48a4338d999ec5f33b5964c51893a04fc9e2d104b0c7786f50751f7db5dcbe52

Sharing

Copy URL Twitter E-mail

General

Target
Scylla_v0.9.8.rar
Size 985KB
Sample260702-a7c3faaw7v
SHA256 48a4338d999ec5f33b5964c51893a04fc9e2d104b0c7786f50751f7db5dcbe52
MD5 8295a33665f81192b399d3d5b701e1fe
SHA1 98daa48aa786ea087934774e800d9b6dec3ea541
SHA512 420136b1dabffeb0bf52cecf5c974d09cdfc96a84906f29844ae0478761c64b9a444ceac1b7a75cd2fa40268752593553abfd4d7850e6558517de63290486586
SSDEEP 24576:kOBgRoD1A00cMLmWuYHGqqS047IMei7F1cCMZqkkohZ:7bpYLx6A0nni7F1N4qkthZ
TLSH
T16C2533A8EF4AD64B525A329CF5EA06E07BFF22C603A6932F355E3610D09FC845DD5243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Scylla_v0.9.8.rar
- Size 985KB
- SHA256 48a4338d999ec5f33b5964c51893a04fc9e2d104b0c7786f50751f7db5dcbe52
- MD5 8295a33665f81192b399d3d5b701e1fe
- SHA1 98daa48aa786ea087934774e800d9b6dec3ea541
- SHA512 420136b1dabffeb0bf52cecf5c974d09cdfc96a84906f29844ae0478761c64b9a444ceac1b7a75cd2fa40268752593553abfd4d7850e6558517de63290486586
- SSDEEP 24576:kOBgRoD1A00cMLmWuYHGqqS047IMei7F1cCMZqkkohZ:7bpYLx6A0nni7F1N4qkthZ
- TLSH
  T16C2533A8EF4AD64B525A329CF5EA06E07BFF22C603A6932F355E3610D09FC845DD5243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll
- Size 34KB
- SHA256 6a51a7e5ce252e01643f6e6d96a4eb15ed162f615a569f1fad157dfced6ffe2b
- MD5 1e4c916c141ce64143cc03d68f340e62
- SHA1 aa3746e5c381b0b9f70fe88d208a7d50f88b060b
- SHA512 c394dcb87c851b7089a1dea56c97de74f7f9642474313aa410f2403b2db33bcded25a3797f5078beab0864489a6ed91b3947e6447f5935641ef5d0489c455ade
- SSDEEP 384:VgsHIA+xpYd8NHGgyvNfUztd9cWcSKfOphwtlwM+1nu6EDHpC676J01wNgvySXmq:V3IPryxUZdylghovmnTEDAJKvySeop
- TLSH
  T1B3F22A02B69180B7E26E2A3418B996625D7F7C417BF040CB3F9A16F95FB16C0E678317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  Plugins/ImpRec_Plugins/PECompact 2.7.x.dll
- Size 1KB
- SHA256 17b5256499d88166833bd2ee98b242d23337659f45bdb9205d15ecb6b784f797
- MD5 117f1a000d87fd4356ae72f198806eac
- SHA1 1a0ce06b77e5da718f9c3653abefee337d365336
- SHA512 74f4a10abfb02ba037ef3b545d3bff774c79a75f9c8ea6d50a6967b60f9901a0b3b6e9b36cdc2c7b20b54a7a3324548327652b4dcb83db348fda24514522113f
- TLSH
  T1CB31AC2BD7550973CA091F748A83831DA1B7607116C1A0044BC499686C6968BFD71F22
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Plugins/PECompact.dll
- Size 33KB
- SHA256 cb358ad5b464dce7b102417dd3e14389e11b591593a62e3e1b80fa1c4453ecc9
- MD5 0111537a291bb6bf633f33ee41236f5b
- SHA1 5b4a19344e62e608fed7dc31a961d67b9733f9c4
- SHA512 f151e764e5f84d9e35cf0896d9f62643d5afdce7c56fd24fe993178f1cbe12d905cdeaa59a570511e20ada69e87db1280c5e8e61d1ba4c2e45d4789e52ac3290
- SSDEEP 384:NI4s0r/dwgGaSPbfu6UXSgcL8dXQrkhU80lHrpeu+1nu6EDHvlvo1/NqvyjsCH:z7SzfHU1cLWIkhDsZmnTED9vlvyIC
- TLSH
  T1F6E21A0172A184B7E1AA1A3458B5A2715D7F7C0167F040CF3F9A16BE5FB06D0EA7C366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  Plugins/PESpin_x64_v1.dll
- Size 40KB
- SHA256 e183ebb99dfc7a8d6a8de614158634b00a6527fa5ad440722c6b5cf0a1a43473
- MD5 e851afbadc38a673a7e7cbc232c8bef5
- SHA1 1db930e3f51a4b3e7fb1ffc0ecd543241d44e94d
- SHA512 7ec97409f3197676d19ca2bf5a231d3d1967a11f266adfb243b1f9f6fda43938bbe6e138342cac9a6ac05ee6b5a4d6a72233c1d21a9d6e32f81aa87f324b216b
- SSDEEP 768:bEEAODltRD4njn7oNj7TF0KTClxCTn5f+7nzggXjkDLEHY73uigN:bEEdDltKoFTFH6CTB+7zXMDa
- TLSH
  T166132A5A22B400B9E5634339CCF38E55E673F84663B5438F869882AE1FB37D65538732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  Plugins/ScyllaToImprecTree.exe
- Size 11KB
- SHA256 883ed0acadc4850439b9f35722b74ff930e39a93f4032c1bfa2a4ac7c9f33812
- MD5 4c70ceb0b6603ae30432a09c42404f1b
- SHA1 ad4d7551e01ea67d11748eb82f9bd8984b36eb28
- SHA512 51528b2ac44763468e46a367f45ade55dbb960fe8be14814d79e787ce1167289d894837ba4d24025529687f98f20071054b213d83f14929410dffecea2edb5bb
- SSDEEP 192:zD2RoZ5Z4b2q0fycIMBB6YSUVrGFuOlMkgyJsO:x5Z4qnRIY7VrGFflMkgyJF
- TLSH
  T1A9321A2637E89A33D97A4B721CB3914443B2B7564AB5E71E2CCA41CE5CB37184393F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  ScyllaToImprecTree/Form1.resx
- Size 5KB
- SHA256 4d3ee9059f5b98ab1806f6916ebea2a8c56023f8c63ddfd80b7378d27d1aa0f6
- MD5 96ba0a444d087ae06f32319ca4f0a3e4
- SHA1 e3e08973b3d47c1ad51ccb133315b6242e275f0f
- SHA512 571d4083c76428d8c3914b2bc1281cc79ed4603b5fe0e3e82ee58dad488fcfe7f797a45b0ea7f14841a2a100656f059c186b7338ce33beb910cdddbf9ee70cbb
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFC3qxdRMvDbu8KsrbEKAy202lUt:Zf+tLPfYnLvFVOiFQaUD7Ut
- TLSH
  T172C11E45B2D1ED260E93483CD65139847BA8923F0234AC94B4DC961E5F92B85A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ScyllaToImprecTree/Properties/Resources.Designer.cs
- Size 2KB
- SHA256 81677e759573774859b115dc8ec383daa7242d73dd5dc4cd0f87bc57488b2eab
- MD5 4f086511f30b244cc110d4fa42cfb817
- SHA1 3276518e1f08cf1f92011448dc06fabb0c62c924
- SHA512 704e92b3038919ebdcf6148ec46d745ac0f7162dcbc1582d699b82aed875d3fa8f7f844c958e3f0393d494778446f0446e34d564b671d13a2737393b739039e7
- TLSH
  T1B45150F30FE9C5360815E59B4B01F851D7255223C22CE839F8AE42509FAE34143ED9BA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ScyllaToImprecTree/Properties/Resources.resx
- Size 5KB
- SHA256 4e124f5a7694ffe813c60601b1b73c53e47536b1f1c0e798d4d55bfc2ca3774f
- MD5 c07716633f086d91759ae32a18996a1a
- SHA1 bf3383c20acf6e64ce49f120938456161e5f6cb9
- SHA512 c6ad0ec603ff69d2d1b787db9426f29d44ea1ba45cf1d2b7ec41cc2bd6d5c93af8d2299139cc1c5d10d56718f36daa37d544f8d5411fad91a72efc2e70454cdf
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFE3qxdRMvDTursrbLAy202W:Zf+tLPfYnLvFVOiFQaUR6
- TLSH
  T1E3B12045F2D5DD220AD3483CD64139847BA8923B4234AC94B4DC961E5F93F86A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Scylla_x64.dll
- Size 507KB
- SHA256 183671a094a184f3bb22b893cbce8a77f4bbc3932d96a1113b7d93755ecca360
- MD5 7bd1b05fcef651cb71a401fb5954943d
- SHA1 d2c8a60e9bd14d85459519ef20ce3487e6270d82
- SHA512 aed6c7dffbcabe6062cabffeb904d017e7a15b3ca900279a902c8f09c7a0ef7e98795aaa05b4e38f38c694f407470f65327380f736f096595382b19f5ae6eb62
- SSDEEP 6144:dKsoPHO7OtFAlEYKvkmiV76xyGl4ImDkwGem/qzD/13tTykCnoIVRUt0dMkcwLSb:U3RtF41wmDkjSzWhnAmMkcwLv
- TLSH
  T1AAB47C59B7F808A9E077A13CCAA3C642F3B274550770D7CF5664967A2F23BE05A39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Scylla_x64.exe
- Size 500KB
- SHA256 47889e39785f0f50d6254ac29eceb2e5b39667eb74986e01d80b3042679f35d2
- MD5 9e6ecb3625b7ca4ffb2167958d9cdf72
- SHA1 8d8b8ae5d66101fe8b95182708506d90ea6cf471
- SHA512 716d2f9c3beec854f0e9598cd030d4ee0bc611cf19ea479d7f2468ad85440a4213f28745c4cf37ae85dcd5566ca9f14b9208efe2d3465ab4fe3e8c38bc716a98
- SSDEEP 6144:ojm7X2kYngdKc2jfiF6G1Nmbe40jVEUFlTHYkifA2O9d/ffdcEZUd4rQk:vAHdCmbeNjDYkzfV/Y
- TLSH
  T151B47C56F7E808E9E077A138CAA3C742E7B274540B70D7CF5668967A2F236E05D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Scylla_x86.dll
- Size 462KB
- SHA256 e21db48a70ed20fab35139e7919d9c1833d0728c33ec9d95802daf1571fcd12e
- MD5 738b9e4e29c12a8cc9c43e477c8940e4
- SHA1 fdfac85735242f90f5ebb0b5c4ae77d45499e916
- SHA512 b00456e830d4e18f3052b78bda7826f62cc231c34fb09e6490475d2720ec82d90d43641f0740ad87d4d26929bc8ec3b08748da8433c19aa1ed16bf5cc403604f
- SSDEEP 12288:dAgJHfZPW2qmAvztIAZDdpm2x/12lwjAHMB4F:dsztIAS2SlwjAHMB4
- TLSH
  T149A49D31B681C077E4EB013099BEDBBA657DB661172982C7F38809AF5E642D12F3474B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Scylla_x86.exe
- Size 457KB
- SHA256 4b49b0827f447d8d272c4f118c7c0afd2c786c12751e8e6e32e8477586afcc75
- MD5 3cf24b68ce13aac31a2808bab6a805ea
- SHA1 0bd75d62fb43cb5e3039fb5ae4c4e09a6841372c
- SHA512 85f169eefbc340dbe6b3b949c4ecde7df6db1cd408f546723901f2a4b6144da83c5b23e3c5eee63157ada09538f0b7520ca42cb5a41fecbb4147dcf5c20077df
- SSDEEP 12288:g0QsSmAKgxCk5IPYOVhJUInmB0kwKyI6t2CtOjpcoPa:g0CyjJUIw0kwK5hjpco
- TLSH
  T103A48D31B791C032E1E312708DBEDB79A57EB2611B2685C773C40EAE5EA42E16E35347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops file in System32 directory

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26