7b5121a41008653cda152a3bf5f0d0c44254fa3cd98af607dbc32f6e65341242

Sharing

Copy URL Twitter E-mail

General

Target
_7b5121a41008653cda152a3bf5f0d0c44254fa3cd98af607dbc32f6e65341242.zip
Size 6.7MB
Sample260629-xt8zaads8s
SHA256 7b5121a41008653cda152a3bf5f0d0c44254fa3cd98af607dbc32f6e65341242
MD5 cd91f12cf47767396194394964d2267c
SHA1 6a13e1fa76ca966980d477c1c741d3d6b41d3395
SHA512 9aeb90ada39178c887d4c8b23b8b6f688db0fe57b04d9992ffbb9c7f678a088372f94d405966c490a4a4dd174f22c39a46f2d31d203a88c6ab05f5736cc87479
SSDEEP 196608:lTnpm/SDlI16xwycQf+UxYaZyenxL0UE1prbZkARY:Vpm/SDWAiy5NHZyenxjE1lb2ARY
TLSH
T10366334A10206DFBC9FCF5F8A18829A24291EE0F76501411BD7BF47E38467C89B97B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AccessibleMarshal.dll
- Size 228KB
- SHA256 c220dd2c05cabee115f8c9b71ebd63f9b6317a858e0119196ed4dbe43dbc78c6
- MD5 08e4e97e0a5b71c53defaa9b05c9d255
- SHA1 339600c246dfb5ac83643563a8bcab9a95ca7511
- SHA512 ba6b17475ad7ffd8afbf7cfc248e2573736bc45c7ed2d22df22bbbddedd5d275b32a1f85775f3f28fafc3fec5d1ee5738419967ebc3f4d2ff9edf4b6a82b5f77
- SSDEEP 3072:oAIyIAjJQTRz0niJtsAICGzoRdThjqD2t6ldLO1xHxOqlbOehxQwNgnFPcRygJ:rIy2TRbIGThjqD2aNWQL0
- TLSH
  T15D347C4B76A158BCD106D039930B9A7BB772B88A4730FDBF12E496302F56E512F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  firefoxupdate.dll
- Size 229KB
- SHA256 f0f2f3d690255ff4fcd40253b49b6a3f1f327728bb8c98b8a040ecbef5118a5e
- MD5 24514b2f51d90a5cf9d3ea4e61d22257
- SHA1 72b79b806de97e50d00444c98e8579fb6f456322
- SHA512 a47f91663c2a92fee098620ea6eaa979d9af71cfb8ae729d6f80aafde105ab0624126fd5c35460f0ddae72e0c1b1fee4fc9fe95be0103596a07596e43415b902
- SSDEEP 3072:JxceGQYLn3ZnYUTqYtHZNOCGzoRXjAqSGtrn9NxHxOqlbOehj/g5Oswkpjej65C:J6eG1RlO4jAqSGN9R/IOGgg
- TLSH
  T143348E4B72A558BCE106D078935B957BB672B88A4630FDBF12F496302F1BE511F2CB09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  freebl3.dll
- Size 228KB
- SHA256 ad742cec2b2ae8480c40dc350bc9fedbb228fb425721d6804f1a1e85ad030232
- MD5 6e394c62f1f5a7d61fbf01e191d4f80f
- SHA1 258f1712e71c10c77984f409ee7a225f0d3b3f8f
- SHA512 a86525f586d1efa60be7cd44d473876b43964d60027a5ffb8189cdc01a696f56596b113eb8aa4305696119e157de79911a05c17b0ef387d0c508834d839645a1
- SSDEEP 3072:V9XfQgvdSpp23C/tTTggCGzoRS7kqu2gN/8/pq5xHxOqlbOehqDwR7GT4N3ED:nXfWpUgZ7kqu2pMsD4
- TLSH
  T101347E4B76A559BCD116C038A34BD67BB672B8864230FD7F17E0A6302E17E512F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  gkcodecs.dll
- Size 228KB
- SHA256 39ab2172c515bf149874c753159ea9ebb7efeaebf4913f911006d68b308561b3
- MD5 1199c51bee124daf50f8373e741dea7a
- SHA1 04e524d4fdc9a89c6adea638c8b702e864ae1e57
- SHA512 893b5343644a4175ad400a27d4328178f902535c78e39a79f07f356ea0f34c46dc96b0cc7c7cb0aa7593a375313caf8d0ad4d822576783bc09737792b22e1089
- SSDEEP 3072:awcUSQ1fmnd4UXkwtdwZQCGzoRm/p7q22387sfqwxHxOqlbOehiwwAlnF/MOlMl:0USPdGQl/p7q22Py/wBl
- TLSH
  T179347D4B72A559BCE106D038935BD67BBB72B8864230FDBF12E496302E17E511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  lgpllibs.dll
- Size 234KB
- SHA256 a5a4fa57fc012fba4530fe7fa9ae1b121907bb9839c3174a19adf8be3914fe41
- MD5 f1abac65a31f1a17f4d84e71ece57676
- SHA1 19594110e4fe82604b49a20da489006ad5c09a79
- SHA512 f553caa7c6041758ced3b9113b4ea521683cfb8cd721e946f7f4edbd1da158e790a7b293488e4adadc1e38177495a4f06d41805273e749c3f3a0abf83acd5d75
- SSDEEP 3072:IZ/R4HCLoCJaHLTLVeM6t/soCGzoRbOAq022TRbgBLxHxOqlbOehSMw0EY1jghO1:IZJ4H0a1ogOAq02sKGMD/
- TLSH
  T1E3347D4B72A559BCD106E038D35B957BBA76B88A4230FDBF12E096302F17E511F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libEGL.dll
- Size 1.4MB
- SHA256 c9d3758301521245bf344392697176f0b822ba0fd9514566475f0f0509c58a18
- MD5 c6413c9c8501ea0ed35cfe57bd17b2ce
- SHA1 3c6944ad73ffc34b5541ee8fe031dfe407cf4adb
- SHA512 727b197560a3b0b87fa71265ecd544abc6ba63857966c2ab605bb8523616e6c0558afef4f8e9ba7085722f985e670555a205a71c113b7e7f29eecde9829a4139
- SSDEEP 24576:HAQxLGcths0n2jFRqwVgsAqOzJdGmfrVIH06iy9FMo:HlxLGWnnEHqwmz7HpIU6is
- TLSH
  T133658E43E6A181B9C09EE078D3479A3BFA71B88ECD34767B1BE087112E25F90571DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  libGLESv2.dll
- Size 1.6MB
- SHA256 93c3a838f117784c8e762975234dfa4e2cc2d7139345a3eabc02871fa05b079a
- MD5 0bc075819cec04c18c460199936f4bc1
- SHA1 a446e1099bc7af84777a1a32762b6261d681670e
- SHA512 d840d1ec0020e0417e24a43ecbf0316cd1a9dd45a3d8a25015f5e6a4ac03b7941108c384fb2d2882cbc8fc3d56fd31c745636fa96cc92d19ee8970604eae2451
- SSDEEP 24576:owBxFQe2WaJOe5BE4bxsjCr3N64eNsULgXsSdGm0VIH06iy9FMji:HhQE45BRdsjCr3xULg8OMIU6is
- TLSH
  T1CD758E07E6A580B8C099E078D3579A3FFB727C8EC934B6AB1BD087212E55F50970DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  mozavcodec.dll
- Size 287KB
- SHA256 a54104335aef01962edcec9b30ab334b4e33143b7684b8b0fa4113958c0d04f9
- MD5 c2ad0983c73398b2c4d293b565dee6c3
- SHA1 85d21c2b47bb1dc7d1bf7a223f310f0c774f9637
- SHA512 16f845f72b245c9a462e58e41e37db6f4dc316428b2f03b2ae955318f5e59b248c00eb2061c9f8bde8cb5dda488f652ac4d1ad065c75817f300d0ea9d1a7eab4
- SSDEEP 3072:Y7yDF96npzgJoUwFDB8ddpvUdakHSGzoRZXzqhTRE+i/0xHxOqlbOehqdSGtmeOo:QyDF9GlDYsHeXzqhT6/jdSSO9mrmcFa
- TLSH
  T16F54AE47B6A150BCD146D078931F957BBA32B88A4631BDBF13E4AA303E26F516F1CB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  mozavutil.dll
- Size 231KB
- SHA256 fcc9f9eb6cf26445f561e4281107373c496afcc5f44667810c3a66efabb71d90
- MD5 77c988c9521a2d8dc6439d928f14d7ba
- SHA1 cac10e7c1127c0aaf2b04ce8d709f5f9cb07c1c4
- SHA512 4dfec5050d0d062d6f2aed3643e46d7d63994304958381a62ea654d5dcd2ad03d7e31607b912c6602317aa3811ac42a55b658496310b8eb95204eef179e4ff62
- SSDEEP 3072:SEeo7/CBTvJ8Lb0/EgxiSGzoRHNRqWFPMrcexHxOqlbOehMmApT226r:SEebGERxiANRqWFscLm
- TLSH
  T1B8347D4B72A559FCD146D038930B967BB672B88A0231FDBF12E49A302F57E511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  mozglue.dll
- Size 594KB
- SHA256 3437aaf76e6a2d86ceff6f8f97b0268d515405416b32ae6708aa67c29aca6200
- MD5 1c5ed027908aa20ef8e0e0ccdc7ac089
- SHA1 c32801e0b4753e84a57edcf34342ec852e52701b
- SHA512 862672b67613fe1604d02e537067a21b38fad652d48a82b9a3182558c03c80650a4dca50c915b44f1e2852d1121c76a08ae6f1040495a1f5b2b20b3b6a5091b9
- SSDEEP 12288:oXLFMojyxAROLgi1aj/tNPRcj7nl5T2ZH988hibJ:cljyxARapI7WnT2ZH9hhibJ
- TLSH
  T183D46C03B6A681BCD059D075834BA67BFB32B88A8232BE7F17D497343E58B546B1D704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  mozinference.dll
- Size 244KB
- SHA256 6967dc803a9ef476960b6d680813c5387bdac0ddcf74729b0a0751db30b5c3d8
- MD5 7b3f18f178472e9aff0e5fdaa32fca7f
- SHA1 b740eb07aa559d2b012cac5a024a518796882605
- SHA512 b663b3182544b1f332e1e25811bb30f5efc4a7825ec09a34d24940b984cfc2601ce64ac5ae416eb94a47936342de63046fe5c59890bab46e019e3bcf3c6ed607
- SSDEEP 3072:idrHBsSbTdHoPNa9O9Luo8SGzoRi7Fq9m2KGvzWxHxOqlbOehD+wEbsTyz6Whu:idrH9Noi86o8x7Fq9mSzE+kTc
- TLSH
  T15A348D4BB2A554BCE145D038931BE67BF772B88A4631BDBF12E096302F16E512F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  mozwer.dll
- Size 229KB
- SHA256 5387247541740e204972c9876b2ee75d4c53c8c22e3577b26ee285e32e5cf70b
- MD5 bc057617b3eed1f94f6782669c6018ec
- SHA1 0f5351abf2e87680a2dcaa3adbac5331bb6f8ec1
- SHA512 f68ef0d26ba1a88aa4b12bf83179656f273764efda593084ad234dec00eaed4ecce275b58d3b3d3565b50545d2b2389fd4f7a5e1af43773df379380930893f09
- SSDEEP 3072:GpQwPGaBkgS6FS7ltvKBCGzoR05pqj2t2ku75xHxOqlbOehB8w3GpMNycLgz2vf:gQwAgSiBz5pqj2XWP8DIz
- TLSH
  T1E3347D4B76A558BCD106D038D31BD5BBBA72B8864321FDBF12E496303E26E511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  notificationserver.dll
- Size 228KB
- SHA256 4caeeb57f799a061dbe7f961b907a100a26cd2cbd8800dedcc5b506baafb4aa9
- MD5 21a56bfa09a6865da3d54d2e3492c19a
- SHA1 2a77f8a6f935ec678bb3f265a27b548b99e68058
- SHA512 16a233ebba60345408aadfa3b401cea184d9b229c99344692285eccecc423dd6810d5482a5311766bbeb0df83fb4b6a8bb2b610c54d3c062d95ae8e6774a4732
- SSDEEP 6144:yfX79LHPB7zqyGnEINfVdPPPPPPPPPPPSPPPPPPSPPPPPPPPPPPPPP7PPPPPPPPN:u9zp7zqyGEINfrPPPPPPPPPPPSPPPPP/
- TLSH
  T152347C47769558BCE106C038931BD57BBA72B88A4630FDBF12E49B302E66F511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  nss3.dll
- Size 233KB
- SHA256 9849dcfb7ad7f2cdb7274b141b8a74ce34c8fd20e766a9adffc4a4d518a5098a
- MD5 1c8a8478d75f34add6508c844ea3e967
- SHA1 ae74fa65798ead1fd800e19048233a3757164a63
- SHA512 42f91c87cb9a6dfc5065c0d583c6dda0f601e902c4d0b99167338d9cea20f678428f9dec5b67f1cc4faf8e3af8bc9f9a29bd87334bbf83b70d1ea6f8aaf61c9f
- SSDEEP 3072:/pkRJUMNzytDhnvHdKT+tveHCGzoRgCTqP2h5wP63dxHxOqlbOeh0vw/K26bThNu:BkRnNuhfKHnCTqP2wWmvY
- TLSH
  T159349E4B72A559BCE106D038935BD57BB732B88A4230FDBF12E496342E1BE511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  plugin-container.exe
- Size 141KB
- SHA256 653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
- MD5 6935302137f3152317eb6a3b4a74f8c5
- SHA1 494e7a194ab5e7c6934c0154f6a2e48a001d199b
- SHA512 b2c987911aba4f77df7844a6612034fd8516ab7671527c918be013179a61c28082a9ecac69625c66e5a7611535dc180f3792302ce75760d4a3d2610dce1da138
- SSDEEP 3072:Xkxq4w6505dcKCB7xjLrWqQo6SY5bBL/zp2Z2x7tg:Xg9wzXCB7xjXWQ6SYhNLpy2lS
- TLSH
  T1FDE35A13FA5950FAD549C974DA824612DFB2B8860B30A7DF23944DA12FA5BE4BF3D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Deletes itself
behavioral31
- Target
  softokn3.dll
- Size 238KB
- SHA256 430ecc0cd5577f89b60aa5f0184de04828edb0f1196e6330150d4666d34835f3
- MD5 5f74430d87920065b5cc24c85474b64a
- SHA1 4709aa35d3294805c740b94b26629d561c1d85d7
- SHA512 3dcee0fb0af36e978c64ba82914fb278e84598e8144d15201913b692aa5ea3080f7997127b32bc2ad0e0aec682f6b3b136ea9bc4c686a3960cc22a0c117f31fe
- SSDEEP 3072:su3XUjrj42R0RXF7um/tYqIMCGzoRcitbqN2+6q78vxHxOqlbOehhVwf8vZTVBNR:XXUvRa0jM/itbqN2OYRVDF
- TLSH
  T1AD348D0772A558BCE506C038935B957BB772B88B4630FDBF16E49A302F16E512F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Deletes itself

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32