fa3c0d40eb3082e2fafabb24514bdc5fb8efb2242135e8075a4bad53476f8d09

Sharing

Copy URL Twitter E-mail

General

Target
full.zip
Size 185KB
Sample260703-xcfamsaz6k
SHA256 fa3c0d40eb3082e2fafabb24514bdc5fb8efb2242135e8075a4bad53476f8d09
MD5 a3a726e4288abad8e2f7e4eee8abb646
SHA1 04bdeaef9f16eee64b8854840398fb46b6520ecc
SHA512 b95f5734ace99d1079d5682222b7af749a1d9a0fc936b527f1eb7167805ddbef7a65f439d2dcb4d43a0abaf345823ce914003e07de6e42a28452c012ea264355
SSDEEP 3072:2JsuNK30CKNdRxtshTTewk5KIrXfu+PnE4jZMdtliBaduWqlkm:2JfNDCKNdRPaTenY+fE440BFVlkm
TLSH
T1480412BDE9CD44E1E0E771B8041F87A532479079AAA2CB3BEC1E48B5CF271C84725E56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  full.zip
- Size 185KB
- SHA256 fa3c0d40eb3082e2fafabb24514bdc5fb8efb2242135e8075a4bad53476f8d09
- MD5 a3a726e4288abad8e2f7e4eee8abb646
- SHA1 04bdeaef9f16eee64b8854840398fb46b6520ecc
- SHA512 b95f5734ace99d1079d5682222b7af749a1d9a0fc936b527f1eb7167805ddbef7a65f439d2dcb4d43a0abaf345823ce914003e07de6e42a28452c012ea264355
- SSDEEP 3072:2JsuNK30CKNdRxtshTTewk5KIrXfu+PnE4jZMdtliBaduWqlkm:2JfNDCKNdRPaTenY+fE440BFVlkm
- TLSH
  T1480412BDE9CD44E1E0E771B8041F87A532479079AAA2CB3BEC1E48B5CF271C84725E56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  .gitignore
- Size 190B
- SHA256 3e0330862a61f47e77c3d1558f95b665ab8dff5df0afb41051393c306d762f0f
- MD5 57d8c43a5a499e10396f64211d53b182
- SHA1 7142022ae60578bcc98934d4f6edd7a1110f4188
- SHA512 58951766a06f5c2c1ff51987b1f1274976bf83cced140ed86aaa3c02299565c774ece9bdc457490627a6ca8c826d04172884ca96ae8c73abb87933fc973d0f97
- TLSH
  T173C0122BA573551F3482160795229345F670CBF98B08806930A541607D4F4EB5797DC3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  CLA.md
- Size 2KB
- SHA256 ca1758fa99f971f6272d1419e56167321b5d17281596b8c9371a2fab02a309a3
- MD5 c41b92a0a4ece4e0b41019bac4a1c37e
- SHA1 932b25e408c24a132732c5cff14f9e5e56f5d39a
- SHA512 82c6256ca8624761535bd12e059c011498da7761a40945ecde8ad246386b356c4bcf76587460670622344f3d341beacd2df94c520395ea16b94b13e5a0ae6453
- TLSH
  T1E25101A9620FC3716FD702329A569DDAF12EE118355E253D70D8D04C324FAA0C77B65B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  CONTRIBUTING.md
- Size 1KB
- SHA256 489f93848f39530ddb7fc552ca4c9ca5101bf713af3baebeceb1304df93d7aa8
- MD5 8118e6b7bf1834b64d4a25fd754214fe
- SHA1 cb2e1e80126dad4edc9a65335d8c91fba16efbc0
- SHA512 a9bc0f6bbd41a1e52161b0c8acb04716674fc253755ca11d808900033eca28643261dfd95e50fafaeb25a090f560fa3388b491362bbad1241b7b19788185c40d
- TLSH
  T1B0212F5D540587B217E20C22DA078CEAF37FE15CE94F006A3445C26832FEF99C6BA11A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  LICENSE
- Size 33KB
- SHA256 79735a75d0274d2a5dcc240d11a0f81e34cfc3533939b7fce8e84e35a150a238
- MD5 ee6ab23e8f9fe16a4e3e31e3e6ffa40b
- SHA1 37447258393f4e065926df2da7a83ba122e6890b
- SHA512 af26dc15788dd7c890d5a6a2e425e509ef3d8adbc498bb54b29bf05a169355ed4034e39b3ae22ff375633923da0a3509ed524e77e923dd64d34cfa167533fdf9
- SSDEEP 768:SemCHXZJu/OGqdpKifHigEwnEoG8e8Y1F:SF4uUFfH7Eroje/
- TLSH
  T19EF2645FB34513B6028202526A4FA4CEF32D9079776A44A57869C15C23F3E3583BFAED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Main.ahk
- Size 8KB
- SHA256 a00f4894f6c699bd57644885ffc60a108236bd292d984116f3524d6f230b9013
- MD5 7ddd95943be10c77c1d423037a5a3c9a
- SHA1 e4a842f02ceab21c18fb0186f635b50884314d1c
- SHA512 8aa75d43c3a5570210b3ba3377877f0c058ccafff0ea2bf484f676bab11c53c20f1811b87d0cfbc4448742137c1b30c0cde481547ad6002f8781d2ed3c37d16e
- SSDEEP 192:KG54KlYKypzr/oMmEpd2jbnKH+sA6ozZY+:KbpfDoMmEpd2jbKHwt
- TLSH
  T1B402963BF25E03366072C26AAB1B608AE307D06B115B1914B98C75883F7435DC2FE9F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  NOTICE
- Size 1KB
- SHA256 46fbde377cb005b6f484178c1b6d4ad39055b04b3fddc79ad49869220c44405e
- MD5 7d654fdb49a8f37e976e8dc394e6a8dc
- SHA1 42c45f3d6c2f594e65243d8b1daf9652cb0eeb0c
- SHA512 d4f9189e131e077946e415387be39f9aaf319ce64e94aa8d0b69e5119a88e33f46039b1416452a3045f73279bfb923890b45b397d5bda599260dd04de28a9034
- TLSH
  T1BC21412F9E04933223A0C66A861799C7F329104C665F28947055C20C2AB1A298FFD2AB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  README.md
- Size 2KB
- SHA256 4a8209b38540417978a42cf00f3e6e155008693288163ba74fb6966a95f7a5a4
- MD5 61a1496cebf39508aa4c186520b470aa
- SHA1 a216b1e78d93d4ac2745c2ba70f21b7d5fef6928
- SHA512 d91ebf824e5b827894cd79e68c5fde5cf730ea3ff8d46c5a17b20c512f1cfa48d6e3cf19290d036019a59382e9fed80c3bf0334c049578c54e23c58130cadc63
- TLSH
  T1A051943F660B8332033056C7A65654E9D706A00AE0EF19DC70AAE38D3376295C36DADF
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  images/DiscordLogo.png
- Size 112KB
- SHA256 51388fa374938017e4cb818fd9a7acd6de68b1d56798986545d2e49cfabf8176
- MD5 7fc7ac037b60a97abb7cc57eab9c02b0
- SHA1 417b4d3f6b9844dc4d560e29bb7bc0c998f0e916
- SHA512 91f0f7a2211dede51f52df120cf5c06047ee403e8aa57de9015763428c4dca81bfc04aa6aa16f1c5e775387aad16278e8d46bd2613c0806716d145fb624f810a
- SSDEEP 1536:emUfSLe7SOzuhPkVm4vxCwjb/1EDlRJmhH4YSM9z4H2lXyJ4H:jUqLe7aP6mendEkhYYIWlimH
- TLSH
  T1A5B37BA8DD031CA7FE4040B6899B0F64FB910971C862A7074374F22D6D8B75B7F4B9A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  images/OpenMacro.png
- Size 6KB
- SHA256 72964a5442f1ea46612a4460c94a0196b6c609ba13e8ff85d9f2f3a771f29831
- MD5 24400dd63a8889c8a5e11a3529a4b0c7
- SHA1 0811213fd7979e9d39178971dd7708343c6b66aa
- SHA512 3b4ea43de20fed33bc2849c0a1d00f6c9b33cbe11b14a1c7818adfa06b80d9d9084ab16988fca3e93ea9e9a2ebc585f864fcb3fd9f33854340a7803826db1bc8
- SSDEEP 192:USe50m/YCrQUz/lmy9nRrItp0a4wZETH8EPyW:Thm/prpJmyBtIARwuH8EPv
- TLSH
  T1A4D11A820255B5DFCE3696F31CA45BA248F94D4871B63A1396C5A3001963E2D3F8A37B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  images/OpenMacroBlack.png
- Size 6KB
- SHA256 e7c3623c41b62e48718c11f1e833aa7b86d47e18e69ffc42b510f72b4ab9f55b
- MD5 ceec76c94c350ee46fa940890645984c
- SHA1 2aafc2184b921148dc6d21147f87185385e8aeb1
- SHA512 16e65b4b1c96a1c0a61edb34396ec52158620eed6cc2deb2ecd6fe9fb0615fa20d543292a1d3c672a2a451591abe3dd21d68a477553fbecdaa0dcd09cd0a25a7
- SSDEEP 192:USP6GT/wjEoNsLknyW+RGcIvTIqeJY3YW:TP6CwjEiyW+RGcI8LJY3YW
- TLSH
  T156E14B126152CCAAB5443FB70AF5D4CF5C4F68891D8C730FE0E1E6648A1A117C398D7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  library/Discord/DiscordBuilder.ahk
- Size 9KB
- SHA256 48c9567596a89449f832236011d5d18e69ab9b60861fedbf9bbe81cc2c6252cd
- MD5 55e7fc3a70e50ad07aad60b5f622fd0f
- SHA1 fe9d9d8a8958fdb66577903f72ca4f2a5c9aac08
- SHA512 025327561c34bc3e16b4a4684362c19398bac3fde7b3848541147f0b61b7cbd1b09a928e9f355f1556c15e4d1063f9383f648509e1e6148c08786d0254d98aff
- SSDEEP 192:FRmPifQlXVPM0lY+o1PjTsRHkztHl0i3Xun:FOiollPMtiHkztHlV3Xun
- TLSH
  T1691285265E85900285F3E3A5AD939002F73A712F6537C880BF4C45F89FBC7E16578EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  library/DiscordBuilderAHK-0.0.1.1/DiscordBuilder.ahk
- Size 9KB
- SHA256 0b5b5367c499809e67b06e92bfb8563ba0d57a7e9aa8ebd734695969848b0871
- MD5 2950b475005f5812548326798e08f1fc
- SHA1 0d8f52758943b6d4b8b64f22a2fef308f7c38592
- SHA512 3585007ab07cd7249c83f7b748f6c9ba4798506428079756220e0f6cfb6912acf1397772997b544e0e87f01679daef05e33f6c87a742614eb4387d28f8ef5882
- SSDEEP 192:gRmPifQlXVPM0lY+o1PjTsRHkztHl0i3Xun:gOiollPMtiHkztHlV3Xun
- TLSH
  T1802273225D859C0285B3E3A5AD9390C2F73A612F6537C480BE4C75F89FBC3A15078EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  library/JSON.ahk
- Size 7KB
- SHA256 213b68cdc1763330f1b1f1eea9af128d61f6b478f6aba67927e5f2c6e967e31d
- MD5 9a87184612ee8efe456940d8077c72ad
- SHA1 1d99142a6d3a57c46db9b410afdc1f6c324b4e74
- SHA512 4724ee52793bdf1137ce7455a4a2b64a84439e8cf8dc6bc1c3d65373f90bbadce42466b87819f38aeeac6ffe4222a20fa7de0e90d891abc6e43d8a9be90b9e82
- SSDEEP 96:puPULN6JsTyQMK25E0mrv+WQTQsSnikA+6yY3YHz1VWDcaDhaLZI:lLU2TyQMKjdrdvsSnK+hYK78haLZI
- TLSH
  T122F1C761FA0D4D9F455292D2A47444C4C66EF9B9D234A2CAF1A476FCB40C833C2FCB96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  settings/offsets.json
- Size 28KB
- SHA256 650e30ca3e2132ae9ea7dde4f469434123306b615585f13a00c314428fad270b
- MD5 e906bbff8fa61bead956250f25938bb2
- SHA1 1bb7fb58b6d463cc6708464964367abe69b0f6e2
- SHA512 06826edad4e73eb5ace74e4ff5ab5a5458ae5acc697c398bf9fb991d4506ccfd8166bb18a026e283b125ef7d73b7b451d16740f3be0029691169560d25fbafd9
- SSDEEP 192:bkxy+Ek5Q8/Thwws5ex6kUYfDi3TWFlZ5ZTGwJky7jypi4uZiwAMkOTj3:bW3/Zs5qUQDeTWJeam/uf
- TLSH
  T109D2991ACA615DA82DBF6295287D0B07E220536360157EAF35BC088C4F7BF3601CBA5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  shared/Appraise.ahk
- Size 14KB
- SHA256 5871e343ffd268b50d18014af57b14281a469f7baa9176bf0c46680b664a6696
- MD5 db5e07757aae22e8546e2536f79af307
- SHA1 10b206dda0d9bbb0788e3475072927a368192162
- SHA512 61e845c9ad225cfefad3909a0656794bf2319cc03460c00fbea5861e0c95414dc50f9070602015deb12968c5c98ee60c619bd15b5374ce4747f67b6a0b0a02b7
- SSDEEP 384:KbdldcsyGPEdIBgMJlWfBCRfC8YPz7P8nO8tHUjw:Ky8rFn4w
- TLSH
  T1B9525065BB463457583BAE7EDD77A205EE109453163B3D40B89C00D93F3672382E9EAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32