44b512b25af500724ba579d0a53c8fc5851628b692dd5e5d94ae4a15c2cba9ec

Sharing

Copy URL Twitter E-mail

General

Target
exiftool-13.59_64.zip
Size 10.7MB
Sample260705-wb8ecsat4k
SHA256 44b512b25af500724ba579d0a53c8fc5851628b692dd5e5d94ae4a15c2cba9ec
MD5 df4fa1b736f0b8d39bd09b15fbdb865c
SHA1 022b902bb3d01b171d5108e2c4be59491eb64444
SHA512 e6e5adf244b3bdcfaf7a266135d8bb8d4ae889c463c2dbeb3ed4f1262af27e2a189f5888969fcde1ee33317a50e35e8ea66f7b318829adecf78619b42a55bb21
SSDEEP 196608:Gz4hQPLEyOJPCuurdVwGXp42yknoJMmwdlb89agpJj+G:Q5PYlwHalkou9KFrjt
TLSH
T1D8B63327E67C28F0E75DF1F889060A03D476B543B493379B2814A642DA5F6C31B6BBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  exiftool-13.59_64/exiftool(-k).exe
- Size 57KB
- SHA256 68c079c32fdae0d6c7130e9a5fb73f8ac9dabdf9ab8da312da4f6c549d6d3385
- MD5 ba6ca9779600931a434680f4e753e4e3
- SHA1 f3f3b8a65267535f9915d077228fc546481b8897
- SHA512 6a76839072e6c139430dd6c00dbe8f7955e19f11f41cb65764455f0404b5f85fce8206622ea9fe38cbd4b8de8c52dc3dff28dd78181f8b568e91b4cb2ae52f50
- SSDEEP 768:c0lPKYcrT+QNK96kbKFOjHJObT0055qjaJwYjPClT2lCpsukU:LtbQqQIjHJObY0I0PClT24ps1U
- TLSH
  T17E438CE6B256E49AC351C1B8D89ADBF760BD7C3188220B1B39D1BBDE3E74B744E06444
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  exiftool-13.59_64/exiftool_files/lib/Carp.pm
- Size 35KB
- SHA256 89ce58db6934387bcbab17a4972b75c0d0153335291cd8a762f8341af0bef5ae
- MD5 01d59a664a69ffaed1bd0300ba0c7134
- SHA1 8731263b8e01f6015383c161804dd3a985cbb298
- SHA512 534bf8624ffb73eaafcae949a0ef8da76fe6aef98029dcadf4901d87aec869450bd0e74c39463483473bb77aa3f2d224a44dca8a36fb6c0457aa6b5e9947a12a
- SSDEEP 768:XwPq0dUwWf43jbwKLlh5MMO/pbVPdAx6j/d8fgAB/5:WqqjSwjaBPPdAW/d8I6
- TLSH
  T1B2F2F92A17C34376185232745BCFE260F779D57B22A9D8A0789C826C7F45D3882B57F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  exiftool-13.59_64/exiftool_files/lib/Compress/Raw/Lzma.pm
- Size 24KB
- SHA256 9cdffb9e4ab5b5f8df1f75312628bc82125186222df7d0f54d1520e773f76836
- MD5 ad05fbf21d1bf4223511569076450866
- SHA1 00747266beec0d10def52fd0f4187f5469d85240
- SHA512 76cf8997f72b6963e4ea2fe5cc2368564058a4c0871a93aecdb41284aa4da7e1719b6eec3af57c1b15ce5cf0b3a9ac5191acf065871ffc2c906dafc9695cdbc9
- SSDEEP 192:SrnzVErJ/aTKqSmdvYOizu4ygK5vKU+WRo/6367660TWejxw2sAm9sAm8s/mb1ms:enzVErWK3mD4ygK5TcAzfEofMI2
- TLSH
  T108B231A0BCD32654BD73403F3FCD9DC6693E1097265A9D9138AC15A06F8E838D6B92DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  exiftool-13.59_64/exiftool_files/lib/Config_git.pl
- Size 421B
- SHA256 3a32b99bfc9b3d6d353dd0c873e483a31823e99f5d84f847cc7ced9c759ad913
- MD5 6759074fbcfac87fb3332f43cfe64379
- SHA1 14cbc0ab1177b572d8153c59c657b3dc15c9f655
- SHA512 c58e651992131b5f2d574c7b26a48e56cc911ceb9c2a06d7ebefd94322d11390e5b7e21e2dd2d280c996f112151e930b8f23f81280794daa78066bd2c80ddefb
- TLSH
  T124E0C2EA07F94C121B315490A56A0C2622A5A6442EA7B435393CE8A4E3B96B82C0085A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  exiftool-13.59_64/exiftool_files/lib/Config_heavy.pl
- Size 39KB
- SHA256 1bc2ec293f64aa5971abee71e5dc8c2df0b7602ad1ffa02ed3db6578f309b03f
- MD5 74ad8fd5f09db8456a61d07266baf162
- SHA1 90998b06718fae055a01c2ee20a5d13126c09642
- SHA512 c3dbdf33fcc21a5c12b810cb76c4faf5ce17aa49d017a22f4aa2d2213ddb0bc8e54bc2d39ca6049c35e9f175b8a3aec9097a2ad82aaf5008564687ea1bb3eaa4
- SSDEEP 768:gHbR2hEQXDJtC0Nu69sC0CAq0LDJ3G3Swyzo0fe:g7LQXDjPsvZEoc
- TLSH
  T16403A7C5D49B085B2CD682BA892D8807A509C963C33ED854F81FB70EDB5D634C36E977
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  exiftool-13.59_64/exiftool_files/lib/Data/Dumper.pm
- Size 44KB
- SHA256 fa21074814598d34519ee83d4bbd66bca64b9b7291ff4d36a7453122bc21333f
- MD5 ebafdbf6302e9ad5e27af989dd805aa7
- SHA1 cfb95e0846cb869d4d9c71034a20b211b54ffd54
- SHA512 12bbcb959a2d96614cb07305d7e15fe180d983026c84a4ab0189c494d4c8290e8ed3513bbfacbca8131bd6bc22ddaa6d8dbeee08af5ecd15eeb2d9b7fce2c3a9
- SSDEEP 768:F8A+uK5b3fwLEmp2S4zeQ/z5UbafoipVHXEicX09WM6ccp+L:FB+uK5bwo22z6Q/lU+AQHcXIKoL
- TLSH
  T18823091A728743B40A1325756BCED054FB5DC52B936AA86078DC80DCBF81E7DC3B6AE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  exiftool-13.59_64/exiftool_files/lib/File/Glob.pm
- Size 12KB
- SHA256 ff854e2cccfcd78e6c22278c843ea61fda1d0164704b1aa8941fe05ff9dbbfe8
- MD5 9339f9e86bd5ed7caff8f0d42495e422
- SHA1 6269c492463a392b224e710c348e926f964b3189
- SHA512 f0b0f10e61680498d2c5a8921bf86b226f5137c8e592fd5e1dfa1d64d62ed7853c5283e05f6bd877a4edf26bed6e38a4a6985994b3d5e7398030482404b21bb3
- SSDEEP 384:Jtd8MlnrZLtxV30jQL+f+l4DTZPMRvDgQni8B2iPrNDS8rs1OrsfL9WAF:fblnrZLh0jhHZMni8phS85u9lF
- TLSH
  T1D442FA2F57C963B7849302AD130E95D6B3AAC07F532D9A1578BCA18C2F538A5C7B68D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  exiftool-13.59_64/exiftool_files/lib/IO/Uncompress/Base.pm
- Size 37KB
- SHA256 9f229d9467a12165ac6a0962ce2aa09969b0b9f43b809f6caf0a563a4338ebfd
- MD5 cc35a7ee132af7fbb5de8754fc9da169
- SHA1 77b9ae31665478a1bf0285e4a8bf5240ff503408
- SHA512 d4219136b8af9d7c18551b9ad59ed9148a138bcf5ccdf4f5de40cf1fb15364c4c9eea0e6a0f0480fc49d901de266ff996c0edbd5671dd9440d81fb8832c88eaa
- SSDEEP 384:D1J/CD+nojrrOp57rkc7GziAEBNYCAYIc5iRPFFT6MW3taojPC2:D1J/CKojrrOp5rxyBbCHiRvC3tjPH
- TLSH
  T14703FFE0B9E391516696203A0FCD8898E62E44530D6DDE30B8BCD2957FC1D3AD9F939C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool.pm
- Size 440KB
- SHA256 95fa4ec3cc3603866dd6e37bfe52ad019ff50a23bbd5cc87ce40f949cf49a508
- MD5 0f27a7f112707e23291dcdf74956a044
- SHA1 a5bc4994e73e052030ec291612bf835db92535e5
- SHA512 1274ea0752d265097f1143e35c1cf0432550ecd8909494dfb8183c4ff3cce0ec4dea9b523661a8d61a22abf141c24bc827d0ff0f27f765d390ca704f768641cb
- SSDEEP 6144:Rh8Bblp77DhhyoQORJs2ftaeiX8Mp96YAdIpMy3SYKtJAH2:j8xX77LyoQOnsIaeiX8nFYKtSH2
- TLSH
  T1CCA4C61A3ED392255293E0352BCE9101EB29C1571A0CEA21B89C95C47F85E3DD6FE7EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool/GPS.pm
- Size 20KB
- SHA256 f62c9576a405a636585340b9358202cdb0b2a926368609716764b2e05a337443
- MD5 bffeb0afc1bc176bff946e7a94859a7c
- SHA1 e78c58dfd74122a99c435f469d0b22acf07a10f0
- SHA512 407843b70dbf83c2e98403013bfe701f998c4f5b72791c2bc99b26bb15bc678386937f6a4d691c85fed79d1146f2e3248bb953384235222377ab28efcd3fc289
- SSDEEP 192:CRzDkpSbtfMBBlA6HBo6JHVsCegm/xqmOUHQu6RwIufAynMETakWC6JE2oW5XmVF:CNwYuBhQ4pjg+VnVVVSHq4cvwB
- TLSH
  T105A210259EE145591413F03A2B8E1409EBAA19D75FAE7B12F84DA1883F0DD3CC5BCF68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool/Geolocation.pm
- Size 37KB
- SHA256 c3a5c462fdf672342649b9febc3a497dd3c855aa4163a709f13d786630346eb6
- MD5 3f5ff419c5727241ac525a51aa861c84
- SHA1 f3d8aba2e8ad00d08194373e3523e837c0aadea7
- SHA512 d893f4a110fb5954d6e514da0875661e24b939b29cc28d71175c98954197d60ad01757084fa8f5a0e7679752c6429890e4c71f63323018c2044be79d8fa6784c
- SSDEEP 384:Cr9cyKzjZhlm7MXOwXONvQXN1yRGF4davG4LJ/4VuOfMNk5yqPn9gDbD6:+cyKzhokONY9t/vG4LiVuOf7yYKDf6
- TLSH
  T15C03755A2E931B1452E3C0B61BC9D044D72EE567E2099520BD9CC3946F42AB8E3FFE94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool/Geotag.pm
- Size 76KB
- SHA256 e405d4bac1824001709d80270cc1feab96f034f0c89af85362ae4542a09d00e2
- MD5 608623e03cae6deef1620ea1bf812d0a
- SHA1 05a99df41f2f10fe3c6c4ccbaae7d1b04344662f
- SHA512 33126687d17c196a5b501699f6dcde3aa1701850ef168cf12ef3dab4f8d2ffd90f10ce1ff7ec229370637459e1242cb8c731b64ecf1100c06864153c8c3ac6bd
- SSDEEP 1536:EXSJQaALtSIotBKK5+5/ccbMK53QcYxO4i:nQdfo2K5+50RcQcYBi
- TLSH
  T15173E7523ED312254253F0299BCE5854EB2EC1A76789DE2878EC81C83F41978E6FD7D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool/HtmlDump.pm
- Size 32KB
- SHA256 a02dd96f159a4a96ee649efdb6a1a43bd289cd5912f7da150b08e488ff5a249a
- MD5 8d8160f2eae3299973407f60bb894694
- SHA1 6add6e5585dbd37bf2717785163e131f953c04c7
- SHA512 62b3ff1261c5f29bd7c255edd491e783dbe41a37d0ccb74f8ed941267301a40431ef6298ea180dddb56c6e054d0d54cc986b9e39cf71c3e23954f60959cc41a3
- SSDEEP 768:Xlj/NmQp5oKDy1QbnwTjHVVsut7S5Ij8u4EfjZPjryV:Vj/NmQp5oKDjwXHrsU7S5yti
- TLSH
  T10EE2D61A7DE3112294A3E42A5BC9A214F77AC0436608CD247CAC81C46F95F39D9FDBDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool/ID3.pm
- Size 60KB
- SHA256 92a3c9fa73094191c2000923bd07527504c1d8573a094556628d8de8e57ca43b
- MD5 128cb94b4b5934fafc37d5db41e6c591
- SHA1 2a880f34623d5961f89977382918fd6833a5d86a
- SHA512 b69aecc027b56335de632ed86f90d577aabc4861a652f8142f13b20fa3590074be825ea79950e98e6a0789180f17b97d41fee918864a9fcb163a91a7012c6b62
- SSDEEP 1536:QLU6Owv/TIsljErHRDYyg1c6JK0IjhBJaMLM:8Owv/TIslyDYyh0IVBJaMLM
- TLSH
  T18753A7362DE351646253D02437DE6802E7A9A1C70E94BA23BD8CB1886F0DE3CD6FD759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool/IPTC.pm
- Size 40KB
- SHA256 07508467219121f9552215f715439716fca94825c3e96eafe1363d8009072ffa
- MD5 7fa0a14ec41367f8e90f22c27e960300
- SHA1 6b27b79da48bf9fe9ed7e68796a10f8c5f1af002
- SHA512 70e7f0f73293eedc2729686c2b947bde605d80263bf7ca2946c86da020571195cd9a2d155da303003799e671fcd8b7e704e4397e4f37c7655311c826bc45b604
- SSDEEP 768:a+7fQUlr0UtR+JxavH/mUIcGkGZDwXQiv5M6tNs+C5tczQuVCi:cUjv/mUIzy5MBbczQuMi
- TLSH
  T1F303DD3A0CF141689153E0361B5E6505FA6A60EB4EE9BF23B99DB1483F0DE3C42BD718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  exiftool-13.59_64/exiftool_files/lib/Image/ExifTool/MWG.pm
- Size 30KB
- SHA256 f46d2a5afb7d6cfa174ac28ef855809499630f7d32107e3babee3711f68be96c
- MD5 15e35da804ce4ae202891045b541ecff
- SHA1 b4265447657e00dfa75fc26a81ddf5b1e1a3eca6
- SHA512 5c835887f5a6f40332f81e1719c28483629f37becf8554e4a6f44c57d0c1b0f351cb3f55c004ab757c08ba200b5e95e5d881fc468d3f42ff8c99dcadb563a3ba
- SSDEEP 768:r0CozMRTkcri3qUjhjzjojVs9CQVKYBZDsyaIlKuEci:YCUMRTkcrZUjhjzjojVs9CQVKYBiyZPi
- TLSH
  T197E265135DE256681B63D0673A4F9006F628A99B4D5E7A2AFC6D60081F0DE7CC2FF394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32