efb7189f61bec3eaee572307ec7340f54c051db2e8a5cec4d243b4b1c0ac44ab

Sharing

Copy URL Twitter E-mail

General

Target
RokuRemote-Windows.zip
Size 14.3MB
Sample260704-pglzzse151
SHA256 efb7189f61bec3eaee572307ec7340f54c051db2e8a5cec4d243b4b1c0ac44ab
MD5 dbb6152a26ab452db5027b47a81810f5
SHA1 2788fa62da0404a0cdbd304745f0e6f65333cb13
SHA512 605354cc4d4aff050eba754e12bbc8fabc4c75f611be960b7506e22ffa1cad138c7d29cb4dff5dcbd5e1a1e58b5c06d3d02ae49871c8a4b58fd2489f53283813
SSDEEP 393216:0jHM44N4+PIBMAaN60vK1tvBz5v/2b6S23cGeeUUul7alS1vsMK258t:GNp+PCg6j5vLS6c7xUuiS1tK2Ot
TLSH
T1F0E633A460E03B6BF98A54FD76F7A6407283632C5FD3642934020F7B5F9736A46A10ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  RokuRemote\RokuRemote.exe
- Size 3.3MB
- SHA256 82e4f6d1333035bc72970323a21ffd252fe65196f21752f83ccefb800837d237
- MD5 0a48619c05cabeb56a940e2e4fc029be
- SHA1 28d3fcca0463f7efce86b245fbf55179ade5654e
- SHA512 55313cb916d8e45e29bccf29ab4a210492bb9c4e01944e1722279519fd67981f3ce4ac0ebdd45b777625821482613137a47dcf5e7703e6ce28f9235cf04bee50
- SSDEEP 98304:PxKHsAVT5mD4aSeqbnbX+6EtODKXTVTkVZVIX2rmBE8BYIR7E3B:0HsAVlmDweqr9eDIVIXF+rE7E
- TLSH
  T1A6F52364A78515EAE8E3513D99B7C405E3B2B8201B72C6DF03549B792F332E0893EB75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  RokuRemote\_internal\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH
  T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  RokuRemote\_internal\_asyncio.pyd
- Size 76KB
- SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
- MD5 c2a29938ef6730c1418140a15e0cea86
- SHA1 e137c778526eb34068c0d85fd37d30b81773013b
- SHA512 3f5b212f005b944d872fd3e84a68d1de11809143312571d6540db9cb219c4e9f62137f90af77a81b7b342d8d1665c819b6738dce7a5be1e0d6a135564ae69043
- SSDEEP 768:J3yo/J0GKLIsPwpVnU+C4qMiOU1OnzM8nV6JQIjDnSSyYTegc2Ip4YTxf1ml6Z+o:VJyyUoCgQ8nVYQIjDnSSyYiS9kfILpm
- TLSH
  T1B5737C87A2A44186EEB79174CA536FC3FBB1F1859901935F51A4C18F1F533A18FBA322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  RokuRemote\_internal\_bz2.pyd
- Size 86KB
- SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
- MD5 28cea50945ec6972c8ec096bf562fb9e
- SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
- SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
- SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
- TLSH
  T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  RokuRemote\_internal\_cffi_backend.cp314-win_amd64.pyd
- Size 177KB
- SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
- MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
- SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
- SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
- SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
- TLSH
  T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  RokuRemote\_internal\_ctypes.pyd
- Size 139KB
- SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
- MD5 fdda26bd63d43178c9aca5003f6a7e42
- SHA1 48037f1f68aad29e1002573337d2357f8972d045
- SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
- SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
- TLSH
  T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  RokuRemote\_internal\_decimal.pyd
- Size 283KB
- SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
- MD5 bc63a4bb65d50f6de111deecd8de3457
- SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
- SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
- SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
- TLSH
  T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  RokuRemote\_internal\_elementtree.pyd
- Size 135KB
- SHA256 1f8259cc74aed52e4cd2de6cb1b54bec8b1725a84760c1c5b30ded49f652824a
- MD5 91c8c1d04114c6d0b5fb7a42bc4fc4c9
- SHA1 03e7682c4366b4dc99db5806595d0878f74b2630
- SHA512 ca9b3e1b982474180ed14484ef9b6076a48ac58c466e301b53e6d965d51988369b8317e62d6d698afcd93662378332eee38ae3db1911ff164555ecbcf3c87acf
- SSDEEP 3072:JQzJtOQ6oarG330lzIY15C5L+clBV417wpWKod/tIIjffZL:JQzb130l8cC5L+cw7OTozt
- TLSH
  T100D34B4B72A5C0ABE592403CA6979F93D7B7F8610E00838F5294F29D5F273417F6A329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  RokuRemote\_internal\_hashlib.pyd
- Size 67KB
- SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
- MD5 ff7c390260b2c94396abcc5323db052e
- SHA1 adc7babe127c3586c81f321ad20ff87785945795
- SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
- SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
- TLSH
  T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  RokuRemote\_internal\_lzma.pyd
- Size 157KB
- SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
- MD5 1f2c927c6f1773093e6939e0f0075997
- SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
- SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
- SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
- TLSH
  T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  RokuRemote\_internal\_multiprocessing.pyd
- Size 37KB
- SHA256 a8c15ee29f60536e00fd7c26c0315e062c4f018e2e46e7f6eb65c1fed0d886a4
- MD5 547b59dc1f6caef6706ca1129b5f9618
- SHA1 b990f779204ddebcc00ab926be6c17b462fb3a63
- SHA512 00f49b94a31b8dca6790845e0185b7f7cecb52fa99472bac523cc8ee4efb679585e3476c727e55b43f2b434ed12af51c41364113db89f0f98113be24ab2ab2a6
- SSDEEP 768:HFMV/fpXybycUlgIj7teyYTegc2Ip4u+Txf1mlIJ5pC/:HWpXybycKgIj7teyYiS9uefIk5S
- TLSH
  T1BD038C86A6684053E9639670C5A3EE87F935F7871F22865F3195C2CE0E373C1736A34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  RokuRemote\_internal\_overlapped.pyd
- Size 56KB
- SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
- MD5 c96e86f3868d0323c88700f0671d9f20
- SHA1 c8b9561fb80af89a67fbac11e103ef120dca4ce4
- SHA512 d6953e6e566236f2bd01e40de751e545b680607ad07c8c7f7b8ac621f4c1ed3a227ac14cc45e66e15a0a1f18083ee4aebbacb24b784ced35bd227173b6b41d16
- SSDEEP 1536:/sjKfS6rBgq/Wtg4urMp8IjCtDyYiS9ZfIklp:0tgxrMp8IjCtOK
- TLSH
  T1D6437B4A6B9401DBEE73D179D1A38E03FB74B2D34601931F61A8D28A1F23791A72F385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  RokuRemote\_internal\_queue.pyd
- Size 35KB
- SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
- MD5 8ac260b670f58c4d08ba0a7e5512133d
- SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
- SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
- SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
- TLSH
  T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  RokuRemote\_internal\_ssl.pyd
- Size 180KB
- SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
- MD5 b9acce051643c39e5ac4c36110388724
- SHA1 69f9743a13c57f699ce68270d915159aa812103b
- SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
- SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
- TLSH
  T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  RokuRemote\_internal\_zstd.pyd
- Size 491KB
- SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
- MD5 256a79eff7505cc58fbf59d863c5c543
- SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
- SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
- SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
- TLSH
  T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  RokuRemote\_internal\api-ms-win-core-console-l1-1-0.dll
- Size 21KB
- SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
- MD5 9f746f4f7d845f063fea3c37dcebc27c
- SHA1 24d00523770127a5705fcc2a165731723df36312
- SHA512 306952418b095e5cf139372a7e684062d05b2209e41d74798a20d7819efeb41d9a53dc864cb62cc927a98df45f7365f32b72ec9b17ba1aee63e2bf4e1d61a6e4
- SSDEEP 192:xt/cOTWthWfWJWadJCsVWQ4OWKNVAv+cQ0GX01k9z3A1tUXj:xpcgWthW2CsjNbZR9zOtUX
- TLSH
  T137A219D38EAC8546F8AB9D7046E8DA437C3E6BC71950615525F8F55C2CA33C1EB20B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  RokuRemote\_internal\api-ms-win-core-datetime-l1-1-0.dll
- Size 21KB
- SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
- MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
- SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
- SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
- SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
- TLSH
  T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32