7d5e5ef235c4504b5bd81bc72ca30854a5c2ef166702f4a2ccbd700042473af2

Sharing

Copy URL Twitter E-mail

General

Target
Mfraq.zip
Size 15.6MB
Sample260703-ar7bcag17x
SHA256 7d5e5ef235c4504b5bd81bc72ca30854a5c2ef166702f4a2ccbd700042473af2
MD5 46265e544fc1e16db762ba83bb7433d8
SHA1 54be4152decbd6fcccc1ab17c9cc54d6b7bc2aae
SHA512 78ce110205e87cff73b1baf0e5e425d50a92fb90da8c1f17ff393407f0ae33f61d90086aa6cd259f4c5a679f1fd83b8822f2ffa1aa8c3f097fc602c74d98511b
SSDEEP 393216:c9rjcBVFq28fklve8n2Df3kY3ucN6OUPLFaRGI:yjc9qclGfDf3Nuc8fER9
TLSH
T1E0F63323C73EA8D6DCB2A2783CF2DB055B1ED21A2B71AB8F0E2752946D590D0531735E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  python312x64/BKNOLazyMar28_AnnnnnnnCrack-obf.py
- Size 1.2MB
- SHA256 9ae9f9782cbf7816c1e738b144de4f7c11dbf41a9dc0dd87ca112fc9a8c6f539
- MD5 79496e453e4b8bf497032fb7942f7e00
- SHA1 721634edfd970fc68adf64add30540a5d90edd1d
- SHA512 52581f3e86ff39aa8ab0f60a9582ac67dfea6061667195c8cc19bb8380b8388e53241c70204f8f72dc0c3ad4dfd2260bbc515e829f929db087f485d1592f9573
- SSDEEP 192:wdQ5bGRVd/ciQA5BfgvZxjOZnJTRYwQjeu9iAbnQK9xa23WJ3cCbGRfssGNJGVja:yQVGRT0Gzfg3yZJlYF1iAbnkh
- TLSH
  T1C655C84D611C16DCC75E59C7FAEFEE49008C841B5A83C698976DE8EB9D63232DAB00F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  python312x64/BKNOLazyMar28_Annnnnnnnnnnnn-obf.py
- Size 1.2MB
- SHA256 052b35f075032e6f51e58d762aea758fb1bcab638165fff37643abc46a1d84b5
- MD5 172cddcc1e8fe99accef7463dae78925
- SHA1 1ad46aa5b0612e2f8376f8f288a84b53e19d5382
- SHA512 dcded179c0583b39df08f4dfc3d5554160fb843abcce5786be697c48a7cb754767a2a81e13f51476ef75f136b90d4d0fbcb5a3fd846379ec092ec509124f287c
- SSDEEP 192:Pu8e5bGRVE/xpS8083roA5B8WKmJecfM/b3EXTrhafCfgi24qGz5p4a53+SJ+mP3:teVGRim783Bz8ZCfM/bUDJ
- TLSH
  T1E45537AED41B06BCD81E3A64FF5E198EE553484FCA908B91725DE8BF1B2813DE435072
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  python312x64/BKNOLazyMar28_Asssssssssss-obf.py
- Size 1.0MB
- SHA256 1de062def01706ac35e2441d366fea7686c796de12847c0cb4a14fbceae9b010
- MD5 a1cf5db2f92d1260da1eaead16b13957
- SHA1 c477aaf4f8e5c45cf459739d69f9c1b48a3fd9a3
- SHA512 ddfda019dc35bac5372c1a39a0f9ec5ca2009a790dd8509624b9aba501d6dbd682fbf225727091c75e1b58785318d88742a9a86b2a1c239800db8db375a05fe4
- SSDEEP 192:+UA5BBn91/Nii4i0azMFZHrk55bGR+48+bwEI3GIwG3geC3weE3AI9IbOuo8AOGC:+pzBnzci70hGVGR+V+bK6f
- TLSH
  T1CB350C3D47D42836E25BDB109E96E16BC111EB8DEB99FB7A31E0DC904B04EF1E74205A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  python312x64/BKNOLazyMar28_Hvvvvvvvvvvv-obf.py
- Size 7.5MB
- SHA256 91708488fa635082eba9d2ab640f474da07e0d3246fee1b6f3bd14535c83a04b
- MD5 69dc2a5482bbeb58d9bfd29d8ae4c103
- SHA1 14e9c5af0f1b71e6181cb3296222198248b79a2f
- SHA512 b25f273d0a38b62b6465c37bdcf4a5d4d448d80503ab8f7794361a5c70065eae477e26479350eeca029d7b504d278ed484069337005e732f8f86c29578b3832b
- SSDEEP 3072:o/ylWTm101mWVSLbIbCkJJv5wTIAwlNLPpBEAzWBkUMcuTacRULPLzTHylSjHvZU:ob
- TLSH
  T1B97602DAEC1FA4B5D0F079D8CEB13DF614414996B94385D7A640A8EF8063B3EE43A253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  python312x64/BKNOLazyMar28_Plog55555555555-obf.py
- Size 7.9MB
- SHA256 3c72063967acc8620194fbb00e83e6cb28d26c7d35b70d20f37fcac8197d509c
- MD5 8905fbca269db60413d9698b0f61a4e2
- SHA1 8f689d7ca35a7830df25c4135190267c7ed30db7
- SHA512 63372b6272be27f671580502bcebcc214e1da6f3263f0e9e2138dab2185b92a99bf423ad28d664e483563d0d3bc0c83adc0824344f043f1e733257fa34e8a72e
- SSDEEP 192:OIqrA5BB6kSZz4Wp71P/Zt5bGRcXOwWUjquybE6J4cRMt4jlEgF2XozA6hvDPWNE:OIpzB6jvx1P/ZtVGREOwVj6bGY
- TLSH
  T10D862B2DB71F63D788DB65D0EAC3CEA9C4C32B2891E649C5C67668AF004495CEDF9138
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  python312x64/Crypto/Cipher/AES.py
- Size 9KB
- SHA256 076aa8b82c133fe19bac3ada6d451cae2e0503a6db34b4a00247992de8dd4a97
- MD5 feba092fb6d748978f59d0af580e0d46
- SHA1 d63061dcbeb444c0928bd6aceb732f6525130595
- SHA512 1a1a2085f95aa8ae18a32a7e7a17e6d5736c995ab3540533c1214ad431db2623b2215cafeb2e83078114e068ce578c055ee9aefae265787ebb2a5334f4cb043f
- SSDEEP 192:dmQHvvK8geSDztF9+hMkRI4H1Futf/yi/a1/yRdotfL:sevK9t4ytfP/aydotfL
- TLSH
  T1BF12C637AEC399D261B100A23D78E059E722505F2CD66A4135BDD46C7F76F30E3AA28D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  python312x64/Crypto/Cipher/ARC2.py
- Size 7KB
- SHA256 cf808c3951f83d9e86799e02a564661d6c372216656dc5d40fd9e19b21d84a53
- MD5 274e46a9ae6d3e092b48a7d1ab3f0d6d
- SHA1 fb5a62548fb3876ff73319d3c92565b64cea3e69
- SHA512 d9850d167368ae4b901512d5b3111ef6858e643fcd4dca7ee2a263adbb621d3d9729d124a9a9570eb250d63034734663b16770acc5b2d4f1ceefb3e47eacd8b3
- SSDEEP 192:dHQHv8gflA2jSkmRFmynD/t4AKdRYotKI:te8g9A82jnD/t4hjYotKI
- TLSH
  T1F2E1A567598399D2257040622E79E04DE722916F3DA28B8135FD941C6FBBF30E37628E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  python312x64/Crypto/Cipher/ARC4.py
- Size 5KB
- SHA256 8e7c7189986eaad85a5cc29bf9fea819e5eb144a449bdcfee66a5d6fa9738909
- MD5 712918e363f6431e6814ba371e8024d1
- SHA1 e2d183660491b893c11310fdb7b84d2c75e5b464
- SHA512 299d6815dc6acc5b88767a3e2574fb8d9f29713c35481513a9f678de0a2914d6c34fd1f9e1e385cc1e8a0ac41fef0a4b89a5a71f141f1c699ca0b156d410ead5
- SSDEEP 96:doFQHvo7HtdIUoeGgR2uvi/jqEyExPhO3i:deQHvbGR2uvi/j9xZO3i
- TLSH
  T1C5B1B887BD9BD9C237718086297DE84ED79552072529571334ACE0586FF0731F2FD648
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  python312x64/Crypto/Cipher/Blowfish.py
- Size 5KB
- SHA256 9e71714f41ad4fc6499b83ff0199d1ff75d73d551a740cffdc077d13ad930edf
- MD5 c34b138e93044278085c0172b171945a
- SHA1 058cca453b61ad12f6007a84e1626371ea2e5855
- SHA512 39ca5d7161933f6ab86d14877e8e089d3bd11561494079b99c7b56209b074fae50d31a8ba25760c3309e36bbb216a818ed49084e9479f0b47fefc4f55bf2ec51
- SSDEEP 96:doFQHvofgiwZAEuVDYsgiiJsJWkGI9gmJt4qeA//RFWotKj:deQHvogySniiSYkGIOmJt4A/RYotKj
- TLSH
  T146C1B5635D83DCC2257050762D7CE049E722A16F3DE29A4136BED05C6FB1F31E27A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  python312x64/Crypto/Cipher/CAST.py
- Size 6KB
- SHA256 2e59e547baf132e8553fc76e9ae2151b48c0610483e54130b0b6262a03f95903
- MD5 1166b892369e19b4220bbc069d9ccabc
- SHA1 f8fffefad392a8d7f79cd644b4d21d771d7458ef
- SHA512 b99aa9b0f448b24bcf56deb0bb30b948c1fbae91692a78a291ae30a1935e4c74204a24925573e3e60777b5033cf748fd7c0d4bee3e79bcf3d8d5fbbb19e195ce
- SSDEEP 192:d2QHvVgdaKSnrF4xkOUBRkUtmz5t4AyRYotKw:UeVgd8n549aW75t4rYotKw
- TLSH
  T1FFD1A5625D93DCC326B050A23D78E05DE722A16F2DE25E4135BDE01C6F75F30E2BA289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  python312x64/Crypto/Cipher/ChaCha20.py
- Size 10KB
- SHA256 068ae8765df74153e0d75fe40e422618d9fe4a5016faac5d60d1663abd225b82
- MD5 cf6aeca596303373d68a1397189eb7c5
- SHA1 69b657daf5d5c833175def3eb52f15c36dcb4151
- SHA512 61e705c1448c135fa7ea5765e37730242dc30fe9b9216554afa6004c92696707007dd827ea54210a31e2a40a9ed455eef04738d2eadb8aa375d6ebb105b1aff3
- SSDEEP 192:9qrskrs9t3q/IcwYkUlRGziNzvPpDkzBj/gkcTUjwzgLMZKPOYbCCtrBUpt:0rskrs9VqxwwlCihPix/g5F6PPOqBUt
- TLSH
  T13132C7938E52CCD253B3850A2C7AE90AE71962232E445F033CBDD8146FF637595ACDE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  python312x64/Crypto/Cipher/ChaCha20_Poly1305.py
- Size 11KB
- SHA256 f9ac5471b762339307b3e64e2d3b0e5f0822842053b3cd7327dfb9fe2b6f57ac
- MD5 23161fb81ef4f8d13dbdbc3414bbedc8
- SHA1 cf34274d92ff90154a030f35a082838fe4e0179a
- SHA512 b7e21389b20e380a8194bb7c4997d3620d10c7a2ecb7ae91ffb10ac62af810d3a711196b7e753795de12ac63c9d462affab7ce02fa7d7d58d9cdee06290f4edb
- SSDEEP 192:0qrskrs9t3q/IIJOqiEij/Rnae9XR18psd6agIoK2Xt:zrskrs9VqViTd/XR1iWh6t
- TLSH
  T10C32A8A1EE47EDE34277C589AE68E50BEB0790132A2C0A13787C98541F70774D2F8DE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  python312x64/Crypto/Cipher/DES.py
- Size 5KB
- SHA256 bae52d7a7d2cd509d466156dc2878d7e4194bb304a8cb555f353ec00108c9186
- MD5 1b182d8cd016edc5f53015a433be05d5
- SHA1 531c8db19cda7edee5b45b83d0c309f4ea65c1d5
- SHA512 3d08af59aa18156e5086e061bbddd3e7e321a5eb98b1efe4cce56d7ca668cdfd167ecef8f42a66fb6450797f21a6a21841fe24a606b0f1f959375ca6f4279227
- SSDEEP 96:dOFQHvotgiwHCXjG6DH5K0kmIbU6Ct4qeAYZRFWotK0:dcQHv2gUqC5K0kmIct4NZRYotK0
- TLSH
  T1CCC1B6666DC3D9D325B440623E78E059E722A12F3DE25E5135BDD01C6FB2F30E27A189
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  python312x64/Crypto/Cipher/DES3.py
- Size 6KB
- SHA256 70d9b525599d85146924ef8dbdf0980c42a03f4fbb2d01a2cadbf7ed2d43cd93
- MD5 44204a7cbbf99e82eb31b7f746b43ab3
- SHA1 4589336cf1a1d1e74daaa10e87c898dd804db7f8
- SHA512 1d0403f3bcdf6ae8a7a7d2fe339112b7be604ea1d103388547760ff73cbbc7df5106cf6d702a6134cc4c51a836feb3ed42ac0bfde90a46e67f684ecca3ddf4f6
- SSDEEP 192:dKQHvCgthz1GPoiRxwKIUK9t4A1zRYotKa:YeCgHAhRn9K9t42NYotKa
- TLSH
  T1F5E1A5636EC7EDD3257440A22D68E059E722E12F3DE15A5135ADD01CAF71B32E3B618C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  python312x64/Crypto/Cipher/PKCS1_OAEP.py
- Size 8KB
- SHA256 b197948eacd76b02a5bf42fdd009a0a51a19fe0bcc571c9e6a98bbbaf1ad12cc
- MD5 6a73b6acedb0fbfbd341f54b3d645d2e
- SHA1 45e81d77db3f9c3b0d520bf061bad1ca19172d26
- SHA512 0627010bd065d3fbc5b4a41b90ac8078a9524c722b485cbda0b7d9f988075102c74f5468774700873d0d7be1e0dd2df6329bdae3644b54ed3e788593e9218e9e
- SSDEEP 96:dEFQHvo7wHV2QRL34mghqko9uNizI3y5xU3a5tLVZCMKesDBC7IM2ef9o20kqk9i:d6QHvT3GFA6Iywx2XQ6UF9kv
- TLSH
  T14D12C69B8D06ED9D62F3880ABD7AE00ADB13418B76E9571A30DCDA044F7433C51E5ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  python312x64/Crypto/Cipher/PKCS1_v1_5.py
- Size 8KB
- SHA256 b5779f84428c9ad5116dfd46ac1fba2c9df9f3f93dc3d955ec0ece8db8565f78
- MD5 31086f08868555bdcfb3c52df18f022f
- SHA1 8f174334253e6f1cd82b60ee90d8a7d82db2da72
- SHA512 767ea0778d015619a79ac80be31d6cc63d36f322ef5e36fa9f9c283bff694d4550c47d36ad41c20f5a9ce4f7b39b5b1b1d941b8bafd77a7a68daea0827ac0582
- SSDEEP 96:dtFQHvov1zDHk/zN1hXA3ZutH8MKD8LzPodYavD+U8FbPNapkVs3a:drQHv9zjhQ42ME8Hmd8RNu86a
- TLSH
  T12D02A4479D83CDD952F7486BEDB2F14AEB06A24B2564270738BCD5484F74328D1A1ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32