f4b4d5bc1b7dfbdbdcc51a4f5f42b6c88b63d458411e6a3e699403c54281898c

Sharing

Copy URL Twitter E-mail

General

Target
ja-netfilter.zip
Size 337KB
Sample260702-g3m56sa14p
SHA256 f4b4d5bc1b7dfbdbdcc51a4f5f42b6c88b63d458411e6a3e699403c54281898c
MD5 438c15308228dbb06c779e246b99396f
SHA1 dd1498949b9939f2a8f5b98482bd9a86b902a4c1
SHA512 06e7a75dc0ebd3579b34668aabdea82f83bd7f4894765c5b97b24f68d2524d956420d0454e700cbc8420b2660a706f0a4e3c83fcc5945d29f4609d0fe7297a78
SSDEEP 6144:QfX4nCvGmobfZmkCqtRnUA9oUrP7n2zvfJHM7z1YxlZQm2oSgw46QxMH1ca7/AHb:QfX4nCvxolltlUOxj2z35Mv1YxlZJgqP
TLSH
T1F4742327220EA195D71673F147E0FB18F9F5AC0DBA82C160AC6745914C602FB8E6BF36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ja-netfilter.jar
- Size 292KB
- SHA256 0100484b6410660eca2c202f4a5bfd907763bdb323e1c07662c12dbde5ba8936
- MD5 73d8ca72076d059a59912295062f76cd
- SHA1 488126a2eb9ddf87e2092a3cdf39cdc6762306cd
- SHA512 197ab2a47bc79f601abfe84c431b959581c64cbc1937e1d90c66a0f4a93b3de8136dd4459dc3e7ff0c433ce8b1dee253d99958e4289c702d794310d0ef37caf9
- SSDEEP 6144:oU/EuEFppHlZ2c6AVa4hugELDJMr/FNpdPAntyjAO9oWv91p:oU/EumFZ29kthEXJsdRP+ySm9D
- TLSH
  T10954F121F6D6D022E15B7138F562A863F43D0D7CD64EB5772CD886C3D4A094ABB027EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  plugins/dns.jar
- Size 4KB
- SHA256 d4aaab96c3682f772901ffd5587abf67b7693111aba3dd8594ecb479140f8b84
- MD5 d278f8f65c498c42c361db0c0e0f9b30
- SHA1 c6757d325d86fbf6f64fa76e84c5dfb9ef8381ba
- SHA512 af770237f70993859fc79e8266d07f361d7a9fd1c8f778c84ec6860b4a0742cc56679d7a9dfbb58c6645f48457f17edd7e67d64697426d38ed01badd997095fd
- SSDEEP 96:WoMBQJUSuw4W/Ar3d3lOqqORjYeDKXejuu9lS7o/xowSpTz7g8nJfTfqmRoz:WoMBdSuw3/Ajd3Mq/jYeDho7o/6fpTv0
- TLSH
  T1D7A108B26A9E0CCDFD1E5331F315C163605E4D71419D9917A5EC26862917A3F92134A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  plugins/env.jar
- Size 5KB
- SHA256 9dc98734005393ff9c888be809f8d2ddf4490152377844c76679b5b4a0e788ea
- MD5 fdc9cb4a4bc8696e030e76e1793370b1
- SHA1 c3e3b71d6c5cab0172f05c465aabedaf6594fb26
- SHA512 c45bdf7ff5cd6e31cbf7e320056a23a95b3bab6371d2aa98b83a2ca3028181dc3a39e5f2573ce691849144c1016d1b956184990917508b67d85e2dc7ee543197
- SSDEEP 96:GZmqPf3rRJyubt9kHMcekqH0Aldh76w9dWS3p58mPBsw:Gkq9JVzZcFqUAjh7f9dWS3ppBsw
- TLSH
  T18FB14B1764BC182CF529A2B2F30DE882B20907F0095990F3BD641D86EEBAC557F77729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  plugins/hideme.jar
- Size 7KB
- SHA256 f793c4d9f4ac7b5f43455c8ce84a814253a904e83350f95b0215d4d66aa032d4
- MD5 53cf39dd683197c724eb0d05d5b9eea5
- SHA1 e99ea3b8884a373c08a08eb51bccd88a8d29df0a
- SHA512 922a1bdd24bf4a38380293889ace4dc30c85bd84f0a1ebd7c768d50af7f3d1e18aa711507dc01454e0929713d3aa606c9fd38e79389654a37f51d74821607314
- SSDEEP 96:1dl3+o6jkCv3nHFJxPIm8UgSH44yYxF6QrNbsJ+Bi9GOnNPJB18OiPKwChUUE+:1d5+o6RvFrSSH4uCQRIii9nGOiEUb+
- TLSH
  T1B6E14C3221DC9A7DDC2D2A37F386F422B4950EBDA00975C37554A3015F6363D653A4EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  plugins/native.jar
- Size 4KB
- SHA256 14e4e588abf33678bae57f84c6a61af68ce97552f2aa6883a7fdd46dac956ff5
- MD5 36cbd6a01243517bb83c362a69012f85
- SHA1 14edc0d7e30238ec9f779c0ff12a64ada5f72a7a
- SHA512 fb773233e2eb5c4000e5a2afc2aea0efd6d10fba7cb282966de0c767ccb4aaa494ffbd75a2aa493d92c686a22a927bc7459be494b39fe995f1770684af62900a
- SSDEEP 96:t2IgNDcbRBD6aSaZSltaj2m2NbnxqKXc+NTiufrAxkp:ZgNAoaTSlt2dmbJc+FiuzAWp
- TLSH
  T1BDA14A71266E290CC4A8573DB3368180602D4EFCC2AD706F30E8952A7F7504A73B18EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  plugins/power.jar
- Size 8KB
- SHA256 09fa536905a32569d82e9622ee2a2df1e98cf26eb1e4262d9be5bccfa7693668
- MD5 89ca4fcb37345b545b51d6332e61e8dc
- SHA1 6519162355edecde54c4dfc21afdd523be0a7b5a
- SHA512 daaae1748aab587e7cc0bebb2cc7693aaec966473b606664af16ed82fc0bc0c11d811b019018930a3f210e9ba45259a5cc99709913226f9473bfa8395649ad7e
- SSDEEP 192:waS2u+Ri5aVyRT5VSaV47zEQUsLvA2EagR11rLpNTTbL8e:waVu+47pSz+rn1rLpNTQe
- TLSH
  T14B129F2725BC654FFA2A53B2F3C1D0567ED80DFC72C864176D18254F2826291F9B346D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  plugins/privacy.jar
- Size 31KB
- SHA256 acf04040854e5fd816d736875403d2a6215e2cef79dbe5eb8677cd588044151a
- MD5 7a614d2395207473a32ea45da2750c27
- SHA1 ae288483d474bb1578c332284a09e81d7b7ff722
- SHA512 deb627cee25a16b2672d0f9778f2a24f7e71ade731c705c14211d393c4199b5d78d1a2ea5a454f41c7a0484909ec597e4803a9dd60293017e7c660d6d2542ee0
- SSDEEP 768:Rm9pW2qkniXoUmDfVoEM37oy18ra6WNlC8XnwaXM6:RmTdjiYzbVoEM37jTvNQ8XwiH
- TLSH
  T155E2AEB67FDE74A9F817B03187C498073C39586DD00AA36B2EBE11195925C342F9297C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  plugins/url.jar
- Size 4KB
- SHA256 1d25c61bbc1ef330e4d7319846d2d72899e90ed5ad7c6387cd73e3b24f5bd179
- MD5 c4c56b98102b5f228f0ec8a4ec70dde0
- SHA1 f8518727b7d36e0e55825175d0a1e9a583153a63
- SHA512 c45d78bd35038e2a36e2aa2f64299aacc9139c309e5080739154b2fb5c0936a2f9dfb21cf11dea34699598ac7c2b2790424a632314f9bbb3bc3b33ef88e9026d
- SSDEEP 96:tP4+DT0nUeKLB3pWsWJQN4j4poII/0v40aspx:tPLTLRZWs9+ACsvaspx
- TLSH
  T117916B7261BF1D6FE537B532F280F40370D38678404A60DA39C821CB0A978703B32A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16