93c2420fad674ff14630df39e77ce3d4040a75ce11259b9eeee234b11e09fd94

Sharing

Copy URL Twitter E-mail

General

Target
WraithPanel.zip
Size 9.9MB
Sample260703-3yxppsht71
SHA256 93c2420fad674ff14630df39e77ce3d4040a75ce11259b9eeee234b11e09fd94
MD5 129579fd292e5d27b2d91475809f39e8
SHA1 22f0e27e0c11ccc72d05f1e99f6655f5a445f8a7
SHA512 f3e54ea3f6d408173ff3c88ff6897afef020862eb3d4795b08af86b94d9818853f000e398441373dcacbdb92bd5052eb5ee9194cdb2e18c6bb2d108ab76917c3
SSDEEP 196608:pZUVva+XI2YagA18nbGFbRNHu9boyD/8s42qa9B0pooDBBi9VSvy:vUu2YHnbGFNxuNbqcHVSK
TLSH
T159A633B65C13ED00C915883B7192F38AEBDD29555307103A2EEAED2B4F5FFDA806E914
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WraithPanel.zip
- Size 9.9MB
- SHA256 93c2420fad674ff14630df39e77ce3d4040a75ce11259b9eeee234b11e09fd94
- MD5 129579fd292e5d27b2d91475809f39e8
- SHA1 22f0e27e0c11ccc72d05f1e99f6655f5a445f8a7
- SHA512 f3e54ea3f6d408173ff3c88ff6897afef020862eb3d4795b08af86b94d9818853f000e398441373dcacbdb92bd5052eb5ee9194cdb2e18c6bb2d108ab76917c3
- SSDEEP 196608:pZUVva+XI2YagA18nbGFbRNHu9boyD/8s42qa9B0pooDBBi9VSvy:vUu2YHnbGFNxuNbqcHVSK
- TLSH
  T159A633B65C13ED00C915883B7192F38AEBDD29555307103A2EEAED2B4F5FFDA806E914
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  WraithPanel_2.4.0_x64-setup.exe
- Size 4.1MB
- SHA256 0c3e98fb448c015d421e39150b73c2d8e2d50d2a2b80ed9fce91af0380dc98fd
- MD5 9758c40b3e73f029294c3daec84a363a
- SHA1 58b57e88d3e32dac7272fb2ce3e880a820a39ae4
- SHA512 b357212c7df78c11ca90cf1135f153ba4573232fbee166951b2e8fc3c6cc56769634a4e3842ea4f13c7351709c9ddd44094eab244c20459f3f7ba70082798f53
- SSDEEP 98304:l0J3ccZtVAZVrPkRfaQI89nA5usurGn1zhyL1trGYTNnR/iceo0kiT:l0Jsc0rHQIasuc1FaPGYT3/iRp
- TLSH
  T1E616336A5C93DD35C022447D2221878FF7909C16A31A263A2E5DAD7DCFC7EC49A1DB0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  wraith-panel.exe
- Size 16.2MB
- SHA256 b6d32f01855c52700e13f4c1bdd8c59183b7bbf91de5c5ae045022c65d9fa263
- MD5 299c4d33aa54700533b24aa5c48dbd48
- SHA1 f6aaf9cf7663eff1e2aba4a788f37261393e4882
- SHA512 f0bc871a4b5fe49ab6cd98434568b195eeac000eb163c6e6adcc6034d34f9e7dcaec65c73ce4185ee642cd599ac9b11a905696b8a3be8e87957af060cbae873b
- SSDEEP 196608:Gy1EDHhpHTEaAy+oYpMMbOE5sY01ODVqzJ:5EDHhpHTEaAy+oYp9b5sY0ssN
- TLSH
  T14A07E721BE5B99ACD05BC47483478A62097170CB0B39B9FF448496382F6EBF56F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral17 behavioral18
- Target
  WraithPanel_2.4.0_x64_en-US.msi
- Size 5.9MB
- SHA256 3f5fd5a78119bd3ddaa5069e1fce727aad5aecbe40dde51767355188e6f402dd
- MD5 b2dee0e3131dc5e435b5a59c2f4c131f
- SHA1 c1fa204ea80e771fc437221fe5efcd2f438b14c0
- SHA512 f3b7f5e89f6b3a6f72bb5ffe4350442b4c1707e65d295e77d581ed7cbd7e7b922c618b3b87d9c85c64ca4a78f47682500c903ca04df3dfe1651058ea74f34bae
- SSDEEP 98304:SiYSwDwAUMpDunI9HCKG3Ez9cNQMJV8U063zUf0EOvrtGlbaLkVwQbsPpwBfLm9J:Y5xU0CfAcQ68UBUsEOvMbaLklABwBfuJ
- TLSH
  T1AE56336BBE02DC11C8021E729476E352CF6E7C504BA685632BD1F94ECDF23C14EAA9D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral19 behavioral20