f84cbff441b8066271267cb734d5f58371711b546b00d26214900d2f58d84e54

Sharing

Copy URL Twitter E-mail

General

Target
MecchaESP_[unknowncheats.me]_.zip
Size 519KB
Sample260705-pl3hjacv5s
SHA256 f84cbff441b8066271267cb734d5f58371711b546b00d26214900d2f58d84e54
MD5 af6b2b92fb02eca375be66cf423d7f6b
SHA1 c6bc4563407ca70637c524246a7d2306f7a9ee8d
SHA512 95f317c514921e78c541a2e68d141045df6db346931285c9275ea85f4778b819abe67279dc50a5062ad7c1e3ba2e97a71b6a7dca619940260ddf35aef4c7602b
SSDEEP 12288:t+YZ4bIR/+c+f1yzW+Jrh/c4O0JYFuMu1IfrLc2flZMd:j3/Ix8rh1OAYsFczMd
TLSH
T12FB42317F50AFF886DBA0473004AA0D5A7C2B7B6941FA44C998F82CEDF0F635D269256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MecchaESP_[unknowncheats.me]_.zip
- Size 519KB
- SHA256 f84cbff441b8066271267cb734d5f58371711b546b00d26214900d2f58d84e54
- MD5 af6b2b92fb02eca375be66cf423d7f6b
- SHA1 c6bc4563407ca70637c524246a7d2306f7a9ee8d
- SHA512 95f317c514921e78c541a2e68d141045df6db346931285c9275ea85f4778b819abe67279dc50a5062ad7c1e3ba2e97a71b6a7dca619940260ddf35aef4c7602b
- SSDEEP 12288:t+YZ4bIR/+c+f1yzW+Jrh/c4O0JYFuMu1IfrLc2flZMd:j3/Ix8rh1OAYsFczMd
- TLSH
  T12FB42317F50AFF886DBA0473004AA0D5A7C2B7B6941FA44C998F82CEDF0F635D269256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MecchaESP.exe
- Size 925KB
- SHA256 5b6088d6dd6a0a009f42dee9df2086ccd898ac68fc21cdf31da820c229de57a4
- MD5 c7da026f28a96d3f7b5673bff6ab9953
- SHA1 6863306917d5e12868b1c9548839096f6591bd19
- SHA512 41e5e14b580460f51b67ea9fdd472d870f3ef0e9a2cfde321d4175c8bcc201b1ca61447103c332984a35e99fc7ed613a89c06ba7c94ce89fe104839682b08107
- SSDEEP 24576:3XCZri0jFYJonb8jlTGHzwkaienWDf6Y:nSrxznQjlqJen8
- TLSH
  T161159E56B2A840FCD4BBE1389A5BA90BF6763489032186DF13E045553FA77E06FBB311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  imgui.ini
- Size 143B
- SHA256 0cf0809bbe86bfb3107ee4b3b24bba0a01e3ead2bd3ecdaa7b61dc522ce60363
- MD5 7733e10c313a22ca5c620e9db7aceb1a
- SHA1 5539b7ecf3e8b9afa4bcc8518a7d967838577fc3
- SHA512 30993ec2e39ede000f27e968443f1327bf8b49d80e02092c8fe0357b1557dc39faa93297e4fa1abf091eda742ce228732045892993e699a1b4d48387381a0ece
- TLSH
  T19BC04C16372A125A51F740487179B3E4AA8AAE046442B1A895E4000ABD4E41610478DC
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  runtime-bridge.dll
- Size 303KB
- SHA256 bbadcce043011674ea050ffe23424db2fc8e3366603d5203c9d771d3a883ef64
- MD5 672f2f6800bd400b801708d02023ca80
- SHA1 dcdfe8ef69b62eec97b78757e0bfc42cb81e55f5
- SHA512 c40875b449319caddf08ee43f22a4429ecc62b66af3e550e983bdbd1710c7ccd7eabda889e347172976d51710c4d4a6cc7c715bea4c657444966545e029c662d
- SSDEEP 6144:wqlI28j4jvZe8jPOrzHLLQ9Fpk/XJ+dCPHLZ7MTNc+6x:wqlI28jgvLPOrTLLYDk/5+dCPH+F
- TLSH
  T171641A3AA69800ADE0F6E278CF0B6903E6F63405037595FF07D14D962E5EBD4BD3AA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8