dd8907eab902a5ea8b7842ee6b77ffb0be0cceb594dbfc16c01d7f3c1a26fe8f

Sharing

Copy URL Twitter E-mail

General

Target
dd8907eab902a5ea8b7842ee6b77ffb0be0cceb594dbfc16c01d7f3c1a26fe8f
Size 77KB
Sample260703-l15dwsbz3k
SHA256 dd8907eab902a5ea8b7842ee6b77ffb0be0cceb594dbfc16c01d7f3c1a26fe8f
MD5 18dff9b0e8fb5e0d98efe58df747c57d
SHA1 d156d00126b9cacc13667398197520999143a7f0
SHA512 d85c37add5b83ddfea38c76aed5e8d9c75fa945a59d25abda9a658ab8ee67909c029636e7c81578d40d2257db8eda8f0bb20dbdd817b873b2a630c62c897b243
SSDEEP 1536:krX4tpfcUjrwLxZYE8ksu+gdLeAyNxYKhHygKx:+X47fcIrwR8ksu+ceAdKhSl
TLSH
T1AA73CF0077A0C4B3D9770B715D7A67BB7FF6A52212A89B1B17006B5EBC32281DE1D362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  dd8907eab902a5ea8b7842ee6b77ffb0be0cceb594dbfc16c01d7f3c1a26fe8f
- Size 77KB
- SHA256 dd8907eab902a5ea8b7842ee6b77ffb0be0cceb594dbfc16c01d7f3c1a26fe8f
- MD5 18dff9b0e8fb5e0d98efe58df747c57d
- SHA1 d156d00126b9cacc13667398197520999143a7f0
- SHA512 d85c37add5b83ddfea38c76aed5e8d9c75fa945a59d25abda9a658ab8ee67909c029636e7c81578d40d2257db8eda8f0bb20dbdd817b873b2a630c62c897b243
- SSDEEP 1536:krX4tpfcUjrwLxZYE8ksu+gdLeAyNxYKhHygKx:+X47fcIrwR8ksu+ceAdKhSl
- TLSH
  T1AA73CF0077A0C4B3D9770B715D7A67BB7FF6A52212A89B1B17006B5EBC32281DE1D362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 32KB
- SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
- MD5 6ebdde247cad8468575f1f2a4d7ae2a2
- SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
- SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
- SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
- TLSH
  T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8