f3d1600d4ff5650a7039ce81ddc9a686299b99d4363e06c1da004876c7e8a158

Sharing

Copy URL Twitter E-mail

General

Target
Divulge-Stealer-main.zip
Size 20.6MB
Sample260705-bym2qaf18x
SHA256 f3d1600d4ff5650a7039ce81ddc9a686299b99d4363e06c1da004876c7e8a158
MD5 9916a9f7834bb786ab1c8e4f3c846e25
SHA1 5ff3a92340274a491fbea77774a4219d79c276b1
SHA512 9436c112e8100e595228cebb833ac95cd5b3cda2ab3925fdfeae6964d39082bf4493068aef5e7d5be08a12f7f90748280e0be2c04ad8e349c0fa147a84dd24b2
SSDEEP 393216:EY2fgQr23K9sy8Z0sfT6jESICyjzwQY2DBON4a8YQlUDym:EfddmHTlSIhqoWn8YN
TLSH
T1132733058555CC8221E53F4F4DA46772436C382B91ADEF1B676313CCFAEA93258FA4E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Divulge-Stealer-main.zip
- Size 20.6MB
- SHA256 f3d1600d4ff5650a7039ce81ddc9a686299b99d4363e06c1da004876c7e8a158
- MD5 9916a9f7834bb786ab1c8e4f3c846e25
- SHA1 5ff3a92340274a491fbea77774a4219d79c276b1
- SHA512 9436c112e8100e595228cebb833ac95cd5b3cda2ab3925fdfeae6964d39082bf4493068aef5e7d5be08a12f7f90748280e0be2c04ad8e349c0fa147a84dd24b2
- SSDEEP 393216:EY2fgQr23K9sy8Z0sfT6jESICyjzwQY2DBON4a8YQlUDym:EfddmHTlSIhqoWn8YN
- TLSH
  T1132733058555CC8221E53F4F4DA46772436C382B91ADEF1B676313CCFAEA93258FA4E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Divulge-Stealer/Divulge.builder/Components/Build/Builder.cs
- Size 8KB
- SHA256 6d89bd6778ebd7d487f9dc2a14cbf551165bca1d25acc5f14473dcf018e86b7b
- MD5 f01e54aaf24e68e78718d98067051564
- SHA1 f91797b8b90dbb241d7585c230291b119f9067ed
- SHA512 51e1598e61d4bb70d0347b10630d336ecfa25f0c6bb5949505a4f21171192e32477454d380bab3ab0218abfed63784d1e377bbc5fd737ef0f9e33c0d9099d891
- SSDEEP 192:iDsWJH6g62rJSiy6U1yiYv6dfso+IrkiNsh68fXX51ACTqQ4BL:iAgH6ESeU6vFo+cshhfn5It
- TLSH
  T18112ED1BB677CD8908A74037EBFB60449B216197926AFC7A7C4DA040CF9479103F5AF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Divulge-Stealer/Divulge.builder/Components/Forms/AssemblyEditorForm.resx
- Size 13KB
- SHA256 c89e0eedaf2ab4e5bd1389a28f1cd0ac45fca28153c957fdbc09fd0a69815275
- MD5 0d6ee3d4fa32ff908d752d0c41428881
- SHA1 8b4d7aef0226fce11317e4dccef35a0adf7bbe64
- SHA512 bb159a63cbd7ac15c931529d9a08a81854c7681ba5880bbf306c62598df3054e64c17470a97e941c8abb3d2ea7b1f241d5156ac14ef5d27b3496b2902f6a5406
- SSDEEP 384:KjrbLPxsLvASvKgwyahFQawzYgwtok2PdI/ok2PLok2PdNok2P3Bok2Pbok3QnG9:KjXdskSv6IBPdIMPoPduP3SPFQnGbQup
- TLSH
  T1F452612471C1DD6507B74D78B2622A84FFB8921B2374AC5474DE761B8F3B8C17AA33A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Divulge-Stealer/Divulge.builder/Components/Forms/MainForm.cs
- Size 10KB
- SHA256 7c39dc17a03121b88e6ab33d246ecbb735f3f9207ef7a6e05a819fcb31e974c5
- MD5 69e71942d041092f3f23bcf2e7e81b44
- SHA1 244e321ebd957d73ab1a886633e3cc56bef1a254
- SHA512 11b93e14533c284790edff4fb32a8fbd4cfea662e3c0aba30a8561f1f08518642df6605e5f8d3727bc0e9111a43f83d138f66784374d1090ad5e47e39e4fb39d
- SSDEEP 192:9KrytGbeWaT1NSXeTIiM3fm/GsULz7XteoYwKQ/tJTts+7LqxW:9KrYGtk14O4m/8Xteon7tJTtbCg
- TLSH
  T1BB32422D52079A6948B39634EF435A9EFF56041B037269607ECD42A81F3046857F8FFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Divulge-Stealer/Divulge.builder/Components/Forms/MainForm.resx
- Size 19KB
- SHA256 df12185086a968392dc8657927cb3e9de3db978141ad6c1ff13e47e45a76d65b
- MD5 2d090538c0845bf28c04f64a322540ac
- SHA1 a8dca1ece94778d097ef0b99e4d04cd08732f0b9
- SHA512 e4937ac1af2d74792a3f42c8a9a880b3b152fcb3c74101d2394494647945280c064e4c31399872f75eb497501597449baf5fecb0ea5362c5c02276ebd5933f42
- SSDEEP 384:KjrbLPxsLvASvKgwyahFZIaw0g6Ygw1okJXClW6N6pokJXC0okJXCx6qzokJXC+F:KjXdskSv6jRwXClboFXCMXC8iXCTfXCh
- TLSH
  T17292762572C2AC2917F70C6DB3221AC4FEF4521722656C5478DE360B9F3B9C4ABA3365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Divulge-Stealer/Divulge.builder/Properties/Resources.Designer.cs
- Size 3KB
- SHA256 0009fdc443d370c3591f85ee61b55acc1831332274b599cd911dfe461f772b14
- MD5 1ee69ad849b142aee290e5674f5dc3b0
- SHA1 ec340bcb070a34309f2d03794d756129b7d353f4
- SHA512 58672a0127d1ed961d957d6a6965d13dfeff84915e559597b0f7eea7bd97609d5cdd06e8b16caed62af8630757816251f5029281a4939b3dd3882029872508c9
- TLSH
  T1EB71CBBB5F96C1324834D6DB9704F851CB721153C63DD428F8AE43684FB6290437EEAA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Divulge-Stealer/Divulge.builder/Properties/Resources.resx
- Size 6KB
- SHA256 998534fc8cae09a06e6eafc41c864f060904bc2f95f85e2c9691ed2de8912ceb
- MD5 c503b2f5c5121b402729796f61a6d380
- SHA1 0705072ddf1d1cec6fc31c305728578960e14e4c
- SHA512 9a56fd9d328fb4cd4e79a4a6537a9d9adba4fa2d5452f0a25f6a5fa673f40ed0186c7fd8076a05770f7acaa9123712c698bde48ccb1d4fc880e75438b409b46a
- SSDEEP 192:KjrbLPD9sLvIzSvKgIqUyahF8FokwClQEokwCl:KjrbLPxsLvASvKgwyahF8FokwClrokwY
- TLSH
  T1C7D14455B1C1DD260BB34C2DE6167984F7A8823B0234AC54B4DC621F9F73886A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Divulge-Stealer/Divulge.builder/Scripts/sigthief.py
- Size 10KB
- SHA256 3da90e1f2f599849c01dd5e873c0fe902579666556069140e8e89b7476f6fc6a
- MD5 3ab332036d3d137c16e7a6307243ba2e
- SHA1 16e945f448e877aff61e488d2f5f6fd1ea111ef2
- SHA512 fb596987e3606533b2961550a94e8252da4db36093effaa554d8f1e7e4047fb915204143b16c0a0922295d1badd047fdf0b629f3cd61b56b93b55c83e635b483
- SSDEEP 192:Juj5U9+6E0yWYSF/DwI6CRgRIah/gSEU15AkAJi:JvyMvRHU1D
- TLSH
  T1D922520C10BC20B0D2E7975C9736614BD6663A2BBC599E14353CB21B5F4837DB2E3D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  Divulge-Stealer/Divulge.builder/libs/Bunifu/Bunifu.Licensing.dll
- Size 1.3MB
- SHA256 a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43
- MD5 2b2740e0c34a46de31cf9da8a75d77cf
- SHA1 242324f1112e6387cda41686291b6e9a415eeb8c
- SHA512 605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40
- SSDEEP 24576:ebkurkdR5uuMeiPUf2lHmdpjrcbYdwcqMw5LTvBrq/WGs1xGUfGUCco:a1roD9MeiUDDjrW4bqD5LDBrqWG0GUfX
- TLSH
  T16155F150B3FA6F16E1BEB7F56971120807F0BD979835C30C9EDA01EE1B62B848494B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Divulge-Stealer/Divulge.builder/libs/Bunifu/Bunifu.UI.WinForms.1.5.3.dll
- Size 342KB
- SHA256 012d717b4ac00c3686a772757f49c1908e223624e3974314cdb9fc9291073305
- MD5 41c216d27c71a227774e680e95e99f31
- SHA1 0a2a93d4ecbf4bbec2faf110066c6b4472b0dbf5
- SHA512 e355ba11e41b668e4459f709e87c3e212c8986ea894791d9155791ea9d7315372fb51531eb69204ed2ee38e242de7629e4a2f090c05bf9deeea9ea965ffaf651
- SSDEEP 6144:3e5XJsDZGUbIf5kqw23B1Q8g2iYcHIc6uWXMIFidNw:qMZGUbIf5T37Q8ncHNAMhNw
- TLSH
  T1C5742DD15AA5ADE1C7D747BAE7103143D77888A07ADAE70BDB8401FC49A2F9BC84D087
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Divulge-Stealer/Divulge.builder/libs/Bunifu/Bunifu.UI.WinForms.BunifuButton.dll
- Size 107KB
- SHA256 2a62c78f1f0db2e3258135b50f7885e6734c31c74a8f2f5782f285aa268c2f71
- MD5 21f999e5ac72a16077511d41590822de
- SHA1 d8bb1a8a291f73cdf2b5658b2b65736c87db19dd
- SHA512 e04fe31870f266d772829053a6bb210a9513ff5c8c0f9a3a267ddbe1875125496caa602baf44a4e241ef84d933bd55b79af43d5871ed10c81711adecee78b8e3
- SSDEEP 3072:tgiMibnDED3/7f2ih0xdGzFpzUHgmCFKHUUZP0tTwmnkyY:xDDED3/7f2ih0xdGzFpzUHgmCFKHvF0e
- TLSH
  T15EB3083F61A45E71C34AF73EB008514247B2EE90FD76C736BD9842D92A837A74C1A297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Divulge-Stealer/Divulge.builder/libs/Bunifu/Bunifu.UI.WinForms.BunifuCheckBox.dll
- Size 102KB
- SHA256 390252aeb6fd76a954a03853c3d883e0360dc8b3f2cf8cfed5ba94e4e5a24da4
- MD5 ef11f59a9381df17d7ab94434f79f260
- SHA1 ec11e46a636fe3927fd5fa7c30be65b958853ef0
- SHA512 612b1b0f9204c605ff5e9b91816e674cdaea71fa69f81a5a7f475bf1cc8d5e12687deb1b0118b07b3d7e4764adede0576f8fc799f8155a65a70e5dafff50f73d
- SSDEEP 1536:JiQsfF22IDMxiQ9MOWnce1Cua4JfhwuKeWbZ6YlX52o3tWQFeOvTT:JifF22IoxChnv1CuhW1xCwdeOvX
- TLSH
  T132A31B7F62E59F60D38E633F65B061005770F450BD3AD77EAEC848884D9375A0BCA29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Divulge-Stealer/Divulge.builder/libs/Bunifu/Bunifu.UI.WinForms.BunifuCircleProgress.dll
- Size 77KB
- SHA256 d5ed95667aa44a80278b80a90413c0de9d85eeb3ca1fa24a40ae71c3ad88d837
- MD5 bc930a050ca23ea75dbd9deade4189bb
- SHA1 e6878d381ac1c37c331fd01a25b2ec508e1c1a21
- SHA512 20e2bb3661d2817082c2aa01381b5aee8582fea5fc54be486de5b1e48f302a15779ebe5670221774a5a4d031248b342f3c86084de4f023c197cd210857fb3ff3
- SSDEEP 768:A8ioretsy7GQLZvAQFe1zbnprSBaqII0OsWjc1B5Nl4WfWQAz6uJi8B4dgUp2hQf:JixnZYQFe722Wj8l4oL+6uJ/BZ4ZTz
- TLSH
  T1E7733A5670B5CAB1CB1E2B3E238061400BB2FAD2395EEF177E6C879946833FE5195187
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Divulge-Stealer/Divulge.builder/libs/Bunifu/Bunifu.UI.WinForms.BunifuColorTransition.dll
- Size 38KB
- SHA256 500adece1fba76dfb2fa628de9886a2661ed1a4e58a7717a5fee607206bb1d81
- MD5 539d803013c0b1592d0e17a740d72687
- SHA1 b0ce15e0f096d027b1d1482afa9d93bafd160f7a
- SHA512 77d8ab7a949db41a79371cf2ebd5d67bd4a38dd040de0073c878f50b2a6409fae2dc5db7cbf375fbc1bc571838b0a6d4848bdecc1420d91633b878585c94b9dd
- SSDEEP 768:2SfWaEnnh2U2DaRIx0qVuQ/90iAzNIewCqyU659bTTvtM/3JhQTifZs:cs0qVb/95+6ewCqyZ9bfvk0TWZs
- TLSH
  T10A033AD266901E63C39706F934A093165BB4F5E379B1E35BEC1C80815AD33FA5CE92CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Divulge-Stealer/Divulge.builder/libs/Bunifu/Bunifu.UI.WinForms.BunifuDataGridView.dll
- Size 83KB
- SHA256 9e61bd6dbcc8d5866bf3a139ea12f453ef4ca8bab28c08329cbc5f0bf13950df
- MD5 53765ad5b31fd87986a569bbb79f402c
- SHA1 75c7ec63458c79ded533d1d4175de4117036adae
- SHA512 ea129aab13b09e817be6210bc423bcf4e024c83a5a0340941e7658d4dd0ef6f3b40077527f7d168849ad947650a00d360fa6a5f64c4a8f14dfe72cd4d34469d3
- SSDEEP 1536:YNBBIrOTrgVCuiPwacJigM8H+duT0R0xSJQ9FTiIb8EtTG:YNBoGgsPiJfedkvu/IFtC
- TLSH
  T132832C8672D95F71CA760ABE90F002112BF1E1832A45E31ADEEDF5CA0562FE1D146BC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Python

T1059.006

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32