d693b49517a42efb85a1a364a310aed16a53d428d1b46c0d31ef3fba78fcb656

Sharing

Copy URL Twitter E-mail

General

Target
openldap-2.6.13.tgz
Size 6.2MB
Sample260702-pjbl2agv7k
SHA256 d693b49517a42efb85a1a364a310aed16a53d428d1b46c0d31ef3fba78fcb656
MD5 761be850c8ff85dbf5031af7c6c6da44
SHA1 e767400242ad966c2847e8a0ffbde23ac48ddb91
SHA512 a64b222bee2e8693e534f64eeb7afcd1f0c7a4b9ae2288ce2c53be9b532902fac3a1e3318c82545cf30c7f982a68b5167ee8baba1f4be5c1a72abdb7c75ac80b
SSDEEP 196608:UrUsAwAznxsGMwsaOdnePvkaU2KwWrnu4E1Cf0hp:UrdANnxwxYk1+bsC
TLSH
T19E663322DC7823146D840AEFADCE7DCBD94442A4E3BB8B125BE470F717C935078E9969
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  openldap-2.6.13/build/dir.mk
- Size 1KB
- SHA256 b9cfb24eb6d4841a9a0dcef69894e1d256584afe9b25bb5cc7516d4e9ec9fa0b
- MD5 7ccc1c076753476e5784bc995b57a73a
- SHA1 59d8cbbfb5c610c3d3f854fcf22aed5fb1979acd
- SHA512 5e3f498ab267a587c58218533728bcc481b328bc79e494d64e15982865eef2e35d13ae79e54a30a810fc8a281ed633c7773a4020941d3207fa1c293698ea39f6
- TLSH
  T11A31EE78FC66A7B481C8C5F8C5B5690BF34148BE44180CECB1DB6EB52952B4413FE9B6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  openldap-2.6.13/build/libtool.m4
- Size 298KB
- SHA256 94ebc155f41e96e5cb8762a2661e0d39426274e1b2b930bfb6d99c680a041c58
- MD5 fb0e3f654cb31cde80112f89cf47fd91
- SHA1 89105b0fc95d5ff30e8a1194467a61d671b699b5
- SHA512 2e249e22904134d77a6f7c619d3a3b8a90eac549f115ffff09c57cc3814df4a8812f6b53a82a142a749af58ad23ee37b75470d7c2a7c9918753a16f57ff603bd
- SSDEEP 6144:3wSQSlrBHFjOvwYAU/Fsgi/2WDg5+YaNk5xcHrYw+Zg+XrZsGEREYRGAFU25ttR/:ctM7E0L4q
- TLSH
  T15754082ABE8F582C36C1C81AAA5FA53DE771C16B54605964F5DDE30C7F0382921BF2E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  openldap-2.6.13/build/ltmain.sh
- Size 316KB
- SHA256 34ffaa53e9becccce1cee4f149a3b1cbba3c4cda06ab7dfaf1ae905ea4b2c0e3
- MD5 df0f18e33ba4242ff9dff54fece82d8c
- SHA1 6871957156b07ae46e5f75da9510a56c79b45c76
- SHA512 3f225c24aacff5b7708b7de3b6b31abb4623674f01732f795cded9e21a205dc29392f4f5cb023d9c09d2e8ff81615150d4b9d5e1ccd09dbab18857cf26335933
- SSDEEP 6144:EMiSRg49MWrCom5FzLQmoMuMBhmQptqyUjFjasypWpCZl+JRKT2MBFpfJYTt/Wfm:uB3j+hC+
- TLSH
  T18D64E715BFAC55707296D26E9ACBA45AD774823727244D10F8DCF1883B1382C72FE29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  openldap-2.6.13/build/man.mk
- Size 1KB
- SHA256 a7cd888c42aa5e9d5752ebbefe0345a146135d8da9be4b89616718ddc28afd69
- MD5 0379da46e0961ff430be3d6115e3dd01
- SHA1 5080d75f32736993df567cea536a38cd8e05702f
- SHA512 4959cae48b44fdd967e9d031ec8687643ad360dd5ab8a2b852d6dba80dd6dedb875b792abea0806bde67a22a0190d928c6f0c0a38fa287f2a1e27877b2f02b6d
- TLSH
  T12441447CFE5E4AB2A16CE487FF5D5202F2E5051F3A16094191D95D580323D8A212DD25
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  openldap-2.6.13/build/mkvers.bat
- Size 907B
- SHA256 724f539434700990f412a1afc3754b58eba2a88837caf865abe4a507bff21520
- MD5 60cc14a17ab7decc91f6de08675aef0f
- SHA1 1d345b9c9c09f8d3bd13a211b49fc1155ded5a18
- SHA512 7ffabe8602f719d7102859d9a79108264038201c2bcbd01c90441901acfc30f26e15a3cbea9def5226a80c469e0d904e8e6f3842af09a95e442c9a7d62f31b75
- TLSH
  T1C61104DC30B05B3305F102BFB41F026BF3F11899510455A022E210F851979F65BAAB64
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  openldap-2.6.13/build/openldap.m4
- Size 24KB
- SHA256 358b148e49e49294b0d2b52ae2a0a228bb359e2e0421505889c890c6865df994
- MD5 b78fd645c27a0d11c8f4c9da677d60bf
- SHA1 80c6ac50e98963c02146a0cbb8f2d8450d316a98
- SHA512 15c56509d43271360021ac271b5438a1598686bcc0e456222f13594389329306a4f15efa29060f848d2db786226bd47006d9da7b2ae1634e552ce1beb785ca8e
- SSDEEP 768:BgwhbUTJk9C4opH7WZxidgZR7BQ/jI0xB8rznTr/NmjsupN8sADS+ZHsV:BgwhbAJk9C4opH7cidy9BQ/jI0xB8rzA
- TLSH
  T105B2E6259C7FA4E3A195D267B40B7406C22EA99A172C1CF5D38BE3647C82B9DC03F8D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  openldap-2.6.13/build/shtool
- Size 49KB
- SHA256 f9e47d477ebd99606d5ed1d002b1d03a2bb78c53cd43c9915cbb7e7d2be86a37
- MD5 4063103bf9d4c13927f7a47c6cf8ef8a
- SHA1 688a6c7f26dfa86cf03d33c2c34ff7f6c543004b
- SHA512 cbaf6cd46b70af5a1b2ca970b5faa5433f7ec769e920bf9c3d40a0b4ea27445bcbcdd6160444cefbecb8b141e8c124557be4a2675c4b84b80bd8736aa405cf44
- SSDEEP 384:CPxsgISVxRKPmhJq/I69lpvEFSa8Q+vuywNgM6faUS6Um4tcbuxeoZt:CPq7AbwNLuSa8Q+vuywNX6faUR4vxv
- TLSH
  T15A33A7B2B49853B0112481FE2ACF7148265A01DB1EA9FC5CF99EF5902F4426AD1FC7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  openldap-2.6.13/build/version.sh
- Size 1KB
- SHA256 c21d2ad02d3a32fab4217667c9a9d7d321b41750c7f1ae1c0017c3d78c898218
- MD5 4aad13b0fe682f5f4655c1edad97be03
- SHA1 684c10c77f2e2945a8798f06ccb0aed27596ca3d
- SHA512 8ea693178a652d6535d267bf5db01735bc3fe64b48ed0933902dd08fb5668713830d1e6edd03aedb56f4047317f9b9c75d12b346874e0d99d7d88adfb6af78ba
- TLSH
  T14021DFA57CE9E37281D0164A4EC776C8F77E055B5DB00AE590D3807433136BB6B28B08
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  openldap-2.6.13/configure
- Size 763KB
- SHA256 a0787b2a1b33fc986b008e6be077714c1c829e2cb78294ecfe49b58d9b95a538
- MD5 68634ba1f689ac106379c4898dd438fe
- SHA1 e4c2e8e69e892f57eae4294979cf435614573f6f
- SHA512 d7c8336fc510222e696189ccc54b1ccc41dd3299ab627fbecff6d75a7cd280593435d60c68f5079856bd449bdedf0c960b92ba0cc764769cb5501977ffb4a46c
- SSDEEP 12288:KzlIfLYAIE4pTs36+WHUKhPLxYHL/2vUPgL7l45dv0vXVHJavsvhpsnp4kdxMc4a:uCIu6+WH1hPLxYHL/2vUPgL7l45dv0vI
- TLSH
  T16EF43B23E94F1D622620C9B0465B7810960F8DAB26712CB5F6DCF2BC2F1597590BF7E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  openldap-2.6.13/configure.ac
- Size 96KB
- SHA256 e462b0775e44854fd451cc669e24ea0ab0a858057ff44fd245357271ad9c1e4a
- MD5 25f34fdd490dac536ce0998efb316145
- SHA1 9c91435207326ec098c0955e6fe7739aef5ed29c
- SHA512 3541c0586682bf98cc890fc1b7d9a7088ddd8af6fcdc5a984b541ca870739d509ad3d473aeeab7315ea82592a3c1af634243014ac0c483f80b3b527308c6c375
- SSDEEP 3072:otFofZeTtiehwptL0PyaecQByu+tdk9CoJAGytViv2LvapsktIW8OgZDNfytz00H:otFofZeTtiehwptL0PyaecQByu+tdk9/
- TLSH
  T1D2A3D719FCAE3A86E160D15D2A365543E71E95BE2EED0CB4E2DEE2782C47F51413F840
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  openldap-2.6.13/contrib/ldapc++/Makefile.in
- Size 24KB
- SHA256 6544db3c0ea87ee38e4b40a181def7a585e84f57557db8061ab5a62da4a8187e
- MD5 650a55779c6e7a26c223fc443f28ca81
- SHA1 02cbf315b95ddcc6ac0067ee3a509101d88f8c0e
- SHA512 1145a5ceb3bfc61c1ca46f8e9d70670032ba03d1c5ab1c424ab63e5e488c358d398141789d71d84d5c2723b656f7e1f79a17aff652f5a92fde1ec4624504fe93
- SSDEEP 768:7VpDBTSKW8iiQGiUVO+GKp9WnqCAqP3HWp9aLHwZMaEjhO4j5w5He3XvoKSC:7VpD5SKW8iiQGigGIWndANp9aLHwZMaW
- TLSH
  T1E3B2B82FD48C55B2B880C1E92D7A4177AA924216424A7D227FCF6F54730E48B90BF7B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  openldap-2.6.13/contrib/ldapc++/aclocal.m4
- Size 364KB
- SHA256 59de34a198b5117a6011fe49bd2df1307b6faca8c55910ffb1715213c2e6ac6c
- MD5 ddc0ef1c797ae1a9550ffccd58a63631
- SHA1 e1c3820f23e2a12a8246360d95cbd4dc94cfd714
- SHA512 43e7f7e815ba26e0512af3a06789aeb4080ca385be634ce2e51e3ad946c57f31c40029216e553c28a9ee1468bef7d42d6d7b81f269aa8409c926440566b11751
- SSDEEP 6144:N1AwSQSqrgHFnOvwYAU9Fsgi/2WDg5+YaNk56cHrYw+Zg+XrZsGEREYRGAFU25tB:jutM7E0LQNJq
- TLSH
  T1C3843A2ABD8F193C35C1C86A965FA13DE771C26B546058A0F5DDE20C7F0792922BF2E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  openldap-2.6.13/contrib/ldapc++/configure
- Size 569KB
- SHA256 5a36de9511bd57cd4d63e65e0b70d6c813fdbdb1948cc2be1d0e2401ef0b3b32
- MD5 fbc7566c31a7da9253742d80be47946e
- SHA1 2db5c795d90e90ce5630d6b0a6878b2228ec8e1a
- SHA512 edfe36f953b5af6aaa94919ab7ae87ea8326440b0b919511afa599d4700f07be951500ff23fc36b5a4cd69f75f9901bfaaca157ba852e7b51fc87f1d90727790
- SSDEEP 6144:xx9sXthkMmK4C43Rp0E8xPTxoToVLn38Hd9G2wT9erh+B8Q+pDK9TvKDNpYrXYBL:lxTwk9DQIvhSqjiIVGip
- TLSH
  T118C43A7AB90F483A364085B0569FB415A781C66729315CA4FACDA33C3F1667660BF3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  openldap-2.6.13/contrib/ldapc++/examples/Makefile.in
- Size 19KB
- SHA256 c65c2f34301d054eab5355d507d6f3e4e2ea5eefbac9c1775d077aadbc4615a2
- MD5 ce666d6e0e9a1102797b225427b2ae6f
- SHA1 821ce62c3c76a82f83dc649ba4e020e45d74a90f
- SHA512 a052dae8418ac45bfbc5b332aac687fbaaf25285c28e946b1bde598b86fb8826e32d59e44ee6f7f9be753ee12bff69c5bb9b30d92215196878d5801f03970716
- SSDEEP 384:wqkpDu6TSKW8Qa9b+7HmYsFMaiop9WnqCAQMqCxaWOw3LLgDs7MaEljg2wg2HKSo:7kpDBTSKW8lb+7HmY4Maiop9WnqCAfxe
- TLSH
  T1FF92B43EE01D1976B884C5EA2A9941A7A963021606056E333FCEDE4D730F60B617F67B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  openldap-2.6.13/contrib/ldapc++/examples/main.cpp
- Size 4KB
- SHA256 91df5553ad84e8b4c20b64e26ec0bd2c5dee8e822c4e659a3ba8f6f98fd7c45e
- MD5 b553aed5f354e5a9d1807df37b95792a
- SHA1 5922469224c5eb7a9faadd829bb0fdbb09be768f
- SHA512 94f05aaefe2cfa9d742e4cb766ebb2cd395c4c79a281048de0ad9149360181f857a8b5e0f57662c89e4eb3ff2e8913fbbd5171f48428c2d053dc0eb04e3efc21
- SSDEEP 96:m5+8rgEjIjRW0j88LzCCytm74X2mHi8N58IY8kJy1nws:m23zZzCCytIcX55kJy1nws
- TLSH
  T17FA1E032DC371A3265A3D637A3675281F8164813CB33C623344ED7A1AF19956266F37B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32