3f70f4a53126007adf2decbd000bd7148ffc7e27f748016f2a80223b02e82590

Sharing

Copy URL Twitter E-mail

General

Target
Nouveau Archive WinRAR ZIP.zip
Size 21.0MB
Sample260704-1p7gfaev2v
SHA256 3f70f4a53126007adf2decbd000bd7148ffc7e27f748016f2a80223b02e82590
MD5 bad1d8c1866701320d82a77d132e5b6d
SHA1 026db5207dd7364bee15344daff2a434a7fe1702
SHA512 3953962c89b58b31aa1da118350f09cbff293a60c85e4462ebff5c0aa51e264ab15e3318dd6399b647785601a487b016943251a8c146e3f6c375e408dbec2fa1
SSDEEP 393216:qNy0SoneYX/zM7LdOqXS54NqFFjW9Ow3hXm/+0gEr5Ao1oMHkJjSjvl+8WN97pEL:qNKoneYX/zM7xdEFjW9OwRXmjgY5aMEc
TLSH
T1472733FE767886C420014EAFCD9A1145267314279FE6D6300B562325B9CF4EF3FBAA46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  keyauth.exe
- Size 9.8MB
- SHA256 460d55eaa129342bf825e769a0324052a6bac283084748080b8b8166c5311b52
- MD5 9b758eb1e810297986629eb264467c31
- SHA1 f4222a8a9d2b4c2392c794bb8c7070803e54a01f
- SHA512 160ac8c7ecb4d30648f54605695d01920d2aee08413982bb78bfab39e74ff7daf2f437863669529c950f3c56093c29601eaa54a43d16d09abfab9bf9f6529d37
- SSDEEP 98304:qHKUvqO7xDWVdkybPAXzd6PIcs/omEM6Zo0sNFkhd+KpcJkqBBpvvd:qXvjWHPIHoA5KdFcJkep3d
- TLSH
  T16AA68C02FD8B95FAE5432A3181A7627F23345D054B25CBDBEB507A2AFCB76E15832305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery spyware trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  x64/DeviceNameResolver.dll
- Size 74KB
- SHA256 c6702029a705fb5db2775f31331b8314566dd84d9702b0c6ff513515c160629c
- MD5 1a4a1e71f2e948608ba80e901bb2b969
- SHA1 6dbd88b0dd59ea30647ccda1830d33d454044990
- SHA512 a285f2ae8d9021da5c2e05ecef5b62945e442cf62c234fb748a8644f77d55462b129c6583e290cc6e7aa43055509c9d75f6eafa2a76bdd324fac1d8b5a07ee8a
- SSDEEP 1536:TZBMWi6zZbz0eZdTQIijtFe4TPRmoXuXOqH1NIEk672iD3:TZBc6t/VZdTfixw4TPRXuXOqVNIEk22c
- TLSH
  T178736C5A33A800B5E5679239C8E38E17E7B2F48663B552CF5378429E5F633C15A39332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  x64/GleeBug/TitanEngine.dll
- Size 664KB
- SHA256 cf8411f917321dbc5cd1a78b7a417fc3e8c33016cd58a80839fa270d6eb3455b
- MD5 14676747c857c61d4bba6258384b8a8a
- SHA1 a870454776c6a01986345f37f9f2ab103597c173
- SHA512 df8dea8793cc02e28ff4253a6de33497a4d961ef8ed44c02b0e88772c3cdd593f40fa0721f4c3aa4c2dded53399534ab019467325d112b4a40d22bb7deebfab1
- SSDEEP 6144:O0s0ivCE/EJeT+67DgiRrCQrrtkvIwTmcO2uBoHWkkvB6M79ptdYHOycMyfZE6HL:dc7DNrprrtk4cluBDkkv57wdQZdafpV0
- TLSH
  T1DFE40A73DF447C67E431903A49A3077763B6A48347528297269C2A2D5EC3B981F32F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  x64/LLVMDemangle.dll
- Size 593KB
- SHA256 8de391f11ceeafa007badf71b62560368f8c71623486ff1c2e4c5373fe482834
- MD5 1228e59df447f4e6476546ae24638071
- SHA1 7ec87e01e60f8f571684cc929fec414c224156e9
- SHA512 acccedd27f10123e9f572d868fe11cd5d600b4f1a45a9e38fc263dd4d75cde022eb0d3c74fc3700148b4cfba7146c45d4591cda5fcbef8814427980658975c60
- SSDEEP 12288:jo0iiwc1oIuS1jRPhvaIsUag9pbYggoFKQZELWpzizUqZX0aqlyT6kcrZ21ribar:niiwc1oIuS1jRPhvaIsUag9pbYggoFKj
- TLSH
  T1E1D45A2A77A40279E17BE13CDA934A64EA72B8450721A7CF13A453AB0F133E1573F725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  x64/Qt5Core.dll
- Size 5.7MB
- SHA256 ffe7dd4f3edbf6b87d1855c16b9f9c245cc3bbefb4d032537c5686699f91790c
- MD5 f598f1151f894dacdea21a47a214c209
- SHA1 b1ea19d9f361e1d4596abefb51df82601fa09b64
- SHA512 3c0ad8156248d25a1194c2c21e21886973855f9c681ef231129f5fce73012a2787ba3161cdd3559991d86894bbbed11449bac56d5e676346802bcd03c69decd1
- SSDEEP 98304:fys+BX0av+ePwBluJsv6tWKFdu9CtuS74iYRrqfC:fys+X0g+dBkJsv6tWKFdu9Ctv7irqfC
- TLSH
  T124567B57BBA60161D0B6C23CC9EB9252F6B2B8014B328ADF1259574A5F377F1293F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  x64/Qt5Gui.dll
- Size 6.2MB
- SHA256 90b1a7c47965eafcc896b99e9520198c097f60975b74884f1c2bc91a5ce88160
- MD5 1273c387e80db82ee6a96ac4788da8f7
- SHA1 d0ba5c2c54e535254fb1ac5866c32b4c1398e045
- SHA512 3356e4da246a05aaa959002463835afc4154077e112acde6531b78bcaf32272f1d81d8b8aa8407d31bee48b1f439b57427874660386147729749efe790a2ada2
- SSDEEP 49152:5kWYsqgxdm7x1Kbjjivl7TlsXufGRobtYdbbjEanzdmt96UUJHRorIeof9oWnx1n:5kWYsqgxDT/EUmt9godWmqS5W19
- TLSH
  T1D2661786725A6252C977E27E874F052EE1F3B85283428BC758158B580F737EA1B7FE01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  x64/Qt5Svg.dll
- Size 336KB
- SHA256 c795950ce4a2c34a0973738376118fb2172af588430d5eb8527dd6f0d4ca3d1f
- MD5 9ada34c1b3c0165abee9a3194c543e35
- SHA1 c7343fb2d1d13852084f5831b3c63c71ffa9cf3e
- SHA512 ff13346545b9eb2bdfd77869f27a826a5214fda723eef3c8f9f8151fd6a7f57773ae185d12bbc91278ca9ce24d40dc97e703f5febdc6d8564197d7fff17a977d
- SSDEEP 6144:zb8AzZwHpj1RN3NA2rJFLfYwHNV9Q6+SzGKioWKom7hE45PqbKtBj:f8AzEpB3L3Lf1v
- TLSH
  T15B743B87F3520986E56BD23CC9478912E6B3745043A3DBDF02268A5A3F237E27A7D750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  x64/Qt5Widgets.dll
- Size 5.3MB
- SHA256 9e38324e796eb66200498dbfdcda8ac92f92155a9accdc6c97f92f475ea4c8c2
- MD5 91439f0387898388cb1a3150c5848d73
- SHA1 d57b3c8bb6ae88f98add39890c9a8c3fdc2a0f55
- SHA512 8a282440d5b2ba67ef4d9f490c0ef93946b60351b4019cb247eac67da92398b55745f6325fe6ab7f62088132614cc9f6332726e532e692f0b709bdcaa3999bac
- SSDEEP 49152:oBk7r12r8CgPfdo+553iwKF0d+IUXzj6S8SdnDpme3wfv2IBXGexos0UGDrGGSJj:X7r12lUKiChSZ0UGDrGGSDO97y
- TLSH
  T149465A97B3A50185C16BC23CCE8B8A17D6B270044B628BDF156ACF592F737E12A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  x64/Qt5WinExtras.dll
- Size 461KB
- SHA256 8891576fb796b8dffa2a02010c7c9977e58e81c767d17bd3e06fd661ddbe0704
- MD5 bc7436a052aa48ce4239219f7e36e912
- SHA1 51b101b4789d91248b9dbf9b90b366fa685db791
- SHA512 7fcbff1233ea13469257ef81a8faa83b86531387c181f9af2f1515251b98d605a04d2ed71c83c775836012466f55a9f0dbced51d8df0569958f10d5ca2dcf29c
- SSDEEP 6144:SvUlez2vhkRuk6MnDFczmjTEFUIGgvvqiKwsou9eyua:SvoJkRnlwFUdwM
- TLSH
  T182A4A8AF7BBD0129E208F8B44F989385D22735C9771242DB13A682EB4F3B9C5157A770
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  x64/Scylla.dll
- Size 539KB
- SHA256 3a8d0d90b6f1e8e4ccb6c3c84e1755f07775562f4272177eb67ac2f0722af5fa
- MD5 38df08027d57f1615818ba8028e27706
- SHA1 4c261d447e6b6447ecf1077896c19fb7506a3c60
- SHA512 f31580f6074b3154f29a3625a23629ac91ade04aa1f4efdae608bfced988c7cf078ed0504372248f8762a7aa9bd821b4ad4a245cbb41c226862dfc64d805d94a
- SSDEEP 6144:Yfo6NZmPPlRY9E22D5ubY2Es19Dof77jYXTjKJDslXEn52IbDbaFB1eOkER7qHWV:YwZlR122D6t1loceeIbfacOfm2D
- TLSH
  T1AEC47C1A33E444A9E077C13C8A63CA52E7B278550B71D7CF16A4D67E2F23BE05A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  x64/StaticEngine/TitanEngine.dll
- Size 559KB
- SHA256 7e9f634f6fd1a50b3aa4879b3bb13bf496094ff830744ca7cb86879c42816d8c
- MD5 ed8fcaf840ccbef594d523efefa69ffe
- SHA1 87245460c3abbbc61b0ee8f414be10b5eba80587
- SHA512 c0f51b709d817ac2a0c521ba722dea06e9aa1accc41c539ef1b1d9d2e5da1e8b626f12ed1194f5dc058b41e55cd0a7637c607b012295a860c35127fba8012c97
- SSDEEP 6144:o39iFNe7ZiD6rzErrwAearO2uBQHWkkvB6W79ptdYHOycMyfZE6H6bNwXa97zwmg:A7TrYrrwArluBbkkvX7wdQZdaJ/TEV7
- TLSH
  T1ACC4E773DF447C6BE43054398DA307772336949247638297265C2A2E9EC67981F22FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  x64/TitanEngine.dll
- Size 401KB
- SHA256 0f4f992b51218b4bca6a0a8aaf7d1044b56666634c9d62948a8e7873736200d0
- MD5 00b08ecb2b9722781137e2e46ea4a508
- SHA1 0006d992b3541b5972d3ad3bf2aed6f2f4d377ed
- SHA512 a5f77efc48205cfca9d3263437d6debc176c356ca8a168795dbd9c8da570465109b5a220407e361c552122da36b2ff83b4be355fed57ce185ff20d40803cd9fa
- SSDEEP 6144:BiqeDykJCv8McwZSZys6mj42G7VsOPxj9QeQjtHVy:oVNtbwZSoRuC9I1Vy
- TLSH
  T154947D2BE76954F8C56FD13C8B679627F6B2345C0310ABEB06704E566B13BE17A3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  x64/XEDParse.dll
- Size 1.4MB
- SHA256 7237ace651d8ae8e3285c9a0256bf34d50e7a4c9722ce016bbcf74e80c3071d6
- MD5 e9d2d4b4e5c2eaed37f9e27232339858
- SHA1 b6ef7424c927b788e5875198c690e96be1f23f99
- SHA512 5444f5516c74a96cd3152039469ea79f0e7d9262f21410a8e92593e4f870c2da3b8c67a4c85c742338ee6af582fc905ecb4f3704096dca3a791377e48aa1dd2a
- SSDEEP 24576:ZpoHrP3dUN26xvJ9TkdQbgbBO1uGaWAXIcbsYV1tM8o+gxUOKPClk:ntI1O8o+gxTi
- TLSH
  T1F765D549EEF2AE96C441C2B8948FDFA7FBB4A0050B15CB97029434F56D4279729BB334
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  x64/asmjit.dll
- Size 334KB
- SHA256 4b174ef05228587823cc30c6bd55a1103480b29669e17ada05992116bba22422
- MD5 baf567ca381569767db074abed613955
- SHA1 d658b01eaa2d9c66053459d18fd8ea6e891f8f06
- SHA512 ea93ed977ceca490603de76b1cb2b02402f5aa6e21b6c159ddb4ec012fe94a4f385ab6ad6b499ea542df69442698bc044f01db918400d659fe775b384f649609
- SSDEEP 6144:HgYMEBqboCFseFoK947UnTf+lOhyz7rdzyfXt2g:HgYM4qRSeLIUTcrVyF2g
- TLSH
  T1CB748C56BB945ABDC8A3C138CC978212D7F1B85A07328ADF27A446513F333D05A7E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  x64/dbghelp.dll
- Size 1.4MB
- SHA256 5dff20c99a370dc5cc37949c2d749b084d2d7af1c29758121cb0e16ee15034f0
- MD5 65ce67f745501049e0ca0f970e3d283f
- SHA1 dc2ee958785e5b5ec2da602daae2e86a37bc156f
- SHA512 4248bfa9797a248a450686ba5c35d09dad1a76c52f94f1eed374e2f40c379fe929ebeedcebb090422fb61f49b898bb05f4ab25455f8ad5214d4439961bbbb015
- SSDEEP 24576:Yp8iMrylctFcscX1ZxgCf0a+hGxSUwqK6Zq3OUkcgp0OaM:u8UzHXT0a+hGxSUs3OUVyr
- TLSH
  T128656C4362F801BAED7B823DC66A860BD7F23445272087DF266407AA7F13EE5593D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  x64/headless.exe
- Size 59KB
- SHA256 44ece2d8f81c1acbf4c85b45fe89e11875f0e1a0d2ba0c8c8c1a56bf85164268
- MD5 c83e1ab8f01053e5d4946f6907745dca
- SHA1 50039fd4db55b622e9bc396fb372f724bdd6bf61
- SHA512 be7c5a32b3f83104a5f0d97070bbfe3cb89e2d7d182946b6ea334d379e5bdf467580f962d76625228b25b4f995dbddf96275a47c645ee041263e33e0f64b09e7
- SSDEEP 768:zlPKuFC9RSBwnQ+Sesx+ikZeP15M2C9YOXERU5HzH6a:zVHCoUQ9e8+3Y0DU
- TLSH
  T11C432B6ADF5650BBE21DC974CB138805DE62BCDAC7E0A1CB97800ED60E75EE49F39601
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32