5d04f88646c2baa1e1b0bf7eb8553e56fa4c7b673d82585d21b1aa4a5dff7ac2

Sharing

Copy URL Twitter E-mail

General

Target
Ivan-1.2.zip
Size 159KB
Sample260701-wp8bhsbw9r
SHA256 5d04f88646c2baa1e1b0bf7eb8553e56fa4c7b673d82585d21b1aa4a5dff7ac2
MD5 24b14de53e028a170ef525a54f6bc9a5
SHA1 b7829df19edd53b9eadf66a26a4dabfca0ce7ee7
SHA512 b18dff42b5e6740c1d7458f099ed4ee1ab80276bcaf468f19fc365940ca4bd07553c199904fd84cc1c5dd23be4a858e0cc0ed1795d71715a7d0b3576a83bdb15
SSDEEP 3072:GYGrVxL2ROXvlyMSqg7wOCTbZM6hBx7Jkm8Djv1WUu/lH1mDE6gGeOSS41IZvPZN:GYGrVxL2OX9yM7g7wNpMGtJkm8Djv1Ws
TLSH
T13FF39E15C69DB936C4375B78C6A211678FD30BC9F931775BB2926021782B84E0ECA3ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Ivan-1.2.zip
- Size 159KB
- SHA256 5d04f88646c2baa1e1b0bf7eb8553e56fa4c7b673d82585d21b1aa4a5dff7ac2
- MD5 24b14de53e028a170ef525a54f6bc9a5
- SHA1 b7829df19edd53b9eadf66a26a4dabfca0ce7ee7
- SHA512 b18dff42b5e6740c1d7458f099ed4ee1ab80276bcaf468f19fc365940ca4bd07553c199904fd84cc1c5dd23be4a858e0cc0ed1795d71715a7d0b3576a83bdb15
- SSDEEP 3072:GYGrVxL2ROXvlyMSqg7wOCTbZM6hBx7Jkm8Djv1WUu/lH1mDE6gGeOSS41IZvPZN:GYGrVxL2OX9yM7g7wNpMGtJkm8Djv1Ws
- TLSH
  T13FF39E15C69DB936C4375B78C6A211678FD30BC9F931775BB2926021782B84E0ECA3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  manifest.json
- Size 9KB
- SHA256 21b51de85ba54f78eb198a6073ab5f6a556483bac818fbffd788e6c2dd3dc614
- MD5 9d3713118b646beefcb63a38138285c0
- SHA1 938a22db245cf6b82581dced52f7332084ce238c
- SHA512 c9e92a3bab36ed148400775a482b2e2745d1725f9f8d7c881c1d52f6d04d1e904ae88750a8378acd4e36a7c164780d0ae4b4e821c4ccec3c3eb456c11f374619
- SSDEEP 96:BSVMXt6eXEP8GlVB5MIUDqfHl0G9sXq3+RHMbEuqti2+lmAl3ajX1qbyb+g3UMrq:nQY4Pqxr489W
- TLSH
  T16D22A34DCCBA4CBA337150BD18AF5512ACAA803B4C443CA6B91CA07D1F5C71DA6BB7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  modlist.html
- Size 10KB
- SHA256 a3b2f3b8b14dfa7e76a829e4039b309992976037596ece0a91d2151bd6bd2b4e
- MD5 401a1e4215d993ec18d1d4f3d7709675
- SHA1 504b65755107f9a8542059c2489ac01d4a4aa4d7
- SHA512 e2a05c9083d1cf8eaa2ff5d4c0c3d5436b37cca9cc6fd1c6cfb71f6c78205b3ec86e658d62eae3ecef5f7b920b8127ea31503052d0f0f3343e4397fe53de4d30
- SSDEEP 192:GJCP0+1gFfL7qXV3FIVx/ljCsd4XI4k5/PTWjEvv4Auz9QOZSBL4mqAsGkiPSX8/:ELmwSYGywG7
- TLSH
  T1F82212B79DAFB9167B6ED1BEA4307A1DC52391F34A0D4EE7B0A20C477BC01D208155AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  overrides/config/Butchery.toml
- Size 4KB
- SHA256 c5343e555957f67e78aa18d0b5ab803d9927c09807bc0ef9f04eab94e18de30e
- MD5 29c5ba144e2973362c6e43ea4d210acd
- SHA1 93b8a82de8e96bb3a14f50d3fee4ba14039a7c1d
- SHA512 8ccc81153a66ed15fcba2540b67c10b0a26cf881870fcdf7e9b903f10aed3be85070431c5f3aec8619e8f644ca0d084bbc49393cd0a857589e32c641e909f503
- SSDEEP 48:1DGPoCspzTPDqAgw0DliXo4kB3FN7FtBEIQSiIr9I0qkrqHc55og9GrZGAakRkmm:1DGPzTZ/nqYF5c2kjLPWfhr6cbfsa
- TLSH
  T12AA1C254E6C8F175C9B1F06270B87C929EB84F95218B603CD4267E2CA028E48679DDFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  overrides/config/CustomNpcs.cfg
- Size 1KB
- SHA256 146026ad781e7d4da07bded4539b307947f7fac1f35615b4f54c0ec0d31f431c
- MD5 7bd2e84bba067aaec6d3318d85912a2e
- SHA1 b84c9766ccf6887f7e1028ab2aad300fc54a8c54
- SHA512 1c10094703067079f351115ccc36f4c53ca85a954628b3cd114524a55ade9a80c5a573d0c0a01122c24e7fadeb6c06965c88b34f671842fd56e7e1be50cd7e79
- TLSH
  T14331A84A382F743910258037ABAAEC71E201697E350121F770B534EC748DFAA21FBE5D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  overrides/config/DistantHorizons.toml
- Size 32KB
- SHA256 71c4ca5179a63037accd720ee71bfdf63393d6453ce3b030476ada88bdc2e5ab
- MD5 693d9baaf0b59a2ccbbf99cd7e0a9eff
- SHA1 01d08b2cb7d542e653894145456e251e86b9d720
- SHA512 4f58745fd7e8fc0e0d3843189b0dd7528721dcfba1a0241512805a8fc5bdb4aa95425ff9e39446069cae0fad418864f632b42723440dc377f51a7fe13257e6fa
- SSDEEP 768:3X4U2zqcQLBKDgccwtD3D7A95DHxMwDTcDJ7ZoylPUWrCDuv:3X4BiKvcADeCwDTyeyAuv
- TLSH
  T1DCE27122B78C323A68D29093FE78959E423DC079033B62F9B19E855D721C5A1477EBF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  overrides/config/MouseTweaks.cfg
- Size 135B
- SHA256 4069ce1a439d8c37453c1b1e9f2037e0942674c7e48723a39b37eab245792ad4
- MD5 ff577ca09e989c07c056c7cdff465be3
- SHA1 651b3e4db2d430dc1da3566b2984b264061a6794
- SHA512 5a86dc45e2999e337cb36f69ca9d388495ea496058b7346d24369c272bec91af055d3fbc37a26a86d0af03a1a29605c4c846612eb58280bafdb648716220927c
- TLSH
  T181C0920BEC073BEA06F58A2CCDDE968292B90A38C110E52604293A058FD10FF65A358E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  overrides/config/alexsmobs-common.toml
- Size 38KB
- SHA256 d0a4f5d703e0e9756314bc97e7be72e8066702bd5294bd7e599a253def5f9023
- MD5 d2680b013c66fc2cb62fdb5f105059d1
- SHA1 917b1aa96ddda6858a681ac79544e370cddc7de0
- SHA512 20e66bf3dce9529f41c1b46e4196024ab2e0dcb6d435527c8d5fda51d2fd9b9b2ec37eaae918bec5fbc1a15176df36d4601c789aa80089beafec1b78b7ac9b8b
- SSDEEP 384:JTzZYbYHcuwshMgaElKywByzPHRgtyuyi3iNPnTCh/Y:JvKbY8uB+EbwByzPHRgtyuyiyNfTCh/Y
- TLSH
  T185038F94FB53718E30AE4783C03FB061DBAC555BC142E37DE1A47C69220B82995FDEA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  overrides/config/alexsmobs/alligator_snapping_turtle_spawns.json
- Size 750B
- SHA256 b2c962e1ec2f65014b97c16621dc6cb8820caac55e993f2db5f826fa87e7dbe0
- MD5 1612fd932d46bc7e1d2f512f24b8b50e
- SHA1 dfd0c683e29fa92bccbf7c39805e1213c268300d
- SHA512 65ef972efb56a9cae14507f169e52910733b9c8a69eafb4aa839b9e831cbd7639a013adf28fbcc0e438caf05fe49c82a15558f1846bba6649a4e309697a71ec8
- TLSH
  T15D01A42AD4688CF7121A2474995F8002656400478C4C3E7976BC44ECBFCDD1C38BFACE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  overrides/config/alexsmobs/anaconda_spawns.json
- Size 1KB
- SHA256 8e15d68e53a141d14643fba55f3cc63448dee4c94550d825d0da59b51f995ea0
- MD5 2571cf5bec58f00cd529ba5b2c6548b3
- SHA1 717d907d7c554fc01c6a3304e90336fd5904e51e
- SHA512 cfb24c1a53e5579567e719b1ee424eafe391bb510319385142a99bdee2432807b3a245a6eab331554006306e19be4a49730a9984b635c5a4fc761875e1642ba8
- TLSH
  T1AF115226D4598CE7025A24749D9E8402627400574D5D3E6976AC44ACBFCED1C39BEACE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  overrides/config/alexsmobs/anteater_spawns.json
- Size 1KB
- SHA256 f65e31155b2f2e033bed66dc5ec2ce7f6962be3389369ff800b69dfdecb5d990
- MD5 2040bb544aff0345a335fd895cd0022c
- SHA1 983d5b8a09faf49e73d82af7e3fb0d6d8a28ec4d
- SHA512 e72729ceb7162dd77cf12632c4c08f0da4d10b6a6372528c46bf51d5c9bc96a4df78443adb11dbb19aa8050d2cce6ff9b43dff7cdfd58977be9d5c0e1ba54f47
- TLSH
  T1D7213026D469CCE6025B24349E9F8002627540174D5D3E7976BC84ACAFCED1D29BAACE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  overrides/config/alexsmobs/bald_eagle_spawns.json
- Size 2KB
- SHA256 f0f1a3d700fac98d9e477b1f110ca56523d1850c0640918a1e5d9f9da15bf211
- MD5 a325e17ed04405409ac3f537124dbf40
- SHA1 24a04efbc87e0488fd296c2d7c8802cf8ef8291a
- SHA512 c0b173f0770c44960ed030d207fc9db49d7454efc18617add9f1e54362db695e2c92b25b08d7f0275f2a21c94b6ea28f535e532e7125434abf3f42286cbef22d
- TLSH
  T1CE514026D469CCE6035A2534DE9F8002626840074D1D3E75B6BC40ACBFCED2D69BBACE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  overrides/config/alexsmobs/banana_slug_spawns.json
- Size 1KB
- SHA256 ef4ea5b1a4900421e985933a4dcc81ac0cfd1e40249d87475524fea60642e477
- MD5 5e219001a913e4b3791205e90b4e88f2
- SHA1 9a666c04b268d50ca141e280895be10b4f05c594
- SHA512 b16ffe76f7e03b770eba23b0c6058476565e5105f515fec43e7668d864f92f8fdbd1810a112bec44744a46f1a38fefd401e35e94183f093ce6922985b2144833
- TLSH
  T1B331412AD469CCE7129A25349D5E8002626940074D5D3F7576BC40ACBFDDE1C68BFECE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  overrides/config/alexsmobs/bison_spawns.json
- Size 1KB
- SHA256 b95a9b0b1b80ebbf3d7ea6027aa6265e07c1914c068dd18f8bebb0786b1a237c
- MD5 08b1706d504d9fb5b33acf63378d77a9
- SHA1 7e4772d2aeaa0b83f807f66c72f008d4284febd8
- SHA512 d64d737c63628030feaf166104bcc41b90df7c1c5f83d85389684eb86e28ce3c706867faed35d4166559678ffc6360b9b9c1498ff32bda2077a1e4ff16ee7658
- TLSH
  T15A317126D46CCCE3125A25309E9E8402616900078C5D3E79B6AC44ECBFCDF1D68BBACE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  overrides/config/alexsmobs/blobfish_spawns.json
- Size 146B
- SHA256 7e7b175c33aed22c3d2cd31e215c6243e3790b07a3664b42d130a8f3b897489f
- MD5 ad3201c8f95a758dbe8496d677756a5e
- SHA1 f39ce83ec705fea5b1e181947ea3d690961a3556
- SHA512 3a3e122983a69234505f948eb5dc369cf98c389d41c48d6d85ed08f7a5686092927c498b8e98e0e00b2f73cfa96c33d9ebcfa2c4302320e9c6db629ba87ce0d1
- TLSH
  T149C02B18D81C48E7104920388C0C4101B124004380082E12375C006CEFCC8081C595C8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  overrides/config/alexsmobs/blue_jay_spawns.json
- Size 3KB
- SHA256 7d1f784ab378e1e851e73dbb6f81866420c1328d25f754546d82c417bf304644
- MD5 9b797aa57e7c173d5e4a8f034f267dff
- SHA1 4a704c533746078e7338f88c29f181166a092606
- SHA512 16db3a84228b8a63ea403cdeeaf8dc7a15d03eda34428f1c8990a4c53b9ca41ffe03206979beda3fa6c02c32f9fc510c8db7988d3bad2781b79a7b0037a69e14
- TLSH
  T1CD813F2AD46DCCE6035A25349D9F8412626840074C5D3E79B6BC40ACBFCED1D69BBECE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32