7bedda4e3ded76cff10e045d1120bc954837fb2fcce8cc8caacfd0cd587a35f4

Sharing

Copy URL Twitter E-mail

General

Target
HWID SPOOFER.zip
Size 38KB
Sample260703-1v5j2acy8n
SHA256 7bedda4e3ded76cff10e045d1120bc954837fb2fcce8cc8caacfd0cd587a35f4
MD5 51be75cc222426ac2e7c98b16b76e408
SHA1 99fd454f16396acee53ead58e480a739a7e33805
SHA512 2bfc59c6758df764b3e87f77187a162ab715ad498c670aa1c88e5f564d26552d9f93f64d100c2ba9b54ee9295840928b83c619abe33f85e35165734d318a3599
SSDEEP 768:PxLWUmJh6SHUUa1lv/13DZTzwCA6FsQmRhdJ22TL1xKeXisqxs7Oo:PNS6SMDXA66QmRXJ22zXJqxU
TLSH
T1EB03BF5DFD945406DE4E9271CE8AA86D4068E9090493FAB8B6EE9F018D378C03737BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HWID SPOOF/__pycache__/advanced_spoofer.cpython-314.pyc
- Size 15KB
- SHA256 124dc2e536c9926b99dfb5df1a6a75f2149a42e18ee94181702d495cb6c64bdb
- MD5 4b3e3afb6d5e7ff3f009666569a2094c
- SHA1 23fa5e024ef2dd6991d95934f9d21d407ba2af68
- SHA512 dea9cb0d2601e0f075b837766120eafd55d7eb7539fa9deabb8d96826523ba23cd856bcd643765c280a689982c583ccd07953335986312569af28093821eb39a
- SSDEEP 192:v73h27/hfBeHNsaSE3GR4LHIq7biCq48cgKQKR/3hyamUbVGJosPKDg:jY/hfwsws4jFvx8cDQA/3BmUhSPKDg
- TLSH
  T1136209BDAB14F473D9D6F2BC30D3852A271182065611C783F12589BEDCC924AA7F43AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  HWID SPOOF/__pycache__/main.cpython-314.pyc
- Size 27KB
- SHA256 55aec5beb990718c7947d056e23575e981de0b929e8af2b31a2816ac695ac114
- MD5 e1725e79a3f2f1af39f2ea29b833d876
- SHA1 d77b863e051ceaf8854479d2405a8b557afa53b7
- SHA512 0815299996632c66f886c208e4cb9fe9205aca5d9b0595470b7ba5a08637db490a8f12339091a93affbe1e8e71dd7d903f99cb702ccfb2b31107bdfe3a10ef34
- SSDEEP 384:iImhuqLinH+gIW6tJqCJU2Xh92DzgBle7hZ5CSguE+aAPX:VYLingHhkoe7h/CSH
- TLSH
  T163D2F9BDAA64E163FEDAF17830D3C56A13224286B255D743F1288DFDAC85356DBE020C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  HWID SPOOF/advanced_spoofer.py
- Size 12KB
- SHA256 24963ea4e5a4f252418d49dce7779caf06e2e7402bb374ea9ec777cdb0fdb09f
- MD5 db68ad8502fafe04a176d251c90261fd
- SHA1 4effe8260f43952fbe3d5c16951bd46288de6731
- SHA512 27551551fe1756f0c72bbb8b01360377e166a8cb95c5bb1687d1b0715cab994f4d28a0a478045119f4a2aea02f41f4ddcd99709eeab40ce3d01834d44e4b0271
- SSDEEP 96:dimgPLZOWYIJREx5GT8GUQprj3J0ZGmWERUGxhxcogTCRsLRHdnqzUHwXJ1Gk34z:xg4h7wTxPu9WblHdqzUHwZ12wNA7ka
- TLSH
  T119428302FE04681AD143D67C08429452362A69236B552D7A77FCC3884F896BE93F9DFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  HWID SPOOF/install.bat
- Size 673B
- SHA256 4faec29845ba9dce3a554700e5d28d301ad08b2a4586ea2bbf4d70571383f04f
- MD5 47f0f3699178d96092f77f93a428b8af
- SHA1 121756f864181ac28e9e2b5973906c4ec510b8e4
- SHA512 295c3373b0c2cc4aa5ffdeac9357c9d43d8d3df21a5c04b2be2744ddae642e12cfa778b6fdcd84feb2d85b3f93bc606f526777a921d132bae84b98b58bff5cd0
- TLSH
  T17A019E1F3148437735E5619EDC5E11653702220B02525C7DA4FF11686E06CE0BAF94DB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  HWID SPOOF/main.py
- Size 22KB
- SHA256 2d3e80d47bc6983efcf6c42a9ac965bb693cc617be734082238517d954147435
- MD5 44c609ffcf69ae00ff5323814c14aa10
- SHA1 161e374583575fa0f3409f959c6e57af52689c31
- SHA512 c9fdd785db6c62d5320b9dabd33229661802a7d771520dfb10e64c203bd266520afcaa428eaa60f4922e2addbfb5a424ff2cc75fc42a2d6669943c716f57d71d
- SSDEEP 384:58+pMroK56GK7gozEz7qhHUg3GfoGY2lD7s8J4PgO3ZpuJkephcy0dBPdT/:5P656GEGY2lDf4YO3eJBpajd
- TLSH
  T1A7A28506EE056826D743C53A6816E411351B2C235A686D3EFBFC92D00F4D63AD6FCAED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  HWID SPOOF/run.bat
- Size 703B
- SHA256 fdcd0ea433bdb6eca81b099c9d0ff181372b66ddbed7dd71ed697c41358054d5
- MD5 99dae023e2e013877fe80849508b1a0f
- SHA1 e563446b0441dc8d42e2fdb78cde3d02171fc49d
- SHA512 a38da984d26dd8eeca34ca49c91720ee5093d708cc2d05f8860b9e916a9c0823e183cdb58d09d710d62fa5bec6f17b0f8e7c2062e3bd0af3b61bb69fe364a8d6
- TLSH
  T1CC01DD0AF5889B7402ECDD06CC41116C7908211FA2141DF8F2BB43745F657D0E9FC0DA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  HWID SPOOF/test_spoofer.py
- Size 7KB
- SHA256 83df3e6ff0876955c427016eefdce97e76086cf05a1396ec4e6e5f9dc5a31495
- MD5 9ad311acff586841b43011396ca9f5ca
- SHA1 e7d27ca793f46fdf4ea612c107a2786d3f491254
- SHA512 18c3057b1e240b1cb9558fbba53fe82b385fa5defbb99c4c10ee26abee40ed6f3340c3a633762d49992e26fcdf24443be32365d42a72aeca1a74e656308b36e9
- SSDEEP 96:RmYtOlR1ooHKHHTMRrhHh0i2y3bDKkvKnFhFGlEQis/Rc7rW4Y4+0LL+MsOqK6Km:gYslR1XK2ckzKsIYcLKMsFF/8lHi
- TLSH
  T1E0F13D10AE005972828399ACE8048025153F6D2793F83C72F1DC82CA5F759B6C6F6EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18 behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20