44b38a0cd590ada2d96dcf98b6a88d3c17997cac574ab9e68b9f33c6f985dec4

Sharing

Copy URL Twitter E-mail

General

Target
t2.zip
Size 20.9MB
Sample260705-alqfmsft41
SHA256 44b38a0cd590ada2d96dcf98b6a88d3c17997cac574ab9e68b9f33c6f985dec4
MD5 c659f9738716c5bf75ac51bd97923958
SHA1 85514df309cb0a7a799a72bab7a6f01448f2ab91
SHA512 f4986383f160cc646aae637d6bbdbd3cb020c1f163e829df5745ce1048aa05e77d08d3479653afa694f3ccb4ec91172e5dd0cdd7efafcc74dabf7e6ab80ebd9d
SSDEEP 393216:AHJbQLxxGXHqBdAmGusLm6u+vV9r1BPWCpFD8uXd8G0wim6Cm2lKqEI575UKV5Ew:AHJbQL6HqMSam6XV95BFZ8Md8zwC2wq9
TLSH
T177273343C20B03A6DA4BBF3532DB013BA968E22C7576918F3F5593D02CD16D66E13E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  DLLs/_asyncio.pyd
- Size 69KB
- SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
- MD5 90a38a8271379a371a2a4c580e9cd97d
- SHA1 3fde48214fd606114d7df72921cf66ef84bc04c5
- SHA512 3bde0b274f959d201f7820e3c01896c24e4909348c0bc748ade68610a13a4d1e980c50dab33466469cdd19eb90915b45593faab6c3609ae3f616951089de1fdc
- SSDEEP 1536:5VrJQiOU7v3gWTgI9PBgT5NIMOn27SyBxEU:55JQiOU7/g8L9PBSNIMOn2CU
- TLSH
  T191638E83E3E0459ADD57A178D4632F56EBB1F2420A00479F52A8C18F2F7379252FE726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DLLs/_bz2.pyd
- Size 83KB
- SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
- MD5 30f396f8411274f15ac85b14b7b3cd3d
- SHA1 d3921f39e193d89aa93c2677cbfb47bc1ede949c
- SHA512 7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
- SSDEEP 1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
- TLSH
  T1CE839E92E3956AF5F41F81B956C10367E771B945075083EFF348C2592F03B426EAC36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DLLs/_ctypes.pyd
- Size 122KB
- SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
- MD5 5377ab365c86bbcdd998580a79be28b4
- SHA1 b0a6342df76c4da5b1e28a036025e274be322b35
- SHA512 56f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26
- SSDEEP 3072:IXw32spTVYgFoj6N2xE9sb7V/f/E4ZBq5syCtYPU95IMLPhr:IgGEOgFoj68ksRf/ERsX
- TLSH
  T174C36C1B339400A9EBA34178C4B36E07D7F1B41B076197CF12A4C6992F637A76E6E316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DLLs/_ctypes_test.pyd
- Size 36KB
- SHA256 2d47c9496c7104e9d6611453c135e651a154d60a063121ca92efcfd4f17b7528
- MD5 6e6de51b23d8ec3ce52bca12b6f50ac2
- SHA1 6582172180cbd6d695030a5a060071e1a728e2f8
- SHA512 04ce68253749ba17cb3a733d518e7a345cd6ea76cac5c9f76e2938396b30c147dccc54e1d7453f654772b9756750224fc800930f8f67b21904a9a29efb3afe47
- SSDEEP 384:s9IgOXC2zEQZRAxrfJ4zfkCp6zUFIM6knHQIYiSy1pCQhghrAM+o/8E9VF0NybId:sygO1uJ4TrNFIM6kH5YiSyvSAMxkEad
- TLSH
  T1B7F29E43697D2C0CD937853D54EA991FE532B6832B61C3DB13A5829C0F227C53BB71AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  DLLs/_hashlib.pyd
- Size 64KB
- SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
- MD5 a25bc2b21b555293554d7f611eaa75ea
- SHA1 a0dfd4fcfae5b94d4471357f60569b0c18b30c17
- SHA512 b39767c2757c65500fc4f4289cb3825333d43cb659e3b95af4347bd2a277a7f25d18359cedbdde9a020c7ab57b736548c739909867ce9de1dbd3f638f4737dc5
- SSDEEP 1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
- TLSH
  T18F537E09A69544E8C96781B8C8A35F57FAF2F1511710A7DF0368C28D2F237C3A6BB752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  DLLs/_msi.pyd
- Size 44KB
- SHA256 5ff1216dff5a54111f46d3397dbb62709d95cea358292966f87180c0053ed407
- MD5 86d0296321aaf10416667f1802861ed2
- SHA1 adacbaa72eba0fa6b750adfe78b796ad6de73633
- SHA512 91e633e5b26dd218ada4542e9dd1d8a674c5eee777dc27833ea6feaa5fdc711109ff00a4e7b5b2b0854aba7837eb568ce208ce0c253b7000b199d4b7c55b9fed
- SSDEEP 768:JjO12AJvIskT9d2ErfPxoUAIZdeoLuM3mdYVoRnU5RJCuj7VIMCGGX5YiSyvBAMu:JjEuT2OfpmGVoRnsRhj7VIMCGGJ7Syxu
- TLSH
  T103138E4167480855EA2785B8C9938F39E635F192476083DF23F4C25E0F62BC3B6BE795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DLLs/_multiprocessing.pyd
- Size 34KB
- SHA256 2feb0bf9658634fe8405f17c4573feb1c300e9345d7965738bedeb871a939e6b
- MD5 41ee16713672e1bfc4543e6ae7588d72
- SHA1 5ff680727935169e7bcb3991404c68fe6b2e4209
- SHA512 cb407996a42bdf8bc47ce3f4c4485e27a4c862bf543410060e9f65d63bfba4c5a854a1f0601e9d8933c549e5459cb74ca27f3126c8cdbde0bdd2e803390ab942
- SSDEEP 768:I1Rp7eiajKCGnAxQ0zdu9IMWtg5YiSyvKDAMxkEp5u:gRteiaIAxQ0zI9IMWty7Syyjxto
- TLSH
  T19FF28D43A6641856D433CA75A8935F2AE571F7460B2187CF23A4C18E0F327427BFE75A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  DLLs/_overlapped.pyd
- Size 54KB
- SHA256 2187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
- MD5 737f46e8dac553427a823c5f0556961c
- SHA1 30796737caec891a5707b71cf0ad1072469dd9de
- SHA512 f0f4b9045d5328335dc5d779f7ef5ce322eaa8126ec14a84be73edd47efb165f59903bff95eb0661eba291b4bb71474dd0b0686edc132f2fba305c47bb3d019f
- SSDEEP 1536:5inr44gaZPXPCJ/+yZdDDrRIMXtH7SyNx7:5ZJ/+yZdDDrRIMXtHt
- TLSH
  T19E437B16679404D9ED37C17EE4A70E1BEBB0B1964650930F62A8C24A1F737837BAE3C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DLLs/_queue.pyd
- Size 31KB
- SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
- MD5 e1c6ff3c48d1ca755fb8a2ba700243b2
- SHA1 2f2d4c0f429b8a7144d65b179beab2d760396bfb
- SHA512 55bfd1a848f2a70a7a55626fb84086689f867a79f09726c825522d8530f4e83708eb7caa7f7869155d3ae48f3b6aa583b556f3971a2f3412626ae76680e83ca1
- SSDEEP 768:WlzRmezj6rGqMoW45IMQUHR5YiSyvMcAMxkEm2j:yRm0mGpoW45IMQUHf7SyVxb
- TLSH
  T1C6E2AE97BA540C5AC973C87594A25E25F972B3864701C3CF2229C24D2F327837BB97B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  DLLs/_sqlite3.pyd
- Size 122KB
- SHA256 fdeacc2aff71fe21d7a0de0603388299fa203c2692fdbdb3709f1bc4cc9cdc0e
- MD5 64417c2ccd84392880b417e8a9f7a4bc
- SHA1 88c6139471737b14d4161c010b10ad9615766dbb
- SHA512 05163d678f18ea901c5da45f41ee25073b7834e711c2809f98df122e6485b3979c5331709a6f48079a53931d3dbc3b569738b51736260ce1b67811c073c7ea84
- SSDEEP 3072:6WdTrLGXVx7Qt+HEGFCO4w5yirrPrrrrrrbEOyfgv/pWwb8NIMOQI3:zAVxMt7pC5TrWgHos8e
- TLSH
  T1F0C35B67235400AAE5B751B8C1630B17EBB5F822533093CF42A0C68A2F777C36E7A765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  DLLs/_ssl.pyd
- Size 174KB
- SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
- MD5 90f080c53a2b7e23a5efd5fd3806f352
- SHA1 e3b339533bc906688b4d885bdc29626fbb9df2fe
- SHA512 4b9b8899052c1e34675985088d39fe7c95bfd1bbce6fd5cbac8b1e61eda2fbb253eef21f8a5362ea624e8b1696f1e46c366835025aabcb7aa66c1e6709aab58a
- SSDEEP 3072:9EkiCZfBmvD1ZLnM2YfW6XSvWJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JVIMC7g:riC5QD1dwW6XSOMfjTwJH
- TLSH
  T18B046B03B5942EBBD813E4B9C1231913DBF1F015331257DE48D6D64A0F17B4AAEAAB63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  DLLs/_tkinter.pyd
- Size 64KB
- SHA256 f91d38d865378a120f76596c90e79f6ba57fcf3c39dedb99098e597d9b577256
- MD5 911d7552870c5d1ffa646326ab760d38
- SHA1 c6d90ef0540f16e0c0112801ff57325d676d2946
- SHA512 44fbba9cfe5ae64b440751145c7497588c19cc038838c9e046a328682f100d7f45bd9c914fb8e1d462cf105628767ed308bbc19cdbcc5b0afe74621bccc81d4d
- SSDEEP 1536:qGpS27sIvGJdk7Y4Y7S81CpnHcKWNIMOSg7Sy8HHxT:vpVp7jKSppnHcFNIMOSgiH5
- TLSH
  T18D536D6BA760008ACEA7C179C4B36F23D675B5520B10924F0294D35A2F337E3A7FA755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  DLLs/_uuid.pyd
- Size 25KB
- SHA256 8ae23bfa84ce64c3240c61bedb06172bfd76be2ad30788d4499cb24047fce09f
- MD5 d8c6d60ea44694015ba6123ff75bd38d
- SHA1 813deb632f3f3747fe39c5b8ef67bada91184f62
- SHA512 d3d408c79e291ed56ca3135b5043e555e53b70dff45964c8c8d7ffa92b27c6cdea1e717087b79159181f1258f9613fe6d05e3867d9c944f43a980b5bf27a75ab
- SSDEEP 384:maxIcRiAWVIMZwbTHQIYiSy1pCQm9Y+pAM+o/8E9VF0Ny7yYV:ScR3WVIMZwn5YiSyvXMAMxkE8YV
- TLSH
  T18FC26D56AA605C15DD178A7074E24A26EEB6B7814B50C3C72329C1990F723C37BEB3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  DLLs/_wmi.pyd
- Size 36KB
- SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
- MD5 827615eee937880862e2f26548b91e83
- SHA1 186346b816a9de1ba69e51042faf36f47d768b6c
- SHA512 45114caf2b4a7678e6b1e64d84b118fb3437232b4c0add345ddb6fbda87cebd7b5adad11899bdcd95ddfe83fdc3944a93674ca3d1b5f643a2963fbe709e44fb8
- SSDEEP 768:rUmqQhTcYr6NxO0VIMCit5YiSyv4YmAJAMxkEn:Im7GBNxO0VIMCiz7SyQYmQxz
- TLSH
  T106F27E67E7940895D937CDB9C8864E27E971B5825B11C3CF331482590F323C1AE7A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  DLLs/_zoneinfo.pyd
- Size 47KB
- SHA256 b39048436a2396927c982084f9f750905b2c95a0715a97f7f01ecbec85891899
- MD5 467246ec721a13e8b21d9270b3e7ccbc
- SHA1 4f9dca76fb5c810900819f6e7c9510c6b3a698fc
- SHA512 36dd9c8ac6d9b52976bb3e02e0801eaabed48e7b3dff22081aa23d11097302dd8216aa9e359719d49317dc887c0155b06ce79f2c01cdae1d0196305f56d8a072
- SSDEEP 768:1VhyHphBWnyMps2cCCedUEYPzU4I3NIM9XgY5YiSyvIJ5AMxkEF6:lepXbMphpCedUEYbU4ANIM9Xgq7SyQhy
- TLSH
  T1D2239E23A690149DDA23857AA5A7AE1AEA70B4411310C7CF2324C24E1F33BC367FE365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  DLLs/libcrypto-3.dll
- Size 5.0MB
- SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
- MD5 123ad0908c76ccba4789c084f7a6b8d0
- SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
- SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
- SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
- TLSH
  T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32