26c3a8d2e1d6d477152a7d307161d72877b38406a72374761824b8bfe7db315b

Sharing

Copy URL Twitter E-mail

General

Target
1776020987431-realistic-drivers-ai-2.1.zip
Size 56.7MB
Sample260703-pxpe2set3n
SHA256 26c3a8d2e1d6d477152a7d307161d72877b38406a72374761824b8bfe7db315b
MD5 3650d71a424f7fe963c0341492ae0e3f
SHA1 10594e49107a21ad5bc3437e868a515055c05554
SHA512 69085f4e33efba75d724f804beb3548c8067179894dc8795607012c9f60c741cf2677ad85cc1fa041b2d1c68f50091a8387db565ec6ba0a451b77a07fae06b25
SSDEEP 1572864:BuJsqgfWI+i3fPpsCPPENDe9h/zAlKaQRp:EJsT+Il3JsCee95zMK7p
TLSH
T1A0D733D60B10273CA6B3715277E366D6F0164A07153398DD0EB6FFD02FB65321E90A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://www.gyan.dev/ffmpeg/builds/ffmpeg-release-essentials.zip

Targets

- Target
  art/sounds/radio/RadioPrep-FFmpeg.bat
- Size 286B
- SHA256 e94e3238bcab702fbc65057e25ff1744a1d92635561def5ea3b5e8202d688154
- MD5 3db7de79f2a8cfd14806724cc74b42c0
- SHA1 4bbab6ebf9955d130a5f1636b19fbcf9cb8498a4
- SHA512 c17b4f71203d494a679802fc7655a9b10a08d6492b1a69453e2d6db862b5fd45d7f0b66572cdc8a3da85cefe7bd25d55ba4f8dde961fd5648bd47f43dec75a4a
- TLSH
  T1B2D02B1F47E5838A14AD6AD2B68449B07B1BA286814281823076A17EBB5A3BC4391DC7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  art/sounds/radio/RadioPrep-FFmpeg.ps1
- Size 17KB
- SHA256 19d7e09e461c9596390576619db7676258888d4e15b059afa700e275b7fce742
- MD5 e902a3217222603a55c796022820bba6
- SHA1 34c91c2ac64b2f15c4cbdcab01b1f9958e57684e
- SHA512 2e40748ffe1577dd12f72cf608a5c8b4fdcafb55406762045399b6c7b259bbf39d5b492f252047416ca244e80b96d7216592c4663d40d3d64524774d6767f6e8
- SSDEEP 384:5l2yx/G9CEMEJE4EOE3EGYMGw+dLbmfx/qhe+KfdaA:5Ayx/qCEMEJE4EOE3EakmEA
- TLSH
  T17B82CD28DC05051E5AF382AFBD014118FDD6423F91991AC0F55CA0D57FBB32F8AA9DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  art/sounds/radio/RadioPrep.bat
- Size 202B
- SHA256 01002da1c10b46ae0410e99dd5921a29ba1fe21fd477de94ea85e8b8749a6bdf
- MD5 5a2224187d3d01aec7f06b8a17f9ef16
- SHA1 337c3ad0276b438e4b4b3c5100301490ec2fdddc
- SHA512 468c739b77fdfcba6e7594f15b46dfb2e3d9d0eefc67506d768db5a380d3fafce039610ff04ccb9dcac728b168ad7ebf87497a3fa1d0b63be5b31e126bbff7b4
- TLSH
  T1A5D0230D0236768530C38DF710C5D574441B0242A903854D7130637B7F4D3ACD793AC1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  art/sounds/radio/RadioPrep.ps1
- Size 19KB
- SHA256 9d9c16e33b1719f5c1e6f79e5132597bebaa87c5cc86b4ae9e330220c5ca105c
- MD5 2783fecc468557e1515d54bb14503e1a
- SHA1 99c972a587f12548df301d21811b0851685bc187
- SHA512 f4565420317ad9bf7bec347d32b2ad3590d2448a1502d3730e2b25caad5f2efa200c5851cbce391aac8ba2a0a38a9484bf928c1eb7daf5b6243d94f01f050d17
- SSDEEP 192:FR9P9otPNLg7KxZ8i1dUK17bjcsrjU1vsizUIUUOMSbXZ8da6cwW+HZ9Zv4cxxrl:dPINMOt2hOM/alwhHvPxxUqhe+GTwa2
- TLSH
  T1F4920129DD09051F1AF383AF6901551CFEC6022F819859C0F59CA4D47FFA32E86A9DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  art/sounds/radio/divide-ogg.py
- Size 1KB
- SHA256 762521980251ace9c98b0811af1dc5c3c246c60f90baa46337cc4445ddc8d2b6
- MD5 87e33824bfbe3feabd6b94f82c21baed
- SHA1 19f15bf1c9dda5e57c53ab1cf568a5b9a8fdf4f2
- SHA512 2eb6072fb0c0b409759da2de9492fa4e564fbaada5cb9716270464958dc1c335159e598b8bd0a6f661273a9a03cc492bd4fb5598ba6346fe080a4c6bb1dd5516
- TLSH
  T1FC31CDD79D1E010042F753A0BB440C8FEB68A7AB67732C2575ED5C406B3D2B0A39216C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  art/sounds/radio/sox/libflac-8.dll
- Size 277KB
- SHA256 2c154aeaad085e01361b967adfec84b63db76a82a45681b3e6cdfacb6088e369
- MD5 10f9aa4d91b6f04397768263dd6afbfd
- SHA1 530a410f6eb97b1a1b03f5ab71f580348c56ed0f
- SHA512 12d2a2486a26c57059b36750a5b8796701624ca56997b24dbd942ae783a6ad69df33fdbd5bb87fc1bd33998a0d586b8d39b9b652c16bb6c94650dd60fa4c4a11
- SSDEEP 6144:S3ba7qSdbpw769foARg2eKamfKdssRhkvhxsmcmdqMRREaeHWRNIinwgOna4:p7qSBpw769foWg2eKamfKOvhxsmcaqMQ
- TLSH
  T118543B89EFC718F6F8A71576A157FBBF9A2C83015028C97AD798EA5CEC13B16710D204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  art/sounds/radio/sox/libgcc_s_sjlj-1.dll
- Size 463KB
- SHA256 2af381dbd5ea1a9a150307b1cba3a150321a3c3ff09fb6ead9bba1e880e03a64
- MD5 d9aff72a4665ab1b08022eeed5c1bc7e
- SHA1 38e93179517d6f2b742a61054600e402e8efed13
- SHA512 a60125a04315bf432dbb62fa103a7bb58d76476332271181ab0a79dcd5625df6eee6e8964361575bc8d664a0604a5fb9ef2266c2deb7ae590b5636346c55ebfb
- SSDEEP 3072:uyCsuUOPs0Q+2zsByZAefDkVqQNc1Km1Vm5nzGMG3mbW8RV3XGIVDazoc:5PYQdnAscc1Km1Vm5nzG/mbpRV3XGlEc
- TLSH
  T10CA45B85FFCAE8A7D91701750DFA43161738E64456C6DB9BBF08A73C6C033626EE4688
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  art/sounds/radio/sox/libgomp-1.dll
- Size 414KB
- SHA256 9dbbb0cb3f31ded7fbf51141a39578c0bc5cc85b83e9b6908657a6083948b9ba
- MD5 5dfd5da5cd787b292ff5667ed42557e5
- SHA1 435d4e7672638308f2af58519b75280adbc7b335
- SHA512 7e5625feb62c40fc8110e7b58616903036dd28bf6aad5270ad1d3945f22ccd9e03ea7e48262590f1308e6eb60b420323855eb7374912de0ff2b3094e12354c6a
- SSDEEP 6144:JXoVJ6/+T5ZHLjyIRl1KUQIHUTRu/YjOJ9wmruiVJtJbzcikE7suYux7nwqlM:JYVJcu5hpE1OIMPzcQzwqlM
- TLSH
  T1C8946DE5BB908D97F4520BB70EEF63120377D5458B4EBF23AA21913C5C3A2DB6746809
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  art/sounds/radio/sox/libid3tag-0.dll
- Size 71KB
- SHA256 4ec8e74cdd48a388a41f7f3ab2cea810a1661f47e79b6338192f000341f20af0
- MD5 4d1cbcba47fd965b02605c11a57e649b
- SHA1 a2eca0e01b1e8dde243aea9fcaa56ec03d539b62
- SHA512 7c0b5fb82ffd9c1f1affb6ce4c7fbbe3f79908c810c5fb118f80366128830feb7af7e408cb85eb35a086d756231ea64b7a08547a9f33f59623db1f739f40ed4d
- SSDEEP 768:Q4ujvdNY51bu1tPCKKKEonUb8o/I8BGfHwpd1LV/BEOUiiUfeVlFjklIJ9rX7WiQ:Q4PYCK7nYFEIv1dWgWW4IIvw
- TLSH
  T133734B1AB3914076C587277346A7A5BBB638AB02C9F0AF4DCE583D65F739310A874327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  art/sounds/radio/sox/libogg-0.dll
- Size 26KB
- SHA256 3262325b43b6f249831cc15428372a6daa34cf2459e66ed047dbbd9f00f49378
- MD5 d4eae0f7d6cfa23f8b409cc7df4e7673
- SHA1 5d8ba81ebe560c424b4e5082c25a567d2979871a
- SHA512 2d96d7522b953ad688233bd324a0669ee5d5f31a474e57c10a5f1899acf7a591b468a84e4c4248bd6fac77c9f4c015c2a45918192a36c6520a382f66b4871bbf
- SSDEEP 384:ho39x1kbS5eGtPuDZ4Wz6o1MIqMFJB28wRD6pEJdHPq7aZrD:m7tmd4Wz2IXFaJ1hq+
- TLSH
  T154C23C157B8788F7C8C31BB1A6ABEBFE63EA4601CC158671D374E6946EB32E26110D14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  art/sounds/radio/sox/libpng16-16.dll
- Size 206KB
- SHA256 22d46adb7927690eeeb1a27f9544108f7a1c66bf1daec90f3c41aa36e176920d
- MD5 d1e30ccfc7765882364c47b770a06ac6
- SHA1 52f566222a728e521c875e2e2fc40cb4acc753dd
- SHA512 a330887b5fb55afca78ded90ffd9b438e81054f68787be3e1be9b0d778da3fdffe8b1902bd92316229e1fd25c83f30d74af9677eb0a0f9a39779d0c162c9ac6e
- SSDEEP 3072:0505q6hoAllEoZY/eViXivi5UmwJT+WSeuAgN6UwLXUSmPNU:5srAlKWY2V4ivdmCT+ze7CeLXQO
- TLSH
  T147246BC6FA8B5DF2E88749706053FBFF4B314B119439CEB5CAD8EA48ED63B656108244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  art/sounds/radio/sox/libsox-3.dll
- Size 2.2MB
- SHA256 240a7e47a4274908786220f1b92372ed1b5f2a1c29874292fad5e64f120d84b4
- MD5 acdb7f5ecee425f091dd55bd90f2911c
- SHA1 c6e51a936b699ee3c5c9fc966fd90041ddb88e46
- SHA512 4ef00d74cffe0738041b1ebdb994fa05611c4a8e7cef7da2d8a5a1271d50e455e10cae00b76c4d53f55c06adfbe5330b584d4c1309aadb0d0c3b8b46503d0f17
- SSDEEP 24576:OjWwy1Ms9E+L21vTrmH5KcxVp3paEs83/igAPmv39hb4tn/5OtAuJ9VXynZ1w:Oj3ynXmvTrqn7pds8KgAPmv9h2uFOZ1w
- TLSH
  T15AB57DC9F7858D87E736137748D7832E0338CF04AD82DB475E64A6BA69567B02E41B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  art/sounds/radio/sox/libssp-0.dll
- Size 71KB
- SHA256 113da78ba0514b3947e0988376002c4d5f783d62d5058f99259771648f2e9138
- MD5 7aed7006f99df1e8600c7db5c55ae9bf
- SHA1 5597b9a29d0924daf6b9fdb14d135e3b69cc0d9c
- SHA512 e66da643e1d3c06dd9a632a5c837673d428c7a8fd8eb1b7d8e9880d36da23826325029ce8ac1e1e4cd14c26949b0354924d81d2bd0d07e27637d7f8e5ca2eff8
- SSDEEP 768:6KHYON3FjuCuFjPKVORtw/E+rKp7xpKSXyIrrI0txvl+OZk:6WYO3FGK0twZrKpOUyIr9k
- TLSH
  T10873F9D5BAE99EB3E956037E0AE78321133CF6D48BC38B075E70A9381B036D17AD5506
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  art/sounds/radio/sox/libvorbis-0.dll
- Size 167KB
- SHA256 03ae1625a47c1255d70e7d63ee42ef2483c7e2adc9a33d21f45799f323a530b4
- MD5 9ef9fb453937b09e14f17bb52aef865b
- SHA1 42b4309c0f701e1354a131f9c76ef1abac10ba49
- SHA512 4f1c5990ec9c57b87d8141044972ee17a442fa38899af4c38fa046e15e37502188982f8dbfd6e378d3ce4840b208c3c2faa77a8ff4919c3f2a70d15071fd6567
- SSDEEP 3072:oDMcZY5X3bUzPZrFB17qcIRm1lT29I9Rtv:kMlbUzPFFHLZCQRh
- TLSH
  T123F38D86D987A0FFC8D70AB05157B6BFD9211B1D8624CC73EF286AF4ED62F516D08604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  art/sounds/radio/sox/libvorbisenc-2.dll
- Size 554KB
- SHA256 3b809daf958b6dedeedbe05e91a0ac016b18c871b33dc98c728f8b3440874385
- MD5 5a6f5865ff89e3efccc6c75f74c0c57e
- SHA1 432c99bebe1643a5d0a89fff53771ce24b439883
- SHA512 d2c4501a79e823972dae623208f02dabf826428bdc6baed715a398c30d849081add9cbd33699eaa933d9a4060043a1a5cc127fc7f8d0625f6eff0bf709cdf1b8
- SSDEEP 6144:ifUuNruVRJ/RbM4YkuYFSqqKpx5AmhTc1eqVRchmQ69gKutRJhuusoAu3FsYpX8L:ikz8qlpx5ACTcQyRchpJdjCBf
- TLSH
  T12AC40E23F692ADA3D7E512364191D5301622BCBCC7E312F73CC4B6BDB9E62445B1AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  art/sounds/radio/sox/libvorbisfile-3.dll
- Size 37KB
- SHA256 1a14d8b0749f66811dacb23b093d54d4ff88036d49fd017b0d98b21de7f9ef1d
- MD5 8addbf28b6aae0853df3638b1079a6b9
- SHA1 563fa0404251fdbadaac06085866c62813d384ad
- SHA512 de5434497a226543f294485b4c8a011ebbaa5c4d1a2aa6e5aca330e40540de63866072b7c8c3de7dca5c55b204fe30210cbed758c3ab6bcb76fc8bdfc70c0f83
- SSDEEP 768:d5xfETL26sT6/tFCUKvsG6Fo/wmAY1yxKnk:d5xc3++/tFVrdwk
- TLSH
  T127035B5AE9CBD8F7E4DB163895C3FB7FB63241018A31C822D764E8A4EF72F516115209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32