f40a8c828ee910ba5ccd08a99ca872ae6a57d9df4
- MD5 f7853142869526d9bc621387bbef1a6e
- SHA1 325cf21a1f3a621fbbf722204f0bcd9e7186d100
- SHA512 cf967409c494637b420ee5a26159a5badb4e8d474783690352ee9e59cc5005bfa929d276e02febc231bb291589942ed5fba4e34122d1803022e958cb898e54d0
- SSDEEP 49152:jErY3vJLkmTgmjhgVeno7cFhM6xLMBs8FJ/LhKpM+wZ9UXOUfWccn3hpdSkiBbpG:BS++18CDpr7GG6jK
- TLSH
  T12FB5E7B3E5825C53E8BE673EE452025077155E8AE3CDBBCB4086B0346DDA35C8F2EA51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  rage/dependenices/imgui/slate/x64/Release/vcpkg.applocal.log
- Size 5B
- SHA256 f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295
- MD5 3bab25a3e651a9e4a00473d2257b99f9
- SHA1 1419458f2696be8daeade77ddad380cd0c871fdb
- SHA512 ae8dc1129b7a81ba70c9512a94a3e9ccd8c159f1817e309198c2babaf5bcb3f7e97f43b54ea4937cbea468bb5a62328fc0c01982aa1b883d8fd6d2e2c58090ff
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral21 behavioral22
- Target
  rage/dependenices/imgui/slate/x64/Release/widgets.obj
- Size 3.5MB
- SHA256 564bea985d0a3c2acf49481c28e5bf129a63aa6c8e35ff0657b1972955ddf583
- MD5 002ce77aea4ac8b724d16594662dbe5f
- SHA1 d32f0368cef319540e29819c205c28fb60ef5965
- SHA512 21fe46270863d20ac10cd19fffded19c8f04eb877ea19420e33e7b69348aa0a4c017ed34450afc11533fe2554ad5b32bf2f156dacfdfc02656110e0f74a1c1d3
- SSDEEP 49152:uZVluzxglnSUeebVPS1/IsqC8MKQi3yNrR4MkdOwxuPtTNKnIGdlYLS5m8G7Aaqv:r2bF13YhtWV/7JyJ5fJsspY
- TLSH
  T11F061B23C5A5C643F9766B24D01B03299EA288DA9663DBC3C1FFD06E1DBC19D83B7521
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  rage/dependenices/imgui/thirdparty/include/animations.hpp
- Size 1KB
- SHA256 52c1628f125f43e90612d02bbca74a3d623a9079b8e2089c4b6c9d3a8af0c58d
- MD5 eb76957c7da3f948288e845295deed8c
- SHA1 121a7261c912bb51ee5441948c9be05d4adb6f80
- SHA512 0496524ec32d7c0ea83b94dd8cdd7a4812594689582d6e8e276c7bf8f4c023dae947c2e1945f7d8757dea7bb64205caa1b95c02c5530011da55438569ddc6677
- TLSH
  T12031A6D41027B6090FB1B32988524960DF71E9777B4C3B54B88FA2BE5F2001E8278BB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  rage/dependenices/imgui/thirdparty/include/freetype/config/ftconfig.h
- Size 1KB
- SHA256 d4d3f993f3db4c22229f60fc031a81f5632add9a332552540e34ec85ea589c8a
- MD5 760caf116c958ad49a8cd0443aa53209
- SHA1 6d716d41392378c27c9d1833ba0b0519ff4a4c69
- SHA512 4adf726feee80a0608ee10534dcdefcec31ca6cd42b5ee035f3fea129a86eb25e4f064f824c2aea025151722c11e647dd338d00b51606fb862d02aaef8c4fae2
- TLSH
  T163313F2516DC1EE382830DF2A31916DAC317A5AF62220870708DB1543E0FEF5837BB92
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  rage/dependenices/imgui/thirdparty/include/freetype/config/ftheader.h
- Size 23KB
- SHA256 a108f40ae2861dbf363b247317a79b182018ea6a5e6aa51bcdf94ffd455139f7
- MD5 0e8d5dec842ac72d77867c265ec7f944
- SHA1 7ec70ca860ef9f0065593ac98ba10d8946c1e205
- SHA512 faf3b08b4ac5f95ffa8e75aa7854adcda1dd0314f41e40ad817e374684d1d172e573a241233ebf484a1189ee7d6f135930af9d8f5069e0091adc406b48ad3d81
- SSDEEP 192:IHttVyaxt44HptVfxtHDYpivmLnjiF97guMmN3S7OiWlH1Gqwevuh3SaVRpUf:6givBhMmRS67lH1Gqwevuh1w
- TLSH
  T134B2F1052DC83DD3C5270872425694D9E7193AAF830209E470AE366D7F8DFF39ABB295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  rage/dependenices/imgui/thirdparty/include/freetype/config/ftmodule.h
- Size 1KB
- SHA256 61c76e01106e7b7c80f39f8d6fd479b5323b54d757c9a2cb66d07064ef616649
- MD5 3ff40fd5c4e279577cdd7b49ba8b7890
- SHA1 b5e41b76072cb3df01daa4348fdf1cd302d7e9ea
- SHA512 9230c27ac0b7cf05af7988fcc00833fca258ef0e2e403fc16def232e61adb70af781a9b1148166015e72297d4f572934bc0fcea38763cab4918c9c27f58a1c87
- TLSH
  T1DF21D7CC6D5A2D5F90C744A2E791C81DBA41A74CD22D5934F9BD025DD30840CA0FAB9B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32