1f80ea11f8b97b88a7c2fd341715878af9b99f89f0e51664707369f19d678de9

Sharing

Copy URL Twitter E-mail

General

Target
imgui template by byte.rar
Size 246.5MB
Sample260705-veh37sd16s
SHA256 1f80ea11f8b97b88a7c2fd341715878af9b99f89f0e51664707369f19d678de9
MD5 a7908e7094bc687448e460f944382a43
SHA1 318c4a4b75e96f19cffbc5f244db072250d583a3
SHA512 0b0f0ec4da7ea34f25dd34fdbe657424d8763d3480c4fade40e24e87979d742df5a98319309e63abe0dfc7faa556be292012ca2478b819f65ef257e9918fa5fc
SSDEEP 6291456:3v3MELjxtD3u9ennVE1LQpxdZaoyLJoVd+fBoU9fr+ab:3v3MwL3nV7pxdZQuVs6W
TLSH
T1B9C833DCDC7ADA27EF61265469EC26D8D8A4104BD5F0C8E75AFC53436833AC0528E36E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL.h
- Size 5KB
- SHA256 855416dcf055048c96bbbe94fa844bae75e9d2f7a3a13c14bd7421feb480e628
- MD5 9279717c6770db83127c4b3f4fe6f0a5
- SHA1 10b7a816f13ccc2e16fcd784c8a4b15c08aa83f9
- SHA512 e5473e2a6c34a830849f9d93c0194bbb3bdde3f9bc74962aaebe114df0a1af947ab562c2eb7218f4b5352ef250c75c71f806428f62afd9e2388155138a05e8d9
- SSDEEP 96:z+D1t2oQp/Sx0Wh1a8MFjuAxt7gKO2q8p+N9Z4ViglZMlNJv0+PWm/OnG9vHzZB0:Y2Tp/SWy1tM5uAQKpe9vdB6vbciGg18G
- TLSH
  T10CB17459929F123364B74174360AE845DB2B756617C934CE3CAD52CC6B122C823B7FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_assert.h
- Size 10KB
- SHA256 322dff426215cc6756963a6d723006a76b1841b6a93e5c44a8aa4498d35689d7
- MD5 8eb8e8874dc98a8a12730f3f3c25c852
- SHA1 2eb46e1412faf945d670352c25785950d007a6d4
- SHA512 b7b75504de0f2513828617b00b331e05f1e505a9d308a66c745780a8703f57de29cd109cf5787b76e67f3354db1d00e706e2fc8f79be020cdcd7bfa53c7be12f
- SSDEEP 192:Ubz8UcbS8n5FS12q8uT3yt1JiW3o5EXIpqNfFbg2JBdaZtA6QTgk/:Ez8UcbS8n5FS12qdy3JibOgM
- TLSH
  T1573272363BCB1A6640377238544CC501EA62BF6B325A54E43CBF535C3F2115166BBEBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_atomic.h
- Size 9KB
- SHA256 d27aac6841fd30d6c8efd0f3c71d9381f51200366ccb441bbe8c76ff7a96ec25
- MD5 456f08ffba01a959b3e179c7c19db12a
- SHA1 7ede2a8d3038b2d3733bedb4824b990417aad69c
- SHA512 6c6a1d740412384805f5e550834771f0e66815c0759f1d9a1dd6340845e6eb41e06312054b138f42fb04712a2d1ef17c5de9fa863e7f39d3c71581fa6613e16d
- SSDEEP 192:/+Zehf8dXsP8Ah8G+8nba8BEkzGMfKFbC3ryjVm:GAhUXk8AhO8nba8BEkzGMfKFbC3ryjA
- TLSH
  T1AF12B5897FEB2347027602B4FD1CC062DA95F529331826EE3C9BC4A82F1455D1276EEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_audio.h
- Size 20KB
- SHA256 a22a82ae34c482f16762f8167628fd890f6485e8db952edaedaa916450292589
- MD5 d1121591a06b1aadbbeb931a3cb02cac
- SHA1 0002a30e84753e7dc1c7f038c53d4d0c292f5914
- SHA512 8e8cccdbd3c9a7d219d15772691664b3c37c97bbed1bd795396dedd9b5f160c173c204f1ffe94b8b2cd892dc3a1587cf2c3488908146f5d6852d5c914da70437
- SSDEEP 384:WlyoJ05FXku4s5J4Vhu1cmn+AD37l+mYHpvCwsrjvYn:WlyU0vP4s5JQhQjn+ADLl+mHrUn
- TLSH
  T1E792B44A3A873362403361B17A58E19FDF21E2A7218450C93C6EA5B51F379F593B2F8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_bits.h
- Size 2KB
- SHA256 b4cb27b02cdc586a5403d706f34af0555245e61bcdffaa6fb301d03dafa23578
- MD5 6b3058ae360ed6cbe0ce592eae3611df
- SHA1 54c349459343a3d0c51acd575b562b6ff8fd0458
- SHA512 37739201e7155a4d0e9cfc872e1a6a7a59d534447431c39527bd7942456500adcc689de859b6b014d32d927a5e74bd0cb3b6a85acd3c6d769e70f6b9f6631c32
- TLSH
  T10A5174092BCB533220B302746A4A89C8F319A81767D561C8B4AD80D43F377AA1179F9E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_blendmode.h
- Size 2KB
- SHA256 1e9d8fb3a2550bb8690aa8dffb1cc9f25c50f18c5079a113e003cc67ef308f7c
- MD5 b57e8096799f7a90e9de805cd001465f
- SHA1 c412490eefcc8b5ad1ada4523faa940acbe34216
- SHA512 bf77696b631c2b8ec878d6c491beb848caebea71956b47e6db36fce92067535daece7e4c8d4d344fe122aff7acd7e62abf71082ef34c072ca63c76ec982c786b
- TLSH
  T1C141679137DF676394F200B27649B088F727756167C912DD385E91C87B2E2A41234A6E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_clipboard.h
- Size 1KB
- SHA256 625147a339053cad666958b5b0a6b0d666a95379a117c06397ed92d69b2710af
- MD5 a2343b4d1e8612f8e82a7650697bb4b2
- SHA1 30fe8305b7fd5ad11f37c41a19dabb2af4bb8ab8
- SHA512 5e3df167e0aa29b5a014cfaca300c9ae1c6def25e10874f5571aab417626847315faa4f828dc5738efe8bb7f91eab6ae66620886576c418af62f7366a08372ff
- TLSH
  T10141200632CF5327F0F741753407C486E60D72617B0C66C87CDEE4C82B66298123EE9A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_cpuinfo.h
- Size 4KB
- SHA256 9f1398305342cb142de34734812cfc86b4abef3bfab7d2e68a0356eb44e505f9
- MD5 88e851181d23b84c1049bb459abab563
- SHA1 ae0a5acd19842216ecabbd6857b2230bfe76b055
- SHA512 4e5d840271e6fcd1bd2d0d3b4cfe4cf0ed03d951900b6716995f62624e22bd5be6d91ef252a7903fd8bf8e33ca5b906022b5f31f3fd8b87efc397a2240e37862
- SSDEEP 96:z+D1tBmtR7rDqUqaTwpPbwd7rMrDUfWlU7AdstuSXCJnuN8Oa:YBmtRrTq3PbwxrMnUfWlU8dstuSXCJnz
- TLSH
  T1A991519E7CD7F36154B70173911BC165AE88F882569221987CE7E0D82B17688133EEDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_egl.h
- Size 56KB
- SHA256 2cb783339c598bdab26cbb6f006dab729c3e21d28221c5830e30d8c3a1ee4713
- MD5 769fd9883d4a80150ca162ac7ca7e9e8
- SHA1 7259e777bd85ec27517495b25b666b252301eb59
- SHA512 02512cd4962ca0ae82b9f8606fd1ae8f8ef5a7f2b7443a3b794ffafb5644fdb545e43dd0285d868d26fbb325285750071639a36351705aff40f8d69673d16f9d
- SSDEEP 768:iKnzPCgTZD/coNBVT3xK/SUs0RQW+Hrt4ms:iK79bPNB6HmW+ds
- TLSH
  T18D43A8190DCA96621C35F052522D2167CA7AD47F15F622F8788C79DC2F6AA8280FF7DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_endian.h
- Size 6KB
- SHA256 6cbd992db1271b696f28a71e0ee36c42c46ea7da76d5f28327cf0e30dedefcb7
- MD5 5111b2f55f197fee65a440be2fa460dd
- SHA1 f4a8876965589fc71322154edc0650770ad8d01d
- SHA512 b56c80d6de034e48a0d70d81ea594663d6e90fde12e00fd2ff857bee85fc2f2c5bae95a133c69087d5e6240a585d4975568b89380203676cc87fc4dcec279af9
- SSDEEP 192:Y4je2x3H6Xk7khRD8BEN8BoN8nbjK8naG1e28B6ZN8BrN8nbgY8naGI44f8BrW8q:xx3H6Xk7kL8Bs8BI8nb28naGR8B6D8Bu
- TLSH
  T11AD1EFE02FE3A256013E1034535DD107EA09FCEB46DD29E4389F9D196F2A45E61E0DAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_error.h
- Size 2KB
- SHA256 c9c7ae63981ce7ab00ee0b0446a07af5e022c2c06d5c44ab8269250d343fbd44
- MD5 cfa570b698fbb28589324a071cc3533f
- SHA1 1b754504a6f136757cd92cc5a18a068a5f138a48
- SHA512 b3a02057a399ab1aa2e7e749909a3283d593e2bf1005f7bfa3a3cbce65d8d9f78207b75d9861211d545b27ab4fa606cf09b87369719940b206d1845870f28742
- TLSH
  T1B141726A33DF632300F701743405C442EA6AF1227209248C3C9BA6C92B6B5DA5D35FBF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_events.h
- Size 26KB
- SHA256 f5e3f1c04f02c876619c1221681227760715c859350d282b0c9230dd83b28963
- MD5 86ed5f1c12a48797731ad8a61cd63126
- SHA1 ba0033cb951d082e7a107978bc139a38e946a228
- SHA512 5e6b203ccdc58c8f8749d797a31fd44b2ea8c621fcbd957eb92cefe7a71ee70b090a8792261e5f736a541758bfd323a36be5ace16d0321f6d25549bfca93003e
- SSDEEP 384:+lDrIcCSRAEOd4uTzkRhON2rpT8KG7kfj8w:QufkaS1
- TLSH
  T1BAC2219123837793167A01BAB74DE45ADA76D5FB6644B4C23C7C0EB82F301E90261F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_filesystem.h
- Size 5KB
- SHA256 1cf25698f5e66cdec901a27e976448c19f8d9470e27ae1ad492c4c23ed928238
- MD5 77a7adaa85ea581c9d2ced8bf0d4f2c5
- SHA1 de2a91c50623ec7045d1d4f105a20fd230ba5afa
- SHA512 e1828f89d2c31abf3ca670016895758506be3daa880d8463f1d0660c48608b7d5ee8254d42740bbe04c1d24a68d1a95e071fa88699d0d9e01e1f3feb95405df5
- SSDEEP 96:z+D1tAKomHvUN0IoqK5hSTQ/gwTbwv9UN0dYH7kGaH:YAKouvU2ZqRQYwTbYU2dNH
- TLSH
  T14CB1965A7BCA532245F30379230ED5C1E71AB6A53359195838AD80847F26BFE0337FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/sdl2-2.0.3/include/SDL_gamecontroller.h
- Size 10KB
- SHA256 e5358807717dbd673bc711cf7c96332aeacc79bb90a40634f481f15b4585e29b
- MD5 12eabe6724c0f8b16f8649056b5a056e
- SHA1 0bc0021bbdd2d19af67f9d2eb4ae86d88eefcf08
- SHA512 87c3ff68f32a2a9e0576980a43b6cdde78d4e4bb23a1d4369daee5d0b822015f9b055874e5edba5f8ecd184ef1396a7e11c67bdc09e1afea10cc73e33219781f
- SSDEEP 192:YLURL+ra0tKNna8xm2yvjIsrSlJetijtF9rtRKo5NDB/Ogtnkq0E6GAA68FtKN4U:IMpjyK5NAdORi2K
- TLSH
  T1B422CB89627723B607F500BCF207E93CDDD5B2B1B001648B3EAD2DD617A62D940BB997
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/vulkan-1.0.49.0/include/vulkan/spirv.hpp
- Size 30KB
- SHA256 4570a98143f523b0c00f46a593888809d8ba1f49563f590bbefc1d68643d091e
- MD5 f2661f5004e7420cdfdedaf80671269c
- SHA1 43504d890864680a4b1ee5565419804e5a68ce88
- SHA512 59961e668b7273c7bde261c62122651aec3c8e3f88706842aec59abee932f778a9f6a788691b78a4e374137ce6fba6aae4bfc4b5a13bab9e9d825e51c9451e47
- SSDEEP 768:+J2n3O9aeCSNk+xeKFB2HEs6Rgl0Dmvub3tODLUO0IkYEbO7C+eEap0CRGVxeBVt:+JO3O9aeCSNk+xeKFB2HEs6Rgl0Dmvun
- TLSH
  T149D2625826154338E43A6611B8E41809DE343B935CCA5687723ACD788F7BB9DC3B67CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  imgui template by byte/openvr_sdk/samples/thirdparty/vulkan-1.0.49.0/include/vulkan/spirv.py
- Size 26KB
- SHA256 4b745abe470b18eb677b86a236946cc0cca1e27101450b2da6a27272db363de4
- MD5 61512f5ba9b8a20854cf244fdab86771
- SHA1 6f870c9a1830edaf7bd7425a5bfadb27e2d7ccbc
- SHA512 389b6f04f5840da3d05a5cefcd88c3f930d0fcd1e35c5e5a0245c95acb5202aa7f449b866d0459df89849224a4c04337a47c132cb40fc483a8606be4e82c2e44
- SSDEEP 384:7iaaI8k1q2nUUp/ao9YwCw71m4x2vyvA0jwW+EwDjEVw5hkRDUuk:7r8kFlYJ4xDvA08W+EkjEC8p0
- TLSH
  T184C2975D35A38E2EB03AC26739A4EB09D2453F5750C90B07317D8D401FFB26A15AABBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32