fa3c0d40eb3082e2fafabb24514bdc5fb8efb2242135e8075a4bad53476f8d09

Sharing

Copy URL Twitter E-mail

General

Target
full.zip
Size 185KB
Sample260629-hp74vsfw6s
SHA256 fa3c0d40eb3082e2fafabb24514bdc5fb8efb2242135e8075a4bad53476f8d09
MD5 a3a726e4288abad8e2f7e4eee8abb646
SHA1 04bdeaef9f16eee64b8854840398fb46b6520ecc
SHA512 b95f5734ace99d1079d5682222b7af749a1d9a0fc936b527f1eb7167805ddbef7a65f439d2dcb4d43a0abaf345823ce914003e07de6e42a28452c012ea264355
SSDEEP 3072:2JsuNK30CKNdRxtshTTewk5KIrXfu+PnE4jZMdtliBaduWqlkm:2JfNDCKNdRPaTenY+fE440BFVlkm
TLSH
T1480412BDE9CD44E1E0E771B8041F87A532479079AAA2CB3BEC1E48B5CF271C84725E56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Main.ahk
- Size 8KB
- SHA256 a00f4894f6c699bd57644885ffc60a108236bd292d984116f3524d6f230b9013
- MD5 7ddd95943be10c77c1d423037a5a3c9a
- SHA1 e4a842f02ceab21c18fb0186f635b50884314d1c
- SHA512 8aa75d43c3a5570210b3ba3377877f0c058ccafff0ea2bf484f676bab11c53c20f1811b87d0cfbc4448742137c1b30c0cde481547ad6002f8781d2ed3c37d16e
- SSDEEP 192:KG54KlYKypzr/oMmEpd2jbnKH+sA6ozZY+:KbpfDoMmEpd2jbKHwt
- TLSH
  T1B402963BF25E03366072C26AAB1B608AE307D06B115B1914B98C75883F7435DC2FE9F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan upx
- Downloads MZ/PE file
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  library/Discord/DiscordBuilder.ahk
- Size 9KB
- SHA256 48c9567596a89449f832236011d5d18e69ab9b60861fedbf9bbe81cc2c6252cd
- MD5 55e7fc3a70e50ad07aad60b5f622fd0f
- SHA1 fe9d9d8a8958fdb66577903f72ca4f2a5c9aac08
- SHA512 025327561c34bc3e16b4a4684362c19398bac3fde7b3848541147f0b61b7cbd1b09a928e9f355f1556c15e4d1063f9383f648509e1e6148c08786d0254d98aff
- SSDEEP 192:FRmPifQlXVPM0lY+o1PjTsRHkztHl0i3Xun:FOiollPMtiHkztHlV3Xun
- TLSH
  T1691285265E85900285F3E3A5AD939002F73A712F6537C880BF4C45F89FBC7E16578EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  library/DiscordBuilderAHK-0.0.1.1/DiscordBuilder.ahk
- Size 9KB
- SHA256 0b5b5367c499809e67b06e92bfb8563ba0d57a7e9aa8ebd734695969848b0871
- MD5 2950b475005f5812548326798e08f1fc
- SHA1 0d8f52758943b6d4b8b64f22a2fef308f7c38592
- SHA512 3585007ab07cd7249c83f7b748f6c9ba4798506428079756220e0f6cfb6912acf1397772997b544e0e87f01679daef05e33f6c87a742614eb4387d28f8ef5882
- SSDEEP 192:gRmPifQlXVPM0lY+o1PjTsRHkztHl0i3Xun:gOiollPMtiHkztHlV3Xun
- TLSH
  T1802273225D859C0285B3E3A5AD9390C2F73A612F6537C480BE4C75F89FBC3A15078EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  library/JSON.ahk
- Size 7KB
- SHA256 213b68cdc1763330f1b1f1eea9af128d61f6b478f6aba67927e5f2c6e967e31d
- MD5 9a87184612ee8efe456940d8077c72ad
- SHA1 1d99142a6d3a57c46db9b410afdc1f6c324b4e74
- SHA512 4724ee52793bdf1137ce7455a4a2b64a84439e8cf8dc6bc1c3d65373f90bbadce42466b87819f38aeeac6ffe4222a20fa7de0e90d891abc6e43d8a9be90b9e82
- SSDEEP 96:puPULN6JsTyQMK25E0mrv+WQTQsSnikA+6yY3YHz1VWDcaDhaLZI:lLU2TyQMKjdrdvsSnK+hYK78haLZI
- TLSH
  T122F1C761FA0D4D9F455292D2A47444C4C66EF9B9D234A2CAF1A476FCB40C833C2FCB96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  settings/offsets.json
- Size 28KB
- SHA256 650e30ca3e2132ae9ea7dde4f469434123306b615585f13a00c314428fad270b
- MD5 e906bbff8fa61bead956250f25938bb2
- SHA1 1bb7fb58b6d463cc6708464964367abe69b0f6e2
- SHA512 06826edad4e73eb5ace74e4ff5ab5a5458ae5acc697c398bf9fb991d4506ccfd8166bb18a026e283b125ef7d73b7b451d16740f3be0029691169560d25fbafd9
- SSDEEP 192:bkxy+Ek5Q8/Thwws5ex6kUYfDi3TWFlZ5ZTGwJky7jypi4uZiwAMkOTj3:bW3/Zs5qUQDeTWJeam/uf
- TLSH
  T109D2991ACA615DA82DBF6295287D0B07E220536360157EAF35BC088C4F7BF3601CBA5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  shared/Appraise.ahk
- Size 14KB
- SHA256 5871e343ffd268b50d18014af57b14281a469f7baa9176bf0c46680b664a6696
- MD5 db5e07757aae22e8546e2536f79af307
- SHA1 10b206dda0d9bbb0788e3475072927a368192162
- SHA512 61e845c9ad225cfefad3909a0656794bf2319cc03460c00fbea5861e0c95414dc50f9070602015deb12968c5c98ee60c619bd15b5374ce4747f67b6a0b0a02b7
- SSDEEP 384:KbdldcsyGPEdIBgMJlWfBCRfC8YPz7P8nO8tHUjw:Ky8rFn4w
- TLSH
  T1B9525065BB463457583BAE7EDD77A205EE109453163B3D40B89C00D93F3672382E9EAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  shared/Constants.ahk
- Size 13KB
- SHA256 2b23025147707da1e78551d5b4fd502a7f6243a78fddf85dc6c0bbc8812303c4
- MD5 cc728d0eeb757937186234dbf4cba949
- SHA1 4b50acafd7e59e41ee939138642c6996192431b7
- SHA512 06f7a489a6022318cf75555b34fec8f3b2f855c8a80b71b0b0b093fe7182e9cb3243043aa9d84ad0debc56ee25796d37f051d8f7f7da3f933b9e5613e92babd7
- SSDEEP 192:KG54P+D2DE0Ljn4l+ypNn2gNmKK5kGMOdsgnC5+/QBpRrg3rv4oHz7zkSKgzJ4b0:Kb6C4OSvFGhdsg0fdmrvq0
- TLSH
  T1D852963BF6128D3B017693ADAC554285FB11820F1225642B78BC95DC2F3E77582EEB9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  shared/Fish.ahk
- Size 52KB
- SHA256 3ec63ede958112b2aa6c0dbc0ce18abc8f4fc5d8e178f320748d404c08182923
- MD5 337e41a87b274279c819f9e0c632704f
- SHA1 6eb06e2e7192fe894dd376412ac57a06ba54d5f9
- SHA512 12060f004090891e3dc0d443ec503b89787c5df7150cfaf01d0ab50b8282ab0d59858a4ac678e29ebbcfb683af13d80b6805cd51324a2fd43c3888914c08fafb
- SSDEEP 384:Kbolxc0OY08+kY0RnRRz7CxFg9h979V9uV2T2Bi3UtzrtfcMD/d3XXG98o8yicA6:KQY4Agrhzqeki3UtzrpbTZAx6ufY0x
- TLSH
  T1C53353266B57642A52777FAF9D739419FB694093112E3D18BCAC01C82FB136082F2FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  shared/Hotkeys.ahk
- Size 5KB
- SHA256 c797ad91e2c2c73dd6b7760cef4c9a0bac95f3611ba3b018cadccda549da8992
- MD5 b368b3d078cca6b382ff035a7060506f
- SHA1 1c56b24672d9fd4d79e464e2d41290fb3693b462
- SHA512 06a41f7ba5bb5f3291b564ca89c3ef77d62993d883b3c38c1f78d743dfbbf7e33cffec1deb513c4e9c909eaa9299a1961ae27148f682557f63b4c22a393eb207
- SSDEEP 96:KG5N+cBtaIBOkgCzzqMy6YqqmYeimCl9rQeimxNTR2pwlsUG6SwX7XwawdybgwN:KG54cdHSlqqL3hGwwKlsU3Lg7dybpN
- TLSH
  T1B3B12031914622376632FFAB99530549EF12686B167E35217C4C25CC2F35728C2F9EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  shared/Memory.ahk
- Size 22KB
- SHA256 a146129f5ac287b2b5726fe4d2ce115b936379c432154a3ad2de93f7d8e31bdd
- MD5 925f43a7ab9ab4f5c6cb82bbe242f677
- SHA1 29881f938e776699762a8a872a49e549d1953adc
- SHA512 96164658dd165deb0e6ee985a68667f78503778967afdacda4edadd8116fb297447385c71791faddff5ffd7db7970969d64501a8634e803aaac35f0ee430fb48
- SSDEEP 384:sbBQ8YccLOSii3FbrQXH+QjE4XlT2RbeVhYkHcG:43nLGk8G
- TLSH
  T1BAA2C731B64B5A22553353AE6D57D04AFF6E8057012E4528F4AC12CC3F7C26983FAEA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  shared/OffsetsRemote.ahk
- Size 4KB
- SHA256 9d4c715e11f6488617c459155dcc4eff8bcc2aac2ebde222f21d80463729eec7
- MD5 464b0640774377c43e5033146b4452bc
- SHA1 bc60e3fc826910ffc48e36651c6a78fa816a5eb0
- SHA512 b2a2ef2a9a02d6df4f3727fb49718d636aea3a1d87eedee0badd835ba8ba73022a2b07c5b4474d0034a2c2167dbbf6ceda92e9027e3b1e2492fbd1091886365f
- SSDEEP 96:KG5N+c7QeLjvEYLOYHCD1RzLkAViv8rQP+7cQJC/2SA0jio:KG544Lc9CCDf1iUrQP+wQUm0eo
- TLSH
  T1F0A18579BA4761330332E32FCA1285D8FF7BA42B16AD5124B94C06481F35749C567EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  shared/Process.ahk
- Size 3KB
- SHA256 bb0280461a2d4f921b8413d24c21d5f624e6808c5c7aedb3900cf1ec94857763
- MD5 c3f5084bb155231c1c2314f4311719ad
- SHA1 8ec9f11457a5b202bb2e2e198db4282d2b199df0
- SHA512 a97e29a8d82bcac92ae133db981f18550395994f391df588c01569208ca2098f2801c4571e1173a9487e6f1121314e144015ef5a2dfa6fa62d8b9fcf038b41de
- TLSH
  T1B361962E6507C51121F0F35AED103906D7CB694747BF592478CE6A9C2F78314C6A88F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  shared/Read.ahk
- Size 6KB
- SHA256 ec7f4f65ba6c005e2c17a46f096cbc5fbac4a2bf56f2e77355a01dbc47720ab3
- MD5 48a348c462856da2a7ca1eb8a5989960
- SHA1 7a242b41f271b922123b3c40910301e1837ca992
- SHA512 e4d5a706fb14f47a36cea0d8c962d4d48255afc46b6fc0e7ac5fce527e3f7d4b426097bb74c18e7daf4da8238e3fa93e3d41c77646467c6becdea9a8723dd79f
- SSDEEP 192:KG542EM9kxPMlJM9PxfMIX95ZivIev9UqzvpAyjpjiLmMaMMOAvY/M9Iynn7H:Kb2BkVPR5ovhljvpASvIwH
- TLSH
  T160D10C263A97556162B6E79D8C21EE0FF38E6403023F181470EC456C2FB93B1D5DAAED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  shared/Settings.ahk
- Size 6KB
- SHA256 f5c46a9452b899e5c3b5d535c3fd3ad28b33de666fad71f920122eac02dfc11a
- MD5 87785b33d56e22d8e9374e065e433d79
- SHA1 222cf7d716b0be59ba2baa060a0c1677deef48ad
- SHA512 34376ef950e36a98e7253fca880da3046614bc13f40a108644fe00670145125d4367ef93097eee641e0c415729f6775254614bfb786cc85e8ce6abf52cea9ea4
- SSDEEP 96:KG5N+cP0U6wtVD03c0s+N0doqjaxq/wQGtG/0x0mW0nAdGu2unelRKzme:KG54LXwtZxUZqjx4QGtGcOgnvlR61
- TLSH
  T17BD151662C86501391FB26AEFD53920EFF1117AB472A1404781CB6883F78F9483E9F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  shared/Telemetry.ahk
- Size 8KB
- SHA256 2398a594b9e89120b75d6862a4f2dadbdcc3c3d47074cee0b5fa5fff522b05e7
- MD5 d366761fa127b652c92ebf1933bc0f16
- SHA1 aac4764613b932507fe2f9260b3af9ee926c8d09
- SHA512 334a9041a5a7adb6f3d6490a1f51badd134bc98e162e7c37edd1a611f3c94cf93cf0904bb45e88e378e9ed7188d7a451d3de1157de45bba03f85eb0e43e3e390
- SSDEEP 192:k18jaQwC7J7bnFXG0N+34u1oC6iQsPKrg1YAIExvfG4250BbMi3N4FQ9:hj/vFXG/KeH
- TLSH
  T16602A5B659E142723282E67E59638644F372D867272F1E60F58E23A90FCC33850E96F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  shared/Totem.ahk
- Size 8KB
- SHA256 ac7c626a2ec363d24de68320875f8469daef342de28ad4bc9347b023cec74bd1
- MD5 3b3961194cfff445194ae5e08e5a7473
- SHA1 3c24c50477e61f86a9cd4aadcc9154de8729d755
- SHA512 d956a0bf6be34ef78c8dfa2fb89c8f92f840fd1c60364722aea38f5e7e1a465ff5aa693f40efbd7428681f9226e9e30e6b456a8a9304cfa514f36592467e3469
- SSDEEP 192:k18QrhMP5qKHpYX+vnQZ/+arNdgCPwgBw/FGK6qXDHt52fKI25R7j25xHpeH9TJm:hQmEKHw3nwWYFGgR5JK5eTJbL94pcY1
- TLSH
  T12A12D730BA8769657332EB6C5A92E249F7297417712E0054F46D30A43FFD31582FAAF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Checks installed software on the system

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32