245cd9c4d2d9fff5af7a9e69342c64df99da4127648f230103c2ecde6fb656ef

Sharing

Copy URL Twitter E-mail

General

Target
CycloneX.zip
Size 46.3MB
Sample260702-1asdzab14m
SHA256 245cd9c4d2d9fff5af7a9e69342c64df99da4127648f230103c2ecde6fb656ef
MD5 a7ab7cb4a8a957f28e9bd780fdec6e20
SHA1 a41c7bc4f45592f534cbccbaea6f65c49a57de3b
SHA512 a89ed7e9c7777b795207bb6dec123ad88c683b1095462a4570e96c92b7c0fdad1813ed7a9b2037407cfbb8e5d6d68bae3f9c70972a3b747740eba3470d92a96b
SSDEEP 786432:K5V0j7escLKRwh74iAk5eoAouEcKsnWLYbD2hqa1s8ps7ky4/kkqZf0wR+PNzji4:DFcGRm4iLAoudKsnZD2snA8ky4skq5KL
TLSH
T163B73331D10D2421CD5397FE80EE459947ABF09B7ED614552F018B84E9AB8B8BBE0F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CycloneX/CycloneX.exe
- Size 10.5MB
- SHA256 99f831398aa05c7aa7f4ea882ae536620e94d271875ee7a3afc41023f77177b1
- MD5 d8fc6384c9e61dc72de13e4848f2ca0c
- SHA1 641d405e4f2169bbbacfeb60758eca2eb2281545
- SHA512 344a5cf71d06a33c5bcf15ca941c24af43ebf552e4e746e69a2eda3a5262f405b4c22b9bfd3a81d45b35f7f665664bcf6e2828cf9ef490b29d6f0bf456d6344f
- SSDEEP 196608:VsACdjENgpDXikmYYACdjENgpDXikmYLtACdjENgpDXikmYKFsPAaDWVOk/kIU7U:SndjEmWjLndjEmWjcndjEmWjneAaDRdd
- TLSH
  T149B62321B1A5C429C85D5BB0C835CAF423663D58EC34E64F7D9A7EDE3F7BB828104626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery trojan
- Downloads MZ/PE file
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  CycloneX/CycloneX.exe.WebView2/EBWebView/Domain Actions/3.0.0.16/domain_actions.dll
- Size 64KB
- SHA256 cd4e81ff9db4c6b086b70b09919b9426ca1f2c05ec43c477e9ce99156be66399
- MD5 4ef0ad12ffc81a3570d19817265b7197
- SHA1 a70a993ad81ee36d5f719f2f046d30b397fb5191
- SHA512 c270a4d32d8f10eda440ce521cce4f29544b384577548ac0e43b869d726d9cd6d1b283020ade3bd8153b0fc5f6a93bb630b7139b2c627ad0b0e3fe78bf01f212
- SSDEEP 1536:ci9SEjRPuonFOxAdgxBf8pa5oMNOKVGxJeyf2Fm9vcyaZzezj:ci9IcFPgrfrxOKI3dgmuyaAf
- TLSH
  T16753D1988F68501BE5BA1DB0D576DF0AAC79E6A3472060CB2391FA5C1D21BD07F3671C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  CycloneX/CycloneX.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  CycloneX/CycloneX.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.81/adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6 behavioral7
- Target
  domain_actions.dll
- Size 64KB
- SHA256 cd4e81ff9db4c6b086b70b09919b9426ca1f2c05ec43c477e9ce99156be66399
- MD5 4ef0ad12ffc81a3570d19817265b7197
- SHA1 a70a993ad81ee36d5f719f2f046d30b397fb5191
- SHA512 c270a4d32d8f10eda440ce521cce4f29544b384577548ac0e43b869d726d9cd6d1b283020ade3bd8153b0fc5f6a93bb630b7139b2c627ad0b0e3fe78bf01f212
- SSDEEP 1536:ci9SEjRPuonFOxAdgxBf8pa5oMNOKVGxJeyf2Fm9vcyaZzezj:ci9IcFPgrfrxOKI3dgmuyaAf
- TLSH
  T16753D1988F68501BE5BA1DB0D576DF0AAC79E6A3472060CB2391FA5C1D21BD07F3671C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  CycloneX/CycloneX_API.dll
- Size 9KB
- SHA256 9e7d5ebc52ef0c1f3410ed0b99f834b8d74a11a10fa9e8c543cc2666d1843c09
- MD5 78d5cf3705f06e40de9d5c42ca534d2a
- SHA1 23e95949c5570bb1e81659e481a591ce183e4f8f
- SHA512 6527a1c43f81420f5db49d8ace5f556b316ccfd2dfa090815c300da9a702f35ecc758545deff4c103ab2985c42bf236337574aaddff6eef7cc1d592fa222d7f5
- SSDEEP 96:ZuNzJNfapduTXUvfuAfpx9N3XYuxfVYAQhrREClmh5+QxDLB+9KZCJdMuUk0:kHQEyhpfN3oOf3QhrRECESzdMe
- TLSH
  T104127300B7FA4B25F8BF5B34BD7B16804BB5FE42A932C61E5948500E2D76A184D21FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  CycloneX/DiscordRPC.dll
- Size 90KB
- SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
- MD5 9f747cc51687d853f92f70a537ff6ca6
- SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
- SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
- SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
- TLSH
  T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  CycloneX/Guna.UI2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH
  T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  CycloneX/Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 4b50632e5ddfb83b185ebddeb5e1fb233a05aeeda9cfdec96bee269e11c5b49d
- MD5 cf1c8f8768ca48645bd043896f5ce21a
- SHA1 dd40da395c7dc79995df8ec1fc46da717e81d283
- SHA512 b7e2db6481afa9f8993c2dbbe611d7089647b3c52527fb917ed0701ec9dc951c9f720a5de4457107bacd0cf11328e706fd116e3ee55e83fdd2571805df41dca5
- SSDEEP 12288:0BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4xrpsR7rP322v:8Qcl4tO5
- TLSH
  T10DD4522223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  CycloneX/Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 6ac2725b90837eba6cb3aab84c57f8927aa43dabdcdb00d1701b29aa1bbca50d
- MD5 cee40e7ec2d5ca765a1288a5bde39afa
- SHA1 27038333df7b42de09a6e23df6d3582e414d82ca
- SHA512 e5d83b1139d3549dbd5661ac255718d10c106a0351291e50c0d82cac54b7d0bf0657e2fd22ea1ad2f839e18b8b3b8013d6fab3e9635f5517fa7be6821c54276e
- SSDEEP 768:dWQNb2vIYymJ22Mss+5xQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxO:dpb2vLbxQ+ZDgcEST3p4JjrjaeFSUyai
- TLSH
  T13F033B4083ECC917E6EB1F78A5B4916107BABEC37DA1D3A84D84F2DA0D73B9055143AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  CycloneX/Microsoft.Web.WebView2.Wpf.dll
- Size 80KB
- SHA256 f26f3cd7cc1a24d297d5d414f122c4e22d493c461c023838ad8671fa7899e967
- MD5 5f584d541f9e7e2e62d24a965ddb26da
- SHA1 7889c896bf5d83968af1ab3bedce029058c34bfb
- SHA512 0083f664a89f8e6c13905a2abc7e0d94ba551ad4a9040f3ac8744338b441e2e859e43d93a84605836ad93bbbb02bde60684918bfce21afdbf74e2e7b961838be
- SSDEEP 1536:OU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udM:Vs+vLqrThx6spa8+DHfFy30bpc4Jjr4a
- TLSH
  T1D2836C8193AC8923CAEF1FFD786050140FB8FA83B652D7991DC5B5EC0DA379119297A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  CycloneX/Newtonsoft.Json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  CycloneX/runtimes/win-x64/native/WebView2Loader.dll
- Size 157KB
- SHA256 86545b66cdb0603bc26b626fb9ad610cb6e71f28d468f5ea66df23b03dda96d5
- MD5 ff3ab627947e2c1c58f13694a8651c7f
- SHA1 280e4cb1c735b3ee7cfedc82a5bfe7c134a89d90
- SHA512 45a167e90716a08abf79f76fba42681cc8bc76f0087f62d028350c5d28e79b922dc1bc799b0dd0a086e7add20c17b9bd6a355674d7f1b0854f217432e4c7d555
- SSDEEP 3072:lKpb6T599mlMpgeMiqa5agdTl0RflJGhaTcZYEtJomT+JJg7yl:uGf9m9XkagdTlMvEtJKJg8
- TLSH
  T10BF35C57B3E510B7E07BC27485A34A42E772B81157609AEF0364467A1F23BD0EE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks whether UAC is enabled

Contacts third-party web service commonly abused for C2

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27