98ee56d1d0396bf55d9080dbdcbbe7a49cec01938534a80621fdfabe615e2ac6

Sharing

Copy URL Twitter E-mail

General

Target
RefreshTokenApp.zip
Size 39.2MB
Sample260702-wlk2tabt6z
SHA256 98ee56d1d0396bf55d9080dbdcbbe7a49cec01938534a80621fdfabe615e2ac6
MD5 b988b3891e869f4e96c97bd9b2de4532
SHA1 c021ad20e656da78bdb3300cd85cc7c13a434ba2
SHA512 76bbc76690ebcaa4319de4ee9f835b3bdf0f5916164360f0906fe904af234a72422847bdaf111183dfb433df8c85ffdb22c2fd72ee1c78ab3c8f644b5d9b3ff0
SSDEEP 786432:le/he7D030YCo7V01+9HIk5Tp9iKj2BzAucB02d/0OK/5nSv0lif:Kg7UzCuVC6IkhbDnjF/0rnw0Ef
TLSH
T15B97333958A71DB0D1C83670E2F46B68AEF01C50B018DC6AF3D1AB9CAF94BF053566D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RefreshTokenApp.zip
- Size 39.2MB
- SHA256 98ee56d1d0396bf55d9080dbdcbbe7a49cec01938534a80621fdfabe615e2ac6
- MD5 b988b3891e869f4e96c97bd9b2de4532
- SHA1 c021ad20e656da78bdb3300cd85cc7c13a434ba2
- SHA512 76bbc76690ebcaa4319de4ee9f835b3bdf0f5916164360f0906fe904af234a72422847bdaf111183dfb433df8c85ffdb22c2fd72ee1c78ab3c8f644b5d9b3ff0
- SSDEEP 786432:le/he7D030YCo7V01+9HIk5Tp9iKj2BzAucB02d/0OK/5nSv0lif:Kg7UzCuVC6IkhbDnjF/0rnw0Ef
- TLSH
  T15B97333958A71DB0D1C83670E2F46B68AEF01C50B018DC6AF3D1AB9CAF94BF053566D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  runtime/conf/jaxp-strict.properties.template
- Size 4KB
- SHA256 3cc9b87633769414b22c24c97ecded8a15df630fe5ab12abca2398d88e31b32b
- MD5 fd9c1610c84407bf676dc11322c522a7
- SHA1 c965c754dd6e44602d9763c2061a6c5abc95ccbe
- SHA512 a4ea96dcf744d470539bf5498fd0c427d2596652e92ed89751eec68a869f4aa1ec207dc2bb0ba6a9f9b055c6df421e1a0a64e5c3c6cf4f44f00215c5fa9908db
- SSDEEP 96:Wl5e6xCDB1s7Q3GJI9LcvGjLD3Y89V1FZyueAnyRYp:WLe6YDB2Q2rGjLLYO1mueAyRc
- TLSH
  T144A12052B559FBB4038A42E4D40E12DEEAF07468BE3B647471DC566C3309EE066B71CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  runtime/conf/jaxp.properties
- Size 8KB
- SHA256 d4f45052a100e5aef02b6638a3b9c69b2bdd46155ceb58a52671e5d594c30100
- MD5 80f4a5f43c22b97be120e0716974a029
- SHA1 ed8df3f663c669bbe7d9dffd03d4800fae364ba9
- SHA512 875a099a87f8427057661f1b2463c3ba4f2f1070247ca7c1064b3d4e3f45a878057c374eb80f6d760537fa0c11d30add9bd34e3ee9f70c2259f274e719dc5bd5
- SSDEEP 192:vmeomZOmsWKjL53t72QxQOjLLc12/yAyRc:ueomZOmsWKP53t7HxQOLcs6c
- TLSH
  T1B0024123B64DB774038602D1910E13DEEBA8696CBD3764A475DC263C321AED423F75CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  runtime/conf/logging.properties
- Size 2KB
- SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
- MD5 c4b74648f229c4b7e62a1061ee1dc3f0
- SHA1 5795edcb624326bbefdedcdb6a11d9c18071d8ce
- SHA512 76ea95402f64947c2784f1f8d0857f0d7c963285ae9ebcd9f5cb407d83a14e4da6d14aeb8641c9d9b1c92af4493a4b10e52ad6efda7ae47f265d43df6b4002d0
- TLSH
  T13251FE5E9B4E2D35430E00AA5A7FF6527E1898BD1C23A5F6B35E6304321D43485DBBC2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  runtime/conf/net.properties
- Size 7KB
- SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
- MD5 1f251a36eb37913b696b5be5595e1cd0
- SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
- SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
- SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
- TLSH
  T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  runtime/conf/security/java.security
- Size 72KB
- SHA256 a86d4ca2038d0978d8b539224e9d60ff55b475fee2e6d113ee24c8a60852c70b
- MD5 25fcce9d59b4dd156d532ca47a742597
- SHA1 eab689f234879082366530e25737fad0f2983010
- SHA512 efa421a738ae79056fb68dbda14aade554f984b110fcc88f4e1144eab3699900d981f3875f6497a731b1a58d1bf0c3bbc6e589302f897608a9b50e6629886267
- SSDEEP 1536:rQMy8R78MRjJPFp5/LTNHu1UoQ2k/gl0ug6YilNndOcA2ZIYy60:J8MfPFD/LTNO1UoQDHiDndOcKp
- TLSH
  T12673D522BB897B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  runtime/conf/security/policy/README.txt
- Size 2KB
- SHA256 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
- MD5 3d47d94bc4f19d18bcc8b23f51d013af
- SHA1 a97cd312d6a2a9c8c780c15e5af51a2f4f97c2cb
- SHA512 68a031264cf9442526307364ca74b336af55564c233c2f514cac48e910022767562f8ff6a64bb9cfcbf0fb5e755289273382c9246418a4b9207fc7761d03c64e
- TLSH
  T17C4174077E4EDB3204E3C0D36A6A92C1D361A29AB2A5121D750D425C3BDCB3083BF193
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  runtime/conf/security/policy/limited/default_US_export.policy
- Size 146B
- SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
- MD5 1a08ffdf0bc871296c8d698fb22f542a
- SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
- SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
- TLSH
  T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  runtime/conf/security/policy/limited/default_local.policy
- Size 647B
- SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
- MD5 6d7b4616a5dba477b6b6d3f9a12e568f
- SHA1 7fb67e217c53a685cb9314001592b5bd50b5fbb9
- SHA512 a0b98cbbb49184df973bb2c4a506e9bc6e025a696bc0c8054a6352cc3f9b4a38e3baf117c6834ddaddc38498556607ed4eda8f1bc683f662d61da50e0db0c8c2
- TLSH
  T18AF0310FEE49FA740998C1567B3DDE07D175A11771940B69F31CC0601BD8EA0D791B96
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  runtime/conf/security/policy/limited/exempt_local.policy
- Size 566B
- SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
- MD5 4cbb03f484c86cbea1a217baae07d3c9
- SHA1 ee67275bc119c98191a09ff72f043872b05ab7fd
- SHA512 2bd70518aed6b0e01c520c446830c5f567fa72974548818cac3e1e5c2be6f03db78ce6012f5463b1e19c36243d04cbaad38ec79524635eaae2e427eb1875ccdb
- TLSH
  T1F7F0811FFB19E5F564C4DB920776B84DA3319AD270B0431CF546C1942B94911C3325B5
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  runtime/conf/security/policy/unlimited/default_US_export.policy
- Size 146B
- SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
- MD5 1a08ffdf0bc871296c8d698fb22f542a
- SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
- SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
- TLSH
  T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  runtime/conf/security/policy/unlimited/default_local.policy
- Size 193B
- SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
- MD5 2a0f330c51aff13a96af8bd5082c84a8
- SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
- SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
- TLSH
  T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  runtime/conf/sound.properties
- Size 1KB
- SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
- MD5 4f95242740bfb7b133b879597947a41e
- SHA1 9afceb218059d981d0fa9f07aad3c5097cf41b0c
- SHA512 99fdd75b8ce71622f85f957ae52b85e6646763f7864b670e993df0c2c77363ef9cfce2727badee03503cda41abe6eb8a278142766bf66f00b4eb39d0d4fc4a87
- TLSH
  T11A213B3F770AA55F17D600B839BC8A2F91CC0A3E5D63A4C028AC4301BF4A8876D51E46
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  runtime/legal/java.base/ADDITIONAL_LICENSE_INFO
- Size 2KB
- SHA256 a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
- MD5 71bb3ad0017bf36d14bb96a8d4b32c45
- SHA1 1a5c553e71bdb7d94995b206bc9eaa49abd1e888
- SHA512 9f658dfea71bdc3cc1549edfb5ad3171dbfa0082b2d91e820c09abe0b376b6bcd8b5170442a5e25e72274e98f130176bbdecfa7997c59705782b214f02136a20
- TLSH
  T129413262958513731BD200EA2E1C58DEB29D65BCB3190960B8D9C15D335E826C7BF3EE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  runtime/legal/java.base/ASSEMBLY_EXCEPTION
- Size 1KB
- SHA256 75292f03bf23d3db7c985aecc191029b93883200721ed23ed34a2e601463df33
- MD5 d54e5b1b11ce92d8abc22e8e756f54bd
- SHA1 515a539c34f00a4bd68500033ea60f5a45e3adfc
- SHA512 5516e2e9eb3a555562f600cc3cd85ae01004962a8af8c49d2598281ce622bcbee7a4bc513b94b05e3b611bb50611360171e21bae9c1b3ed7d05a0867de7d3bb2
- TLSH
  T13931FD36C28416734AC314625E182ADAD7AF5C2D3FD00561B89CC2CC1699A35D33A7E7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  runtime/legal/java.base/LICENSE
- Size 18KB
- SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
- MD5 3e0b59f8fac05c3c03d4a26bbda13f8f
- SHA1 a4fb972c240d89131ee9e16b845cd302e0ecb05f
- SHA512 6732288c682a39ed9edf11a151f6f48e742696f4a762c0c7d8872b99b9f6d5ab6c305064d4910b1a254862a873129f11fd0fa56ff11bc577d29303f4fb492673
- SSDEEP 384:sY2fSz/rGvS/66YsaZdIP3Lf4vAkMVhPGkupdDdicW:7vuvVmjkbylupdDdiZ
- TLSH
  T10182A62F770503F205C302A16A4F68DBA32BD5B9722E11646859C19D236FE35C3BFAD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32