1053a1d63688bbb59896719f72e7b32715c7afcfbeab3ed4956ae00f066420dd

Sharing

Copy URL Twitter E-mail

General

Target
BusinessInsight-Agent-Package.zip
Size 24.2MB
Sample260701-aj461scv4x
SHA256 1053a1d63688bbb59896719f72e7b32715c7afcfbeab3ed4956ae00f066420dd
MD5 ce4b5917e811a39b21b1da3e666af881
SHA1 194b2eec52154a9d0f4d7d86852a0e0fb0287571
SHA512 86e9a5065252ac05e5effac4cca37c74da72af6da5d5e00043e0d67a51fd6365cc80d4978251904febac956f2f11c3015b6a109c888e60b0e771321373cf7b21
SSDEEP 786432:FPNl33KhNcK9LquQG+4y2gS6+IXnP514HhovYa+:tNR6Dc6qe+b+InPf4HKvYh
TLSH
T1A64733498BB53343C2898FB167EB1641A23A7770F2948A095EE874884D974DD59CF33F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BusinessInsight-Agent-Package/Azure.Core.dll
- Size 427KB
- SHA256 224d09cb39eae4d8c30272a0c49beb19d873c87347eae9487f0ddd859d752b56
- MD5 f97d69848c1fc36ce431b8cd4c9e1dd0
- SHA1 4de0299ee65815c2462e10646c63a26864a5ed40
- SHA512 f187ace9cc2986ea52bc0794da2a1fe1918546948a6d865f69de704b085b13629368b50874ffd87f450ff6caf62217a94ec1489afd8dbfa08b2bcdbf2dd70d9d
- SSDEEP 6144:bFImTo5WDhHcnM5C9+ZMeAWz4GdOtzfiTXp:pImTaYHIM5CoM/WOtzfiTXp
- TLSH
  T18D947D2223B84B25DADF17F5F870A8D54772F406A55AE34F5908A9FD2C877828D20F63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  BusinessInsight-Agent-Package/Azure.Identity.dll
- Size 348KB
- SHA256 af18f20be25b2895c912f3ba0a9f2901a82dda823edcad76e6a19eac9886a40f
- MD5 e9e32512adfc7b59a93e906a8db6f3e6
- SHA1 529a19e1e536a4b17c1a7c281f2858a58cb4d8ae
- SHA512 8f68928f0cce510e03bd7ad6d0a41b79f7f658450a700bbcede05d9270faace47d1624957549cfa4de3f7bb2ecc97a3bee47278d71d16b0e561772bc1e0a24e7
- SSDEEP 6144:/40xIPH7WiQe4DGv3tMtS2FjPEqkRRalkcPG+HHm:/c7iTDGv3kxxPgIlpG
- TLSH
  T10974294023E88729F9FF6BB8F5B0559586B3B94AADBAE39D051C94DF1812B81CC50373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  BusinessInsight-Agent-Package/BusinessInsight.Agent.Setup.cmd
- Size 488B
- SHA256 ae205a06fbd73839eff9c7901b74cdb2cb3ec51d7900ead81bd1969efba34299
- MD5 18add3aacfa4f7ce5cb17a47ca35fe88
- SHA1 647cd05916d9d63f1add8bd9277fd195108e6487
- SHA512 22ff887e85a60c325664db7e8598e48927b6c00598a9a2a7aacb6e056722b12bde797288bdda990f4d2e0432cbd1c4996d0dae7da6801acd109f9af6256261a1
- TLSH
  T138F059446F17BC3393747E582A08A495F032C3D73329AAD83308844A4B7E09B99CC3E8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  BusinessInsight-Agent-Package/BusinessInsight.Agent.Setup.dll
- Size 41KB
- SHA256 ce330c34637d96216f21b468ce8f43567f70a2edf1f5d06a906581e98afb3ce7
- MD5 161372587bf31320744a943d77d62a31
- SHA1 4d4cd6ea8419e93f42ae7934ae0aa7ba5cdfc2bf
- SHA512 3623b64535d2ab59ed34c3b7bcc0ad4ef82d224fd5eaa6bb0bbd89e293cb6a579310ba21ba7bfebfd549f1ba60ed6b454d0ca0c9a0fc70c77a93969be235d12a
- SSDEEP 768:22rMEjBlPTwdIc9gsz2zLIUXqhMJNTJbxE:BM+jsyHIU6hMJtJbxE
- TLSH
  T1BC13190037FC8A17E63F2F39657491438A71BE2A6A21E75D1D4DA0EC19B2B40E931B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  BusinessInsight-Agent-Package/BusinessInsight.Agent.dll
- Size 78KB
- SHA256 550926327d0fe1934cc302ff6a3b8d32b86eae10d5eb03fabc8523b85a13d273
- MD5 489443349dcda27ba756571105328694
- SHA1 27b1622acf3ba6518a13b41f1d34430003a87568
- SHA512 ec66abc103e7dd62f7d0939d28cfe58178918afd00ec0f83debcd0c1afd7c05b34212a67569461c8a4d80f4818b168bb0ad7884741ed0be8a1fecd6f46afb513
- SSDEEP 1536:QbAcDn4ydUmb5fMaVbxA1Sh6DSDuTBmuJ36+Fk554byu7DkKDYG:ud4ydUmtfVVSrNNRO/4jDH
- TLSH
  T1E773F94063FC8F22EBBF2FBDA8B545550732FA225865EB4C18CC55DD18B27D049623AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  BusinessInsight-Agent-Package/BusinessInsight.Application.dll
- Size 45KB
- SHA256 d16c4fa399f4f6e6ee5b525f471ea520bf44be47044d17f918466ef8bdedb62e
- MD5 8bfb46257c5e7688acdf7907547b6c55
- SHA1 e6fc3731349cff376944fdbddcaf26d1d804e206
- SHA512 db5e381e4ce3963db685d25fc498dc96a329cd7f3d366a10207bdf1270d8f84d73662487ddb4020bb33b8db8fd9b194479e83c44a0a18b748f51099cf1fbf37e
- SSDEEP 768:P2VVvw4VP4Tqp4MtHSlnrNCZkkPTNLmq+x98BTujNcFtDlpIx0:P2VVhVYEyln5CZkkPTNLmq+x98BTujNQ
- TLSH
  T1FB236004B3FE0364F9B7B7B55FF58020453AFB69AA36D65D0850428E4871E42AE62F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  BusinessInsight-Agent-Package/BusinessInsight.Shared.dll
- Size 54KB
- SHA256 d3feff9076f38c082d901065feb6a390f5241953bc88fb44fdac440e137906fc
- MD5 2e97068cdc2ae793dc5c353f3e355c8b
- SHA1 7dd96d6ba671c2ea4e0b4d692ba13da9b0f05313
- SHA512 1777757782f50832bed223ad99751276f11534be1a8be356ba209114fe25637343c4a80f3c94f71fba433c9abcbc4fea879fb040dcd57b1a816befb53f64aa69
- SSDEEP 768:8EHOwVmRzAINrze8H4vGoHQL5u72U7d+w8B6q31Hrp/+/B:8EHXVq9Yeowu3zpq3lrp/+/B
- TLSH
  T1A5436625726CC3ADC75E0AF4F4204B361372A2AA3511EEF5C790FC8A3F7275662125B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  BusinessInsight-Agent-Package/Microsoft.Bcl.AsyncInterfaces.dll
- Size 18KB
- SHA256 136d5965cf4768e8420b547a8bddea882921f426c371833d558a858a2f0c235a
- MD5 b984be2a4fc05e9f83e7446b4455806d
- SHA1 3a9cd4a322a8f91e67552a87b079a4652805848a
- SHA512 d0200ffceb4f850db6a7b3e1d7aab6b996ae8f26971472eca3e80d0ab4c763ff13f628a48c1ce02bb9d695a90986f872b81932ee8b7aa45b5cdf67080bb55b71
- SSDEEP 384:JbZwqhkB49n5q1WeP/WuTb2HRN7IPsWAR9zgX2iKdTS:FkBT5/iIkL9zRiKE
- TLSH
  T1B0825A62D7AC8207DCB62FB0E975D5123D39BBD26C22E56E0589E1460C93B81DB3533E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  BusinessInsight-Agent-Package/Microsoft.Bcl.Cryptography.dll
- Size 16KB
- SHA256 009a27b8e3093fdd2960bba63e4acd48eab05c4f8f8a6d9fe8c24b4657f44c4f
- MD5 170ebbc0f639923b9c117918ee85fd8f
- SHA1 6f90c93d28bebc7ca9f12fa18fa32269f4038f99
- SHA512 6aa46b6ddd66fe7277b6beb5ae18374405b77f6db36c4c72fe69b07049cecaca1695a08c26767f30f2b1f5dec3f11a25b9260d4d3c773e314d5ab7ce5689e0b3
- SSDEEP 192:w4J7yhmNQOiyGs8WhSpW2ppWKNA/F5+MHnhWgN7aIWjm2WvpGX01k9z3ACQ1XaXy:wW98WhSpW2ppwnHRN7MmrpGR9z/QIC
- TLSH
  T1E2724CA5D7B88203EE7A5E7097B9D8433D3C63C26912892E1696F2451C637D9DB3032E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  BusinessInsight-Agent-Package/Microsoft.Data.SqlClient.dll
- Size 908KB
- SHA256 5a34e2fa3479b1508dbc20fbeb2c9172f18c3868bdb147a185213a446645b400
- MD5 d2219a8d6f1f65524c2cafea1fd6b94e
- SHA1 d8ee45b49f4fd53fc78a98de6079295b95838b2a
- SHA512 0744d745229a282a53fdf4216629f0c82ac73a7db1f3aa0a6b44a40c625b3530f70845b2f5bb44d6e5fdaa85e2c64151c1e534703b2d8b946da60105b263f5eb
- SSDEEP 24576:GwwljyiS+wrjSn68fVEbiBg7g5EJeGlYeRCEEuaVvp7gmn6GjiLQUg6BV0fHgwgW:Ay0nLf2iBg7g5EJeGlYeRCEEuaVvp7gY
- TLSH
  T13B152E1267F8266CF2F73B607A7911244E3A7DE67A39D25E3548404F0A72E509DB2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  BusinessInsight-Agent-Package/Microsoft.Data.Sqlite.dll
- Size 173KB
- SHA256 4ffa9156ebb9332bc53196cde2e62997447ad046629216be555e07d5d65f6c19
- MD5 803fb44bcf3e488c9fbaac4933d729bb
- SHA1 2f9d613cc53944e912ede7a1214d87554e30394f
- SHA512 569041a3b05cf1bd548ff2c767a48d4c30c9be9a3e11c4407714d1ae1928f817d1a15cdc08fed40c0fbbda78ee3ac4f9ad443be43744647507bc7f6caefb8afd
- SSDEEP 3072:5Po1U7KHI/FRmHsGP8vrzqWLvVtly65GBSilr7DSILSAQSIgdG8CmST:9omLmHsGPKGWhrZ543Iv8Ch
- TLSH
  T16B0449B4135C6543C7FFCE32B0B96C820734AA4BD5D2D74BAE40E5B93923745AE8129E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  BusinessInsight-Agent-Package/Microsoft.Extensions.Caching.Abstractions.dll
- Size 35KB
- SHA256 001baee94c7cac0cac5b4a49accce3a1e9d21053ea99abe42f871710d96640ad
- MD5 bee0fda5b6a5ab8695f993ed558496d5
- SHA1 7341c43c8be2ba933b3a00e64ec14a6bbe6563a2
- SHA512 93c038aede7dff93ff10dbd1046314cbe80f8061f8bff7773d28fe3bf49eb4678691b4b479919aeb00d8f38176860e6056c7cb3cafc81b5bb2b23bb9a1f0768d
- SSDEEP 768:sOcLs0yZ/0f8eMrnKIJGTQ9nM3k+DKGjQtaKio9zg:sOB0zf8eMrnKlTQ9nM3k+DKYQczgzg
- TLSH
  T10AF26C4443B88323DCEE2A79F9F2C5924A76EB463021EB2A1D5CD0DD0D5778D86B0B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  BusinessInsight-Agent-Package/Microsoft.Extensions.Caching.Memory.dll
- Size 47KB
- SHA256 b2205b4ce4ca238a3d36ab36cd312d59e5189c581c5f5af5775b9853150cb871
- MD5 a9aeb8731fac880833b5501efec48026
- SHA1 be62432ee67fba79d2b191107d78d37969a5cb69
- SHA512 a20759f1cd4220d7439e51b7dfa66cda164cfa76eb7a10ad70b7e63cec165e53f1904d2baddb0455422cea036a1d5ce17f069599071325b351dd8d3f861d3893
- SSDEEP 768:bP8LCJxCRf9ZuE+udsPpOMJYDsN4iKejoXmjQtaUMK9z1sq:b3zCdj+udWpvJt4iKhX4QcYzSq
- TLSH
  T1F0234B0057AC4323DEFF0A7599E4A5641BB9D7837802FF6A1D8DE19A0C537C18A2363B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  BusinessInsight-Agent-Package/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 64KB
- SHA256 190142694ee938f5ecd88edb959238968e68cf976a80a6e65ddd488af49f7442
- MD5 572f1e59e51f42fcce45849b49b9d895
- SHA1 1579c85859d0333e876b7ddfea2fd4bd13d36390
- SHA512 c35120a59c4ee3ab0577dcc00ea1ad01c3c283b6f8d25aa3ec803cb4f39af24362db665cebcc7a49d6d3d218a9b71cfc3eff0b335effa00ea85a2baf00c436f7
- SSDEEP 1536:UJb2eM8jJR5f7NlcQi6qim5OLCO8j5XAdkzf:UHlVHW4COs5lj
- TLSH
  T1D8535D5433F8B62ADBBF5B30517191209B38AF477412FB0E796AD0E8088AFCC59519F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  BusinessInsight-Agent-Package/Microsoft.Extensions.Logging.Abstractions.dll
- Size 65KB
- SHA256 f8422575f5591b25a70f4d32a606c0997fe3b0d0348a814ce6e51547b5446da6
- MD5 9232751df48509234134efc16f2fb202
- SHA1 8873571c1dcbfebbcaaa8cca81a560f75a063034
- SHA512 d2cb1900740aacbb7c3099524fa9344f3a8792c622a8cb572055aca5f735059a9c7b046c77bd349d3945d4899773bcc9484c7aa8f197b7bfc429ad2ce454a128
- SSDEEP 768:e5DSfPFlAQynOLmIWHjsMoc5Z9p+T0NFb3GBgx+uUdMDXJIPiYs3L9hspDCwY8Sw:esFlDdcX+PBAUOD6PJoQQclgzy5N
- TLSH
  T1B3637B10BFEC4333CBAE4DB9E4A46A126B35D2933207E34B7DC8E1592857BC45A60779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  BusinessInsight-Agent-Package/Microsoft.Extensions.Options.dll
- Size 64KB
- SHA256 cee3a3432a2e7e0328d49cba4bfa57d81ca05b0b14826cefbcf6b1984153e1ad
- MD5 e82f5bc32635561175c75dbffefc1255
- SHA1 e355976a48b93325a49b20672b78662abf2cb323
- SHA512 5e94b8a5b15d0a24e92174632dbbe15cbf2e730e9cd122c12ef25c3ee9f4d047d8e298224e835d076b6083e066bc11aeb41d9ce7fca6848dfefe106a815da3bf
- SSDEEP 1536:yPJGeDpvU0KQPTBzdXAdiW/1b/pOdgBfMXKgzv:XelvU0BM1b/EdkMhr
- TLSH
  T144535C1297AC9322DEEF4972F0B4E46E0F35D74B7447BB6B82DCF1A419A33804961639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32