2c5f01d6c83016c03d2786f8cf095a3c713103e1670898df9a8eb7ff72358dee

Sharing

Copy URL Twitter E-mail

General

Target
DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
Size 219.0MB
Sample260702-rte4bac16p
SHA256 2c5f01d6c83016c03d2786f8cf095a3c713103e1670898df9a8eb7ff72358dee
MD5 45e8be270fd4a78dfba985ab4cafbc4a
SHA1 9fcb0b6cc02165baf47b09782d62389c7724887b
SHA512 facadf963d8e3382fd7b195e2cb78e5644ac6ea2c13a928c38466f8ddefe863c69a304278d694f01e46fc879cd9fbcfc07657f89eec8c7e39db343ee58fea1c7
SSDEEP 6291456:u2SYvUXz2CFB5L0VyKOwDDh0vAy8zpP1mpW651c:u6sz2CFPLxnwDmAyUGWQ1c
TLSH
T1FFB833CA280F1283C3B1DD7826657225E1875F77A9C4FC48A3A176DE1CB29225C46BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
- Size 219.0MB
- SHA256 2c5f01d6c83016c03d2786f8cf095a3c713103e1670898df9a8eb7ff72358dee
- MD5 45e8be270fd4a78dfba985ab4cafbc4a
- SHA1 9fcb0b6cc02165baf47b09782d62389c7724887b
- SHA512 facadf963d8e3382fd7b195e2cb78e5644ac6ea2c13a928c38466f8ddefe863c69a304278d694f01e46fc879cd9fbcfc07657f89eec8c7e39db343ee58fea1c7
- SSDEEP 6291456:u2SYvUXz2CFB5L0VyKOwDDh0vAy8zpP1mpW651c:u6sz2CFPLxnwDmAyUGWQ1c
- TLSH
  T1FFB833CA280F1283C3B1DD7826657225E1875F77A9C4FC48A3A176DE1CB29225C46BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/killer.dll
- Size 6KB
- SHA256 967d66f23cf3d9d3e5a4d6a9c6e366e792a98cc8a293196095b10cd82da9a695
- MD5 16205cd992d3b3827573f93ab8923e4e
- SHA1 4eece7a206ee619264d686ca1b3021b9f482866b
- SHA512 257b2047b8e9303457bb050a760b8d2577da55642e4fb02933e6188d0591ff8adfe0c8df2a441577466f23a8e3bff2e94e9cfcfc381c4d255935123996c06d6d
- SSDEEP 48:CRNdQ/SbTfx6gA6IMzLvM0Aoy3TYzyixX9o1TNRgPEgt/b82ebRuqSd7:mNGajxG+PWTwlSbpx
- TLSH
  T1F4C1E8F397D540B1E299033E29CB98266A70975803B510DFA9D709265F44DEBEC36B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/ui.dll
- Size 172KB
- SHA256 168deb5f2b887ec09b0612600a49b2b70d7605365501b3471291af67f6fa1e3d
- MD5 74f560d28c33a66f4a67031aec7418ef
- SHA1 aeef3daf8f7fff335be0b1c4b17ccb28b3ccc9e0
- SHA512 382d19e747ebe3d8e158b8d2f247d7595b2b188e656494122a6e15aa0056c465879167096584bbac8215fe096b758f29577ccca86a7b518420ab8d2b66ab4494
- SSDEEP 3072:LIso+mtONBWnFAB4BBESxSjWbtU0nwRWYtBaQu6C3RHxP38qJT4cOC:LICmt6BWnFAB4BBESxMSUvRWYBad3l6G
- TLSH
  T1DE048D107680C13FD59F197988FBAFAA276C6A7113A490C7B7640E69CF306D25F7A306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/utils.dll
- Size 178KB
- SHA256 837dfd14ee80dd4b09b81431f0ff96dc9dd492b729525485ab74b05da43c4343
- MD5 8245b221b5fa70146e9fe5d603867f52
- SHA1 36b8ba0d24ebc71dc5174bda9b6619910522b5e1
- SHA512 c71ba64b0f61b2a0cb41108d985b3d67a3debad91f296691f122e3f28f5a908cdc94d326e6c20c7bb57f31a52bd464e3f737563d92d802ef266f302dd2c1f6f6
- SSDEEP 3072:AYTtzQVBy4xATL7jkflsrRJ6ROrztfuCbuQyVj48E2t7YHjyPscVk:7eVByuABrb6RmfLbuQyjPsn
- TLSH
  T142048D117480C03AE5AF1631497ADB36563CBA300F75D9DBF7889E3A0EA41C16B35E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  7z.dll
- Size 1.7MB
- SHA256 73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e
- MD5 bbf51226a8670475f283a2d57460d46c
- SHA1 6388883ced0ce14ede20c7798338673ff8d6204a
- SHA512 f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9
- SSDEEP 24576:fznngr4eig/HxkaoDFITvg9iLXYgIcjWBzb139EOapmYp:fz64gxnoRGI9MXFrjWLNEOapmYp
- TLSH
  T11F854B57F6788260D0B7C075C5E2ABA6EE7134864B30A6C752859B3D2F17AF6C939330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  7z.exe
- Size 532KB
- SHA256 254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23
- MD5 fe522d8659618e3a50aafd8ac1518638
- SHA1 7d1b392121da91393f69d124928f9fe50d62f785
- SHA512 fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81
- SSDEEP 12288:GvP+BNSebhEFoUbElY7dx0Gyz1batvex:1hiFoUbEwdngx
- TLSH
  T12CC4F925F5748331D073C0BAC5D2A69AEE7230865B308ACB1286D77C2F67AE6D536731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ANPRMonitorLogical.dll
- Size 1.3MB
- SHA256 05625712a494569cccf2088d1873fc56a06da3c2bdc41c116fa9abfc544c8ed4
- MD5 d55d8671350bc943c68eeb854039f47f
- SHA1 09612e480a8cb82ac223287ddaafa2873f46db13
- SHA512 4cdcc84b195b316a3d29b228fe92b93a24c545b6d31e13eface493e68208a00416d246bde622e3e15865edf12aeaf95065589100a1d4d2ee331f6d2a79db2331
- SSDEEP 12288:ipj7P6Tj4Ut2uzfBKAPwLjkeriIp2seeNsDVtDNKJAVRWV9ALQrU5waLD:ipy4Xu5wvkyeeNs/DyAVi9GP/
- TLSH
  T1E3553C6A67788061C5BAD07D86A6C943F7B274C50B358FEB0694866E2F37AF0563D330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  APIModule.dll
- Size 483KB
- SHA256 22fec11438e5c3b5da2f7ab05b0eea2678c99578915d47f03d769239169e104c
- MD5 deebaef720432070044c4dd0f921adb2
- SHA1 4c99c8990e3cc2e0ffb2b45ea5f984b610bbab23
- SHA512 fa124a61e604e58238ef7faa5d9a6d583fc2cec2fa56ec89a103747388d019732754986f7b7eb2e2f0d0d23ae4ec9c97071e6e296c5c0fe5f234ccfa98d36f02
- SSDEEP 6144:Ie43u981HGl6p6PVL1wgk9lmkJR5JiB4iPnCpbohL+mY1XJ9I5:T43y8Vs6wPm9lw/CQtY14
- TLSH
  T147B4166FBB54C956E137C27DCD928B85F1B370958F118BC7028987AE2C37AE44D7A4A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  AccessControlLogical.dll
- Size 2.4MB
- SHA256 139e3a7c2e725af0d76002bba5b60f450318c5e7e8b55f11a7e450c97646f29d
- MD5 13249fd581404c26483a2ca37aeeb56f
- SHA1 70da66a5a62b2692f7e9644aeb82d5445a1341f5
- SHA512 f0caeb790bc4b21509ba72a126c48c554c28eef853a425e684af3b9fc0722ebd1f8ea27302ce5dcf2accae2779b8d6efa7ff4d85b477b2739c8d4d06a24e0f5b
- SSDEEP 49152:JoIwISUAud8zWVqkG0LvZVPOL59swx9p+gMT3+g:GIDSUAumSxG0D/PO8wDm
- TLSH
  T173C54A3B667880B5C1BAC07E9996CE4AF7B178450B3587CF02A0816E3E67EF1597D321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Adaptor.dll
- Size 76KB
- SHA256 2185a9dc699882aa6abd9872bc3d1afefae3a96bc7a90bc753565fe7f2249891
- MD5 bdc5c8bbfd32b68159ef291ed0be1c50
- SHA1 026810c2703c5d1be809344a43a1b755835c56a0
- SHA512 3a8ec370b0ab64e1a7bfa05d17a7dbbd469631e21d11765ffdb6d841322b7d6bf8c927310072eb7653edd24be23722c63123b146bf0f16a62d1a12dd3bc482b8
- SSDEEP 1536:mLS4wUeiV2nR7Rq4/y92+2nkZOKXQcw61LWOjWRjr:SbwUe42nLq46A+2nkZOKXQcNLWOjqj
- TLSH
  T1B973289A721240F5E83A92B88AE70F45EB35F105073617CF0774864E5F22BDA6E3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  AlarmHostLogical.dll
- Size 300KB
- SHA256 223ed8cd5b85d512dc3bd0e21a330cda7a7f2f4cd859bd27fc76bc09eaf8e138
- MD5 5bf3e37c47ee365003cdb1f3d99441f7
- SHA1 ab6d5caf09d1638849a5be0062db4b5f8ea47e78
- SHA512 a979c36c51d975bc79037224f7f28cde90c5a42d5f942f5f7014dd9f64e8c970161686981338b7e5ba43aa9304ef5caf697f4059862000b43851427636cfc1f0
- SSDEEP 6144:BwBE1qlikJLS9JFQ2ZEUSINsxPOJPG3NuZa8YC8:6r8k16FXZEUS3xYmZ
- TLSH
  T1C1640A2B7A688C66D52BD17E85968A41F7B27C414F21DBCB0361473F6F67BE09D38220
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  AlarmLogical.dll
- Size 467KB
- SHA256 546e3ade2416f488c2472b1140c2c3e8ffdb2b1b84650eef24ca5a789b88114c
- MD5 55115dbe2b605be7df7668e5eaaa6d5a
- SHA1 576ac9fd86cbaf5aa30ce50fad09efa65675dff6
- SHA512 32cdbbc183187ec8a57d8902042ab9ef39ff3c4e1872c432c2e58c7cdefc1c386cd5c7bd8d47dba94d2774ded6d0b9a2ea2df7506151116e9f14bb9ff6b35f11
- SSDEEP 6144:qK83bpSFgovkI0lddryPSckW3GmyDY9F7/7eyMK6qclEfY76iBwxiwwo51kXYr0B:6pSavzRCGmyDa/7eyMK6qcrjBwx+3V
- TLSH
  T11FA40A6AFA384466C167C17D85E7DE42E67238890F31DFDB4694923A3E73AE0597C220
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  AudioTalkLogical.dll
- Size 133KB
- SHA256 8c1062d0147dc8826fc04f4453c8c9b71873386ca938311856f64a8a74d63494
- MD5 2b424c037fab733f920633531a3ca2fc
- SHA1 0bb678528fd0a62a0fa82b249000b6e4210b7350
- SHA512 f73a893bfd01ce9004b85a7e861da875253bc5a79eb5910dde9fb48725374f159e39bdf3a07633e6503131de23c82b840b99ed3f568cb0821bb62ce02c2ea15c
- SSDEEP 3072:zIF6XTppio1ly9eA2z8VmFLQTNV4xE+rw7PlX7mYXChdexVc:UqTppht8VyLQTNH3pX7mYXedexVc
- TLSH
  T1DFD3176F3B3880AAC16291BDD4A38F81D3B2B4820F216BCF1664435E5F2BBE45D7D561
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  CardReader.dll
- Size 113KB
- SHA256 c2b89da6ede2463a2824e591fdb4904215d0607d838b692a1e3f8a04ddf801e5
- MD5 1b229fff985dcc6ecca784aa69aed1a0
- SHA1 90d4867000ddb546435aabc4340ebe86c792df1f
- SHA512 002454cac65a69c767cba7982848e864f1c80830950c00baa368abd38bb913c5825034f012001247c187575327c97480348d9206e6e7d21db0d09e83d9567d7d
- SSDEEP 1536:0en5N6z1yF6hc0Fy5ZB1QGJQslxCv4SCvsl:x21yF620OZDQSlxMj
- TLSH
  T10AB37C663B948473E527C2BED8C68A16D7B3B0521B5157EF02178B5C0F233D27E7A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  ClientFramePlugin.dll
- Size 130KB
- SHA256 a0168b7167592954c08ff7682d1bd8c28cfd0134ad1587742c29ed30d45bb1d0
- MD5 bcedf1b579ed715b6fe529a0dfc83f5c
- SHA1 239331328c6bbd692110ad4e5a80c11cd1a5cc8c
- SHA512 a2eb7353057bc2eaaff79556df5e1db887845a120e099464da71019825d4bae169233dd01ea5bea0ad043d48c6280e9a51371aa846dba0cba20a4a668c0a1eb6
- SSDEEP 1536:zfzNRo5/xX4Uro6qHtbMKZgCvFhdkCv0VaK:zZRo5/xX4UlStbMKZgChdkdVaK
- TLSH
  T11AD3496B3B688077D126D27DD8D24FC1E7B7B0A10B524BCB0161439E1E277D63EB81A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32