51ab27ce9533d8c69d8e0a887c6dc284c7c1f9a47f44fa09102ab938eddbac76

Sharing

Copy URL Twitter E-mail

General

Target
Tone2 - Electra3 v3.2.1.rar
Size 261.9MB
Sample260702-mhgesaf12x
SHA256 51ab27ce9533d8c69d8e0a887c6dc284c7c1f9a47f44fa09102ab938eddbac76
MD5 3736c3b91cef1b800011bf3cd3d9dd7f
SHA1 5e3756f4b2f7c3f1203e8a64b30d76e8d791070d
SHA512 c00a69189065d6f8f54c7085fe161199972d9ebd6af79c49013a2fc65b7c4b56f619945aed76bf69f222bf632dcc0ae918a0b73be913e23c8f1499cc077cbde6
SSDEEP 6291456:VBWrGCJKU/ZfKzLKnvYbEKNo9laY+m3MBN0sC9we:JCIU/Zf0LKwnyfaY+mKN0J
TLSH
T109D833567B63EEE2E627BE3240398B796113012B18015690435FEF30724BDB6B937BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Tone2 - Electra3 v3.2.1.rar
- Size 261.9MB
- SHA256 51ab27ce9533d8c69d8e0a887c6dc284c7c1f9a47f44fa09102ab938eddbac76
- MD5 3736c3b91cef1b800011bf3cd3d9dd7f
- SHA1 5e3756f4b2f7c3f1203e8a64b30d76e8d791070d
- SHA512 c00a69189065d6f8f54c7085fe161199972d9ebd6af79c49013a2fc65b7c4b56f619945aed76bf69f222bf632dcc0ae918a0b73be913e23c8f1499cc077cbde6
- SSDEEP 6291456:VBWrGCJKU/ZfKzLKnvYbEKNo9laY+m3MBN0sC9we:JCIU/Zf0LKwnyfaY+mKN0J
- TLSH
  T109D833567B63EEE2E627BE3240398B796113012B18015690435FEF30724BDB6B937BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  R2R/R2R.nfo
- Size 6KB
- SHA256 1e6dd26d7851500c53295f5616c5c664cc02956ff8cdcb585798f725e6f2732e
- MD5 c2d3ff80990a0f2b4a36b1fc8ecb963d
- SHA1 843fdf557e5dcc0c41298b0b05af9c667801811b
- SHA512 6966ea079bc3d33e1edca246fe8f5d31870f2f29be765dde2fbb1ff298c5ab7c05303fbd8d0548160c7f7c7ceb155f5626465b320bdd09de173bc42c943c3c43
- SSDEEP 96:rHMH6DNLnJsAKwzfkTdoUilCWMU0rVFEdj:r59nJsAidojY8yO
- TLSH
  T152C183208121ABA0B51382B71D1822C0F29AD64E3C3929D871DFDABAFF67D34516835D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  R2R/R2R.txt
- Size 570B
- SHA256 bccd2006752a1365c26befe869ef90d8c580497754c78e91e8cc5d1b87e49e41
- MD5 e411a01e13fc04f0b612f83a1d745487
- SHA1 21e699950dba38df643c61feb38b3f0b81af6e98
- SHA512 c67e0ad797a31eda86d52ed789dca07b2d56d587f28e1620ca1a626e50046106eb0106e7a6d5061b1e4ee45bc493af998fcd8a4d9ae50f4345d08ee593cb4fc1
- TLSH
  T156F0E1BB4692D27306CA421DADA9E23EE35BC03196F882213E8DB005772749647DE3C6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  R2R/Tone2_KeyGen.exe
- Size 541KB
- SHA256 b0ebec322ce578522d3187e902c962968e9af4805f0d3eefae549f99a9c7d391
- MD5 23b8db6e59d1b5742d662c2e9aadf960
- SHA1 c23959e602c0c5091a869d58f0e559e57482e233
- SHA512 a9ef60ed4393b410b665454371918aeb5f66d82a9444a301668e03c9d093ae29876d89e0818473c2e157ec6d61f8183c7b72f57f853e5de1896735ad15fc746e
- SSDEEP 12288:XYkc9t2Sll/T/ohkU3xg63nsGDxIVhxdKxoSZvj:XYkcL5T/50nSxor
- TLSH
  T104C41201F65484A7DCA257B049FF9A2125BAEE29843A1F4BB398B72C3933357500F797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral7 behavioral8
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/R2RGLD2KG.dll
- Size 5KB
- SHA256 fa1b6a3dfb396a6f2925f2f8d5d89885c5cbb7e9108d04158262d9af25dcd71b
- MD5 501ae6ccc10518430bd0d6e1ccea179f
- SHA1 ed72512d15bdf16b0fce37235843cf6eae576743
- SHA512 735e972b9aa6e28f669192eaf8c4281ee76453fd17accd9be48c145e4bdb63231adfc6a8c489c7dd4e1e925d034177e986a6a25630987ad95714e74d6c2776e7
- SSDEEP 48:iVhqxMNE2CPj4GDuXnVbwFTENgFOmrDX0Y0tIypFWPvyXsfn8UnkphVhwPcrX1CT:W/e2Cr4jbSG+0Ht1pFWXf8eAla
- TLSH
  T124C1C6ABB2424492DB1935F11D4BEF8E893E5125EF6546F32B00259F2AF49E1F42D30C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $TEMP/bgm.xm
- Size 388KB
- SHA256 98c69e7f59231970dcb7858791ab5e229bb310ac7e196ddfc3203b46f2d043b6
- MD5 2dc3ec3f50214a13388932155baf3724
- SHA1 deb34a6de5c98f4d954a9eb3857694401a5e06a3
- SHA512 b3e9114e005506381d8ce58dadb4f59e9cde2999b170ec021c195d3594a2d8bc535fce6ae7463d70f72f1208ac302a89dcd30436fced727dc14e949831aa546d
- SSDEEP 6144:byrB6Iajv3kXQk4JFcoE/KdbsNknsH1qT467/3h1pj:buDG3kyx+KdbsNCj
- TLSH
  T15A84A823FA059582D8597E314C3D8BA84310BD5CAFB1571B2A9DBE2DEEFA3D31D11290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $TEMP/keygen.exe
- Size 492KB
- SHA256 a2204caa5d2f178a68ab0a803af9df1145c19ee66dccc72282e048482dbff7fa
- MD5 15f2d430bc32b3e4d95f2d915f9f7d83
- SHA1 f60f5a8f968f1b36d689aabeaff62d43f205d614
- SHA512 42dfebe4ea7016e862681db2f4231846dabe5c891eaa604ef1e32606c6014a9b7f14b5adb816b6283c85e0a26d3ec06be74c9110a27e5ff8b6f1a9826c57dfc4
- SSDEEP 6144:pcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOoEFz3pf47oZHGFnRQNCg5Z3E1TUA:pc/kEPDonR6Y436vRLFnCktEdUQd
- TLSH
  T1ADB4A282D26248FEF6F9C33A40DE2338C476BF6CC71484AF82E62D5557B23D505AA2D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Setup Electra v3.2.1.exe
- Size 261.3MB
- SHA256 617e52e3ac95ec1be257f9bc800617b92d83ae776d3318ba64ac13d7ea17c006
- MD5 6f5b25fbafd2899495ce081ce4b1725e
- SHA1 655065f761e7083119ed87de6e8ecdca6c01367d
- SHA512 b5c956530d46766478beed846c99328a09feede85e7cc5ae99c261736e4c1e55a11617290e3197d942441bff83007d3ea680f7eeb8e1a3b28bac9d84716cd1b1
- SSDEEP 6291456:6BWrGCJKU/ZfKzLKnvYbEKNo9laY+m3MBN0sC9wm:eCIU/Zf0LKwnyfaY+mKN03
- TLSH
  T1D9D8339A7B63EEF2E627BE3280388B795513013B18015650435BDF30724BDB6B937AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18