Overview

overview

8

Static

static

3

ByGoneSpoo...64.exe

windows10-2004-x64

1

ByGoneSpoo...64.exe

windows11-ltsc_2024-x64

1

ByGoneSpoo...fer.py

windows10-2004-x64

3

ByGoneSpoo...fer.py

windows11-ltsc_2024-x64

8

ByGoneSpoo...64.sys

windows10-2004-x64

1

ByGoneSpoo...64.sys

windows11-ltsc_2024-x64

6

ByGoneSpoo...64.sys

windows10-2004-x64

1

ByGoneSpoo...xer.py

windows10-2004-x64

3

ByGoneSpoo...xer.py

windows11-ltsc_2024-x64

3

ByGoneSpoo...er.bat

windows10-2004-x64

1

ByGoneSpoo...er.bat

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    ByGoneSpoofer-main.zip
  • Size 189KB
  • Sample260704-ewwsmae18l
  • SHA256 a162f16757f958be103d6d9615ad677e52e4ee459010d55ce29eb9a12ca572be
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Targets

    • Target
      ByGoneSpoofer-main/AMIDEWINx64.EXE
    • Size 377KB
    • SHA256 2c67fb6eb81630c917f08295e4ff3b5f777cb41b26f7b09dc36d79f089e61bc4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      ByGoneSpoofer-main/ByGoneSpoofer.py
    • Size 80KB
    • SHA256 026086a8ed83b02e94d833da3e36f3bc09056c0fb6b312b794e086dadb19fd6f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      ByGoneSpoofer-main/amifldrv64.sys
    • Size 28KB
    • SHA256 20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral5behavioral6
    • Target
      ByGoneSpoofer-main/amigendrv64.sys
    • Size 33KB
    • SHA256 38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      ByGoneSpoofer-main/scripts/bygone_webview2_fixer.py
    • Size 7KB
    • SHA256 de947687e416599ee238d12c98bb2368fe746ffa10e5d6f38b83987e7e368c02
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral8behavioral9
    • Target
      ByGoneSpoofer-main/scripts/compile_bygone_spoofer.bat
    • Size 5KB
    • SHA256 5d0c87a77372ff13868c706c4cd6ef3c528f65d8ad45cbfc5d48623b160f2be9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral11

MITRE ATT&CK Enterprise v16

Tasks