35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5

Sharing

Copy URL Twitter E-mail

General

Target
Minecraft.Note.Block.Studio.exe
Size 43.3MB
Sample260705-psxwmacv7s
SHA256 35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5
MD5 78da383af0d3a0a31ba5a6f6e067ccc6
SHA1 580f8e48161b369f36ee9a19fff5ebe19400eb9e
SHA512 c94b19b0304a16f8bb73639b2ae1bce9342af408c9d41794f9aba89aacaabfc5dedf891b75ec2e0e8123f4e838b5af69cf239bca39d444fb86b2ba43831ea2af
SSDEEP 786432:6P9xR54hCRbVw7xDqAYskKbeTZxcmpMmQO9KWNMFiNssr/VnqjXIhXDd:K9xR50kBw9qAZAemWm/EW6FCDVn6XIFJ
TLSH
T1BFA7338267F4662EE8397FB23054BEDCA1DD89173843CA6B73A011E1A7F3407193656E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Minecraft.Note.Block.Studio.exe
- Size 43.3MB
- SHA256 35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5
- MD5 78da383af0d3a0a31ba5a6f6e067ccc6
- SHA1 580f8e48161b369f36ee9a19fff5ebe19400eb9e
- SHA512 c94b19b0304a16f8bb73639b2ae1bce9342af408c9d41794f9aba89aacaabfc5dedf891b75ec2e0e8123f4e838b5af69cf239bca39d444fb86b2ba43831ea2af
- SSDEEP 786432:6P9xR54hCRbVw7xDqAYskKbeTZxcmpMmQO9KWNMFiNssr/VnqjXIhXDd:K9xR50kBw9qAZAemWm/EW6FCDVn6XIFJ
- TLSH
  T1BFA7338267F4662EE8397FB23054BEDCA1DD89173843CA6B73A011E1A7F3407193656E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/simple_py3.pyc
- Size 221B
- SHA256 acd7bce5015ecd27ef7ad1c6060ac60de8d9c3710c498c053ac222f0a76dde5d
- MD5 fe509923875a6eadfed1c0d77c848c1f
- SHA1 ed03f3e8ec9584a507bab4cd31c9c987a5185e56
- SHA512 7fa722d5b126c2a9ca9f6d31228f9038fdbc47ef14c005130bde707bf5b135f6dd04a9476b1defa1b67e32c5b36b00e6a6c3a8fce79e894b0040e8ffcf7a5c72
- TLSH
  T1F7D02244C6028032ED7E9236E439A22130D624244F2600C30E0D46AAB98828320A182D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral2
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/ufunc_config.pyc
- Size 1KB
- SHA256 c2ce337dbb8eb79b935796d3bedbf00951cd7241a2e2e4be388d529182293ab6
- MD5 2c429cc5ff64b9137988d14c67c833fe
- SHA1 de143ec4d9f34ceaaa8be40a88175967c6b36eac
- SHA512 32a405193bacddbf8be9085c9f04f0ce7f8e74df0a03501704abb8b060ad4d74da3c0361b1b873b88ba9ca10550e136dc36ce8cbaee62920507d282097c07cff
- TLSH
  T1BC41E18D540A5BE5FD27F3B1819BB2106F35E67E37489A1B5A9C183EDC0A9CC4023B0C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/ufunclike.pyc
- Size 1KB
- SHA256 7b212fd175e8dfdd51461b2b965de690f186f549cd4975f54ef5501f93d8bfbc
- MD5 f583b6e99851adaf9a6458828167e99f
- SHA1 8dae81cad889048f92bde0c0ea276249d544aac5
- SHA512 72cb8e31cfc50f947c3c95b39805b3ecb77d00fa1a46c7b1508168741c95e3297bfa3fa826807a618c9de5c79ab1f01abe76a1e14013c14ed6a7ea610d18a6a3
- TLSH
  T1D131DFD8861092B7FD3BF3B420A77631F370FA596255553B0E06D236CD4C7C16A23A1A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral4
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/ufuncs.pyc
- Size 601B
- SHA256 0d2d59dabbd96e0e58385f80554306631b6934de2ad678da87cfe75a300f7d5e
- MD5 2f6da48b1c21689a50565f64fe3c4406
- SHA1 e458ea938de5223b3fe6d2b07dc1785953f65ea9
- SHA512 992de19f0fb7cdb7b5688de4c6a88fb8e900ba3e8d43306b0b4d9a284b2716d8fb81cf9d10eb3522cb0876fdbf44bd9e16a3a274e44574e1bac1b258ac40a844
- TLSH
  T11DF08B05825215D7F875FB7AA1B2652B2F2506A43E00D90F0A186E2DFC486811EA291C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/warnings_and_errors.pyc
- Size 312B
- SHA256 01587fd3118e1f8599bee6fb7f3685d0f5dd51c363bcab9e151225f38ce3da3f
- MD5 fb3f32207f15f7cc68d881f8b38640a5
- SHA1 7ad2e7a6770043f81560da9fb0de62cabbf2bd6c
- SHA512 a53de17c8081cc076d380704f21d0378a127f6f3788b9ab47bf5ea3a0869991125e36944f412bbfc52e7ed1fa865457de71476f1384d2e9a3a063ba1de668522
- TLSH
  T105E0C2004A444D22F975267599B25A32259EA05827A581168D4C6739788135354A5E2E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral6
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/test_generic_alias.pyc
- Size 8KB
- SHA256 f60ef54741a33a7590d9f6c9323f3228201a7c651352a7a7c3942829320e5432
- MD5 d875a5297ff4363578171f7ea01f2da4
- SHA1 be4f1905e67292cc6ac868fc811c36fdc6690014
- SHA512 a4d4e69798fa728918ac30a222ad04f316b59e94ce8154a73c0aacb10736a015d53be2de82a3a5d429c1fcfaeaa94101ae5f0a5d34afab687cea3e9163d6cec7
- SSDEEP 96:epTLGv57UyNuGV2uDOlseq6KIJf444t4OQDqYQt/DMSppHoUL+fwiZMbrVNxFlxU:ehm5HuXQ4R/w/xu4brbpEla8+iOowu
- TLSH
  T122021EA5E31AFCA1FC4BFAB5894F875C6778FB32430EC2AB500555AD2E4838B0D19764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/test_isfile.pyc
- Size 995B
- SHA256 dd6889fab5ab31f676694474269593652042756f081ccf9b703335a78a5ab58e
- MD5 28d9670e60b624395b5faf9469633875
- SHA1 a219cfb0a8f7223542a11542d99e07ad61eb8f45
- SHA512 791a375e470b41e94179fbec86e156bf369fd126ad7c5b9aa54eb05d28ae7bfe91ef1fbce2aebe49462c2b7065e565cd364a57a589a829c5229ab2187864b560
- TLSH
  T12511DC70840146A8FBA066B0B09D126615B9C67FE37A1CF12F11916A3D9B7CE55FD01F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral8
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/test_runtime.pyc
- Size 3KB
- SHA256 0e42ecf4100d1e4906db6848e093e481a27e1977624a08851fefbd83ccb48396
- MD5 49e3dca27eac4e37237c7dcfccb56114
- SHA1 3a764cad36196c736a0c3cb10a1e2ddb98a557f2
- SHA512 65e0ff6aaf64ca2f433d71f5955671de5b0693b4cbc1fc13b3698bc696f762b6397fe1ce161b176ea1439c331bd68ae3f0b67f31c05bb62cbd6c0af342946c81
- TLSH
  T1077182C56A860A56FA98FAB9903607044B35E330FFCAC5B31D2C907D294A6976D9131F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral9
- Target
  Data/Python/Lib/site-packages/numpy/typing/tests/test_typing.pyc
- Size 12KB
- SHA256 62f5688d664b4f7c74b65cb95b7a6e58eb453f7809cadc29a1546b3e927630f9
- MD5 1676d455190c35077723336890159816
- SHA1 e69bcb5caf9ec3b9397aae3182173109798a39bd
- SHA512 e42b8eb52b28ef49d0245d720071bba75f2ac1ffdca390b5f251b33521bc4d2d1e3911ae27e65d4863985341883a313dc891f8b12c22d25007fb26c85ed0b36d
- SSDEEP 384:6uGs8A5tJxEeVRbZXT4jK9Mug7iVkI5qD3GPtauE1sSW08P:6ueqRbUGlxEKP
- TLSH
  T18042D6802001A927FD6DF5F8750C134F8732F1922FD55A43B218A6B12E8DAD36A7CACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  Data/Python/Lib/site-packages/numpy/version.pyc
- Size 559B
- SHA256 18684d226fd54db51cda5916754172f5434ec7fa29641a29fd12d5f305088213
- MD5 9a0df8e6c709bf4bd787239ae6971713
- SHA1 78a8b0c8ed4b5118b2043ac6894e0d1e3c015e7c
- SHA512 1945bffff08f955a1198693a781b9ca2683a0532780e81ce96e263174e38c08bb339f90917b708c4aab2f253d2493d39c2d43fcc439e3bfd7b3961585429e8e0
- TLSH
  T180F08B8449419133F99E6379B02D722D437F2EBA8B9A4A61491892E4470226A26E2C1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11
- Target
  Data/Python/audio_export.py
- Size 881B
- SHA256 476d1e3015bc9daea4c9542edd774dc7ce6e404855f582a7a63bcc2c7a456556
- MD5 48e89e967bd60db7b99d57c1fa75a942
- SHA1 6f641287c18593c347ef15a862f9216c52e2814b
- SHA512 bd53fac2184803f2c8a1dc0f8c795f91a3b469217374c5d4775e92e9c70cd810159f148dfafb5535a1114bf232acc24d0d046da5aa3e2e6c059083de7d5f059a
- TLSH
  T1A111C0D5599A34C04A71341D3B7FB11BD3E66D439E9305C2764CE2673F350364025DAD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral12
- Target
  Data/audio.dll
- Size 9.9MB
- SHA256 6c57a4dcbe8fcefbbf811df428c5b7ee5be2c40df0e242351f7c627f772725d4
- MD5 48281fa7cef5e979bdad2033ca01597e
- SHA1 dbe549038db219f5c5b075f69c747d5d561b694c
- SHA512 3c9285071db125ef6ef093e8ed96effac74ce9edc4c7d069bb013b554731af4728b9e67383eb62009727bf9ed35b1462cd892aea3a72a28395c2e7da7164891b
- SSDEEP 196608:DDncxWiAxJ2m30iXVGkjZTClgozl7i8gYTT6zMWGtbuZNS97kUAwkpPWoYK3:fLiAxJ2m30iXVGkdTC5xgYTT6zBGtbu5
- TLSH
  T125A6BE12FB029142F1D601B2D7AE9F664E3C1A38172561E753987CF97AB4EE17A32307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Data/file.dll
- Size 370KB
- SHA256 c4ea167d8ad20110a12870b6c232fc38a84cc2911de2688f72a961e22264ff1c
- MD5 71823ef94ce64e72783720f689d7658a
- SHA1 510a78755e555b099514c31975069443729f2fab
- SHA512 11a1bcbffb83ae05a82133034a11a8285ab15ddc62dba2f49e01dc53844394d6e97b6fa143d2064eecefbc847cf669d9a39d5f5985922667f8ade2ca3326b08e
- SSDEEP 6144:zBDO2+HofgRqxCPssBzT9TYDoTBGlQoEiZw8:zBDh+I48xCPssBzODoT0lQxA
- TLSH
  T10E84AE0176C1C071D47F027154AAEB1906FDB8B00B7A9AD7E7C8AB4F5B309C1A7367A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  Data/gmbinaryfile.dll
- Size 348KB
- SHA256 83941ff51a07b6479fea636b7814417b9bd0e9657dcafb75d6009f2e77f09738
- MD5 54e7510adc2d717a897ae843c592eb42
- SHA1 35f02ce57ed1e7a10c836838ba7018f8903ae008
- SHA512 603bb307ff918fe8178f06269c3ad1d41d231b613398b08e512fa698b0f0976156301827935094bf44ba67b83200196ad523114b04894bcb7a79b65020c3fc43
- SSDEEP 6144:qyNP6EPHEKpVOgI906iUS027EdP+b86PI1FfYusV13MPXxYi7tvsp6Pr1fvIKEdU:1jtr7EdP+b86PSwusv3MPXxYirx
- TLSH
  T12F74C6643AC86BC6E134147E508E60CD62E6FE0243A97F0ED76CBD6D0DE29517276B83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  Data/midiinput.dll
- Size 102KB
- SHA256 b595335a3cf6493f093e9c183a0ac735d2c3e3125fbfbfd04e4984f36496de1c
- MD5 88345bad6f4bbbf87146663d193e1fb0
- SHA1 eeabd096a5fb90b741161791de125446071b20ef
- SHA512 2b963bce749202a829b8595cbb164623b47f0ebaaedf1788fe2d35937d75517309b40d4f17ecb893b81752a2212c6584aa8db51113ec68cc2c223e6875ba17c4
- SSDEEP 1536:JvkJ7cWIygUF/5MrqWl2TR9A1qiXg0sI9rYAv+Ich43sWjcdoo14FVTcXceZW:JsJ7cW3NVWATR4JF+poo1aVTcXceZ
- TLSH
  T1D5A37B1132D4C070E5AF063E48759F01077EBE62DBB099CB7BA41A5DAA752C06F36B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  Data/move.bat
- Size 37B
- SHA256 202070e706ad43ba8b66332c72b3829ac6c885ee08be74bf089f3af270b83efb
- MD5 1dc4e793875d58a31b6436c3f532fff6
- SHA1 5b5514842c6020cba9a9f4f7468ffd9d03d7b281
- SHA512 21e145b911519bf26cd32353fb04c448695efa51a6ff213d511f34ca4b25afd3bcdd06a1d580e5f0cc8c2c692019175975aea25675079757e3eb2849989b2956
- MD5 SHA1 SHA512
Score

1^/10
behavioral17
- Target
  Data/wallpaper.bat
- Size 86B
- SHA256 8cf013aa324653b78dd95ea55c5306c6f3b48cf403e0256c2b910fa6161358fd
- MD5 27f6211b9fae475eb4e7701f6ba9533d
- SHA1 042e1a7494c9570967933870d5568a7be270fe02
- SHA512 4d48d0c5f16582ab4a9b04a9a62c7c3aa887fdf3089d857558003e589aba9add6eeb890b8eabdb607c091b8cf1eb8e1db78f29b1828d31ce091724767c31060b
- TLSH
  T111A0120124074C219C21321CC19A0CB39A0C73A7800083807900A64E544E68257B40C5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18
- Target
  Data/window.dll
- Size 81KB
- SHA256 c688b9b6d985c575d851547937baca2619f11a23897bbd88637eec311fb7e20c
- MD5 0ffa9a91901802310213d0ec9f021b85
- SHA1 499fae22c319923543419e245fe1f15582d9428b
- SHA512 1ddc8755667b5b0ccf6d7e03f35ef1435bf00a121c8b31c78bad1dff072f413fb46845a643ef06085d3d8bd2a27433746fef1ec760fff1a0e786eca76e8d5e21
- SSDEEP 1536:gqmvPM/qa5MzNixsMTum0OuGZ0c85wsW+FcdSEOAO7wnZl/hZ+n:gqmvXa5cixsMT/UGWc8MSEOAO7wnZl/6
- TLSH
  T13C834940B581D071E97E19350868DAB55B3EB910DFE1EEAB3B49066E4F302C1DE31E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  DialogModule.dll
- Size 267KB
- SHA256 71796350026238175c0efdaf82b208fc585e6c7d96fae234348f4a2e5ad5bf31
- MD5 451b7a3b34b2f89245ca6f0d2bded607
- SHA1 e7115371c0d475a2ba2ddd8d5b3e6dbcc74c2332
- SHA512 3f17e26e617887071635eaa519e699025b6182f502c13cbd60ab7d0af0260b8aeba77272dca2428de5724a2d36552e34518cecaca2fb4207fb6594aa345810bf
- SSDEEP 6144:KLq7wEqARVYSu+rIc0/21ngSAOnJ2/tc:KEwEqARVYl+8eStc
- TLSH
  T1FF447D01B495C432E96D11301578EBB645ADBD248FA1C9DFEB940F798A322C37B31A7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  ExecuteShell.dll
- Size 95KB
- SHA256 460bb138fc648c9322ee6468d02a7da4c99496a3fb0b15a6848a22d5d6370053
- MD5 988b9f3a213e2a1828ee08e1678ff173
- SHA1 09ab94994fdf50264f6428557696890630bede27
- SHA512 19793af14868d3d67f010add3d49a46fb736e43a21111562ca6e898d0225df29b53cb64d137752ef758b992364b2c546f5d5a5ab78e971c9358509d6d6ac0d6b
- SSDEEP 1536:staMMMULe8pPBDQlZmisG9qG1cVKHGamBysu4hsWs8I7ucdmlUVV4NLkq:+FgLe+RGpMG8KHG0j4ImloV4NLD
- TLSH
  T1C4A35C00B581D171E9BF5E3D1874AB96877E7D10DF60CEAB2B940B2A1E701D29E32C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  FileDropper.dll
- Size 177KB
- SHA256 b13f402b984388b8dc627eafef301b7141f2da48defe517fbcd662bedfacb050
- MD5 c841727e1c610af87da95b9e64a31eda
- SHA1 203bf4ecf14215488bab547d81a8fea3af754bf8
- SHA512 eac05fab9f0eb3326399ec7918e2b177940e0beebcd0f0e7f3257aebca00c4752da6e36870277ac4f1ba67255105a87ba55cc08c6ec9c40f85da0fc95d0c5463
- SSDEEP 3072:v/RZ+tl51T8b2/4JwMQva4BzeVEf0GjPbFqu6xAg0FuDpU09KKW1yS:vpZglHT8aM0C4Bze+0mBkAO139KKW1z
- TLSH
  T116046C007193C472D67E16390874AB654B3EBD14CB74DEEBA3D88E6E4E342C19E31A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  Launch Debug.bat
- Size 65B
- SHA256 dbc221d5c677d8ec4a03c8c53ddb28f4d57b9746b5de13818fea7d90b106a4b8
- MD5 f5266d03857631ed59bab8650f792f08
- SHA1 531ecc203da38fde25cf8df4ddbab3e21ad67635
- SHA512 9a9091e3d0d885fa1b7a62f8aa6593e6fd43fe408fd25ead5a041c73c283e16d7b59dd14f38aea54c0506355f1a153f79b8b44eeef2814b0983189ee308a81e9
- TLSH
  T18BA0021541AB391353CBA81AE52639CAB93E9163830A8E7A21609898179C15464C9554
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23
- Target
  Minecraft Note Block Studio.exe
- Size 15.7MB
- SHA256 3868d43cf592478373df6889e817cdc3878859fa0aaec63e6e79eabe859f8109
- MD5 dc6d69fb19aa6e9ac46890691aad3056
- SHA1 1639c2f30c82446ecd219ce8f190d188f9371042
- SHA512 d4c9ea03aeebadb5adab1f622cf32be1eb511ff5800121737a04c38fa3ee476b7426ae20d84c24504451d875910f8ea988394c13043c2260842ade6735d13565
- SSDEEP 98304:BdHO94SWrVRwM2kEFxvYNulG6iSl11igCLyZO50j8lKBkjMv7NF/2jDVR9RKyShv:jHO9n2D2kEFxvY8Tis11iJp2qWIr
- TLSH
  T1D8F608027972F461C19AE2FCF06F46BE52699F08BB280DE3D180FD7C177429A5952B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral24
- Target
  NBS Player Mode.bat
- Size 50B
- SHA256 059abac1515316c2be0dc776b2e9820f45bab91618d766b6a0c1afe40ebeba00
- MD5 ace21ce50bdcd4b2ffe45af6244779f6
- SHA1 f32315a989adcc7e4dd588a23f4b3bcf74f714e6
- SHA512 5862636cd418d16ffca5132c7727c9697dce04c8ffa0f50c891e5b36b121533a0e481a97a04eadae0f8ce2879b1d84046338fa225e00d9379dbd3a09d15a2d5e
- TLSH
  T1A5900214415638135189A446D5222891B4369261830689657120941C16AC15454C9554
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25
- Target
  NekoPresence.dll
- Size 60KB
- SHA256 6c27390f1a332a42a712162f6e2750177cdc37f58bf1ef7a25ab6c4650edcfce
- MD5 4bf22144e0cae4f5fd4d5dce771e653a
- SHA1 e797aac2e6727657b041fe4bbca0221916e095d5
- SHA512 d6c1cfdd4be65f003af8983d2281befaa94bfc8dbcc12bc2c23f149ddf54e9fe878bdb54cf2de3ea6a8a0caa7c098303dc8e1527634fc82457f9637266033be5
- SSDEEP 1536:cnVQAxdA2bXXXfQPNK0meQgKVXyLwkHmkfx/lQajEld:cnVQGdA2aMe7LllQajEL
- TLSH
  T167536B207644D5B9D88A26B0757EBFAB407C69313F9481C3E3A7399D2C751E36E3424B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  ffmpeg.exe
- Size 2.3MB
- SHA256 05a92f69e40a95976f3d30e07d4d86c014a6df9c443650ae5e713ab6afa1e63f
- MD5 3146886e5be49ee98f1ea2c58cbfafc3
- SHA1 ce3a46795db74903b82ef02fa8874d0e85f01700
- SHA512 dffd44e97ae19ea83711b656a2aa04c51a2f31314bf2b640a7a9aed0fe2453b85f5fc4fbf6b5e534f279367672e1f1254e26b03fb9a4f1eb19d28712e5370eef
- SSDEEP 49152:KP5XTwaC6+MQsMiM4oOXUmfVM+vgMTwCS8DL3wEndm:KP5XMaaMvMiM4TXUaVMIgMTwCS8DBnd
- TLSH
  T19EB56B41EBC790F1EC1319705257FBBF8A346B068424CEBAFE986A88FF73E51151A614
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  ffprobe.exe
- Size 2.3MB
- SHA256 39037fcd5d12cb0037e5743c7e9905954d0af1517b28e37d75af51dbbc1082a0
- MD5 9f8cefcafdef38c4e81240e52fcd3a3d
- SHA1 441742f03401f4846cd00fdb4a360083d59cf233
- SHA512 7fec60bd9bb12eb39b4238ec184f0493ab2e850160ebe0caed82a01e611ff4072fb8af0c781b2a6ea1696ced32b4df66a123dd9338a8d9ad1882fda0141d6ac6
- SSDEEP 49152:vFJXu4G4MCd5KgepmfCHLybvfdS1ynY1wg4dm:vXXu4BMCd5nepiCHGbvfdS1ynYn4d
- TLSH
  T1ACB57C41EBC7A0F1EC1709706257FBBF9A346B068420DE7AFE986A48FF73E51151A214
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  pygml.dll
- Size 80KB
- SHA256 fcd4486c4e8a8278d6ae26f4d2b23e0ecd4c5b4d0b60457f3208876637154416
- MD5 0f476d1eb02ab2e2a6fb8a5e74f7a3fe
- SHA1 8cbe497127deed82e13fdffc948a48cb6b6a72b3
- SHA512 d4ab4eba2384e2e222fd7b902986bebda68784db4b234c90631faa2eed9290c00e9cfafb87b261ba525f4da43c9036d013ac873757e0e134d50ce6df0c3dfd9a
- SSDEEP 1536:iipB5FEzROiZCJ+cUmPtowDWeYJ8dBblFDTJh9qxD:ii7EzROIZL3wDLs8d1lxTJh9iD
- TLSH
  T116834B22BE0AD036D8D951BC2969ABBB967E8138CFF501D3A3405E5C49301D36E39F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  python38.dll
- Size 3.9MB
- SHA256 a9675a91d767095c9d4a2ae1df6e17bdb59102dbd2b4504c3493b0bcbed5ef55
- MD5 9f8e0de6e7d4b165b4a49600daacc3b1
- SHA1 8cf37d69fdaf65c49f7f5e048c0085b207f7287b
- SHA512 3201b7adf94d3f4510e0b39b4766d1314da66662819fd6de5f5f71956750bb4fdf4228b6e1ad9d4d3bc1fdeb99b7414ed2eff0374aaa3216b67eeedfb8673b48
- SSDEEP 49152:jHQHfHn2kP/RYwV7hatjc8R5euJ0IAtOEsIUFIHBcn8MTPGRaTn7Hk7+K4ddmQz:T0FYwV785N2IOZUeHS8MCRqA+xAC
- TLSH
  T1AB167D30F541A025E9F850B7A3FE4AB34ADEDC586726D0C3A1D978D456722D322F928F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  uninstall.exe
- Size 86KB
- SHA256 84529d020fd6dc0c2aca535b72d2d232d11b1e23a0f511b08a397b818ab393f5
- MD5 2127450f981cf9912784efb1ff1eb355
- SHA1 e3caae8abe0375270cc416405247d062393fc1af
- SHA512 0fd73f56f46e3a622bd0b37bdf1a15613b6860eb5930eb561c65a7b0dc3d90d0161d71e3171ff01d2797ca5b4920307f08188dfffcac0df40fc31d07961deda6
- SSDEEP 1536:IcVxMtkyfWqPG1QIcVdWToWw2cgzkIXOJD1PSlVZd7ZFLeAyNsxhr:I4MrfWdbcDWToWNczDSLZd7beARp
- TLSH
  T17583C0137FC084F2EFD7487059B7BFBB6676BDB550188B1BC7849E0BA8913009E16296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral31
- Target
  window_set_icon.dll
- Size 79KB
- SHA256 ba5d14484827c3b7ee03b68dc46a6022993c39735376f10c3f559c96955705f1
- MD5 522fc21b6cfb771e2a1180b9df822fcb
- SHA1 c81946d5753b32fd2e4e282a1c5cc6a7eabf86a0
- SHA512 2a6d2df6abb8e5ee3b23f0adfa84ba87aa52fbfad3a8087510e7e1e2220824c0ee8e7c44efa4fbd6e47ec3778e2160677c3788c6e999d132cb7fd9d0976a2fa7
- SSDEEP 1536:SyvPdxomTT6SFKbUCK71w2MBuuIufR1rhZmK5rsW4Ycd54E+3gY5:SyvF3TVKbUHw2MqufR38U2554E+3gY5
- TLSH
  T19F834A4077E190B1E5BE09355474E6629F3DB921CEE09D6B3B96063A4F302D0EE32D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in System32 directory

Checks computer location settings

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32