a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24

Sharing

Copy URL Twitter E-mail

General

Target
8.zip
Size 2.2MB
Sample260701-x2kawsds2m
SHA256 a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24
MD5 6d1f649d90313b7e3624c0e86563b5dd
SHA1 2ab93a242511c38ff7661eb84107ca2ce380d135
SHA512 7313603db16057f68eb3d7db53d7611c9681c57c906fa3e234f1fc6507344aedfab85b755f373f211a34c961914c25ac9d078a75d0619f3245d96db0d184229d
SSDEEP 49152:7lzO5MCEcRPOmqeWozDQvPFq1IYRJRyYkUCJrWVnrxjSYdl:wNEcRPDPq8IYrRyY/CJsnr9SYdl
TLSH
T100A533BAAD8240E6FA6CA566A28480DDDE76A716F0DC3DD0E40D3E42439180FD7D1F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  8.zip
- Size 2.2MB
- SHA256 a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24
- MD5 6d1f649d90313b7e3624c0e86563b5dd
- SHA1 2ab93a242511c38ff7661eb84107ca2ce380d135
- SHA512 7313603db16057f68eb3d7db53d7611c9681c57c906fa3e234f1fc6507344aedfab85b755f373f211a34c961914c25ac9d078a75d0619f3245d96db0d184229d
- SSDEEP 49152:7lzO5MCEcRPOmqeWozDQvPFq1IYRJRyYkUCJrWVnrxjSYdl:wNEcRPDPq8IYrRyY/CJsnr9SYdl
- TLSH
  T100A533BAAD8240E6FA6CA566A28480DDDE76A716F0DC3DD0E40D3E42439180FD7D1F63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Dump/dump1.exe
- Size 268KB
- SHA256 db8c0fc8427546ed54664fba24bdc7aa335eedb34b21c0d9a030dbc4f2bd7aef
- MD5 4ef5f0a660c9ae3e32eb109e1e7bfa30
- SHA1 b02b7fde30930161726fdd7e872da43b271f2c3b
- SHA512 6a49b7d2c46e072f329f75b0ab74e011aee16cd35ba9a83734294fcbb3ad73539a8545f27695d58aa9d9150114c8f344a3b193b2e6005edb3085eba0906e9a81
- SSDEEP 6144:uj7pn+5J7GRQtr3XMxJR2O5jRQtr3Xxw+:uj47mor3XMxJL5dor3X5
- TLSH
  T1AD448C06A18181F9E6A35078DA795F17D2BEB521132287CF23925ED51FB3AD2FA3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Original/999bc5e16312db6abff5f6c9e54c546f.bin
- Size 573KB
- SHA256 dc276b0113694ecc62913311e2580857754aa890173dfaa9d95afad6396bb741
- MD5 999bc5e16312db6abff5f6c9e54c546f
- SHA1 c19761497efcdf156f50c014e7520fdae40822e7
- SHA512 37d8403df63db243ec631267abb167da67acc257a45c775a8e646467e9c121820ce420bc15b920afdd386f2c5edcabe8d310ecd3074405c31ee37f348ec4c78d
- SSDEEP 12288:wZ2BkVm1YvrIm9/nefmiM+Si2BiYRdAugT:GVm2rvJgmX+n2oYRdvA
- TLSH
  T128C4E6F509372C0CDD8B1436F6B7F989BED1A898096DCD944932F1EB2F51025A4E2EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Original/Document-772976_829712.scr
- Size 241KB
- SHA256 523b9e8057ef0905e2c7d51b742d4be9374cf2eee5a810f05d987604847c549d
- MD5 c2d73485095efdbd7ab625e469affb11
- SHA1 a0a7b943b46979cc593474b94f14f2451b8ac3c0
- SHA512 ceafd283a2ce95ae5288871fe1732f97b600a4e08981b044fda925e15cfed120a37015c633de4daabfccdd3716dc9e0f4865468f647d8bd627339815d5bcf131
- SSDEEP 6144:/GpBEWJvXcs5eyOfevIUdy/ZV6u2nf0+8aq:/GkEEJy3IUdy/ZVrifqaq
- TLSH
  T14934266BE7BC3AE6D41945FD088D20E2213FE6A52BF0ECDA590463C730D46694CE6E1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral7 behavioral8
- Target
  Original/b44634d90a9ff2ed8a9d0304c11bf612.bin
- Size 480KB
- SHA256 27d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
- MD5 b44634d90a9ff2ed8a9d0304c11bf612
- SHA1 8f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
- SHA512 7e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
- SSDEEP 6144:iWWPaCGkGGCBJKeNm1VbeuJCeU2HM7R+mzZUxrKkhhcghPrQANJRjiP6EQ6a9k7v:ReGkGJN8VyUxrvoZgJRjJ6a9TgS
- TLSH
  T1F0A4D068C1E61E12E70ACBBE51FA4A51563C6E72D9FB44F0940EF23C36F55B02291F86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral10 behavioral9
- Target
  Original/chqpl.file
- Size 255KB
- SHA256 0e2706d24d9aaf93a2c9181a892367bb6094cf658c97b237d336f0651f35ff5b
- MD5 c6315a09e06e2ba775e5be0979d23755
- SHA1 68abb2c430eebcad865157b4ef3e25f23ec5daca
- SHA512 6895a0dd192ce95a4a9c2ce51cc7e0cfcdcc5a024e6e83e39528f10b835b7eb329deebc72b258c25968291f4c06f27e1a7d06007ee785f684ba920d097e7cb5a
- SSDEEP 6144:E9kZ+d0Wm7M5MyYzWteHu4HCRdfKgvaY:E9OnWm7S26eAf5iY
- TLSH
  T1434439EFEB3C29EDD989263E4CF01AC9045B58DA9280DEFEDAC4550EB0E9749CDC1464
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Original/dd207384b31d118745ebc83203a4b04a.bin
- Size 538KB
- SHA256 a4bc61a4b1b5cbfa25ae56d0fcf94424893a60abcb68aad2c0321f99e5d7b520
- MD5 dd207384b31d118745ebc83203a4b04a
- SHA1 72dbfa32bc3a099833f3d2190371e3478d3324fc
- SHA512 60e6a0467d42171cfb07c33349789f3e679f498df483c7901ad04c3171c0bc324dc86c6b897928cf622873e20ac4e17a87ea88ecac8b555812b16d91f1fe954a
- SSDEEP 12288:uEQTUs9+7tGwu0BubanwRfiHX3XVQtCJJaHPJGLhT:Tq+ebanwR6HXVQtg4HPA
- TLSH
  T18AC4D5F19937150ECC6D4131FA939FC83C9AD8C84A4DA4288630E59B5F9A2B5C6F3ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral13 behavioral14
- Target
  Original/fax_390392029_072514.exe
- Size 276KB
- SHA256 10745182ac1b738e4a363166f650069d16b81873b3bbb1990e7d07cb652495e8
- MD5 4ba43f0b82f86efed437c8523f7a4dee
- SHA1 356b21b749c8bc5e2295a3db62ea03c47cb4c1cf
- SHA512 b0d36313226069688e1710be561f6bb75e232ee35212d41b50e12800ef54c48fbe29b1e97d8d08add642714887a10d598a06cfd2b8a609556242689496ad82a0
- SSDEEP 6144:NYIPjoJyR6dNNdUvw9IbxQi2qJ+4DhYxrtaDi:NY/eP9j2LvxaDi
- TLSH
  T19054C413E3BC44FEEAE7857F5A085DDBB217E0F16B95E6C2C8D9929888D358D5ED0080
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25
- Size 313KB
- SHA256 9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25
- MD5 2f08d1f1b1968be7f9669e2ff94dea76
- SHA1 168befbd8691891fc9a983da90a80bff0aa79cb1
- SHA512 3dc06215caeff44944f577a5040a7f5ea89c16988021dd34dd914c110cd82052b4e4e8a1190568ed1bda89887bc4b132ac965818406b652c91a30acfc3b0ec5a
- SSDEEP 6144:ixxjPBn35E+ZXJtWc/yx1kk5NiIm4ALtvhwhz1m9r8:iTrZpEePWQyx5fiIm4otZm
- TLSH
  T141642266D7903E36CDA99C312BF7720452E3A9647AD43E1CFD109CE47CFAA5480ED24A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9
- Size 123KB
- SHA256 f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9
- MD5 cb10fb803dc1f81b4bd324a5859b3ed5
- SHA1 9e778c1253ea59de4ea76f97d858b0a8d23a2fd2
- SHA512 05865e3554c1f8c90673baf0681de88058c7202439bbecacaaab4ce97bdc60bc77cb1e89d54b3c4ed049c0140c4bb2784433e5dc500debc47a7605b98312506f
- SSDEEP 1536:r8BG7Nckd6tnE0VVQrZzsIQSaB9a0OyJzL0OzfiPO4pPbEFvwfPISaOW9bmCDmf:rzikjEVQlQtBfOUPaP1zkqASxW9yCK
- TLSH
  T19BC3C052F59242F2EFA3453039197B229AFDED122035D60BDB9B09461EA0692F77E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral19 behavioral20
- Target
  Unpacked/Dyre_Unpacked.file
- Size 1.0MB
- SHA256 05edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
- MD5 4d1d43789e038c6a03c07083ca0b0809
- SHA1 8c4d87363a4a2352847923091b9ddfa6891f2807
- SHA512 32de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710
- SSDEEP 6144:rj7W89i5WWwR7A7XJfZ4FFhDhMWwR7A7XJVgNgG7:rjntWqA7X5Z+NMWqA7XOgG
- TLSH
  T1A8357D06A19141F6E6A69078DA795E27D2BEB520132293CF37925ED91FB36D2F33C301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

Enumerates connected drives

Deletes itself

Executes dropped EXE

Adds Run key to start application

Deletes itself

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

Adds Run key to start application

Enumerates connected drives

Deletes itself

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

Adds Run key to start application

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

Adds Run key to start application

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22