d0326fe0338948001b214ea90c077fb1fe7e3d1b1f9a61a59517897b63efcb5c

Sharing

Copy URL Twitter E-mail

General

Target
arkasm-win64-beta.zip
Size 14.4MB
Sample260706-mayn4adv5v
SHA256 d0326fe0338948001b214ea90c077fb1fe7e3d1b1f9a61a59517897b63efcb5c
MD5 2eb16058dd17a190a89c2b803ec864cf
SHA1 0e1ef6ccf46846d604c1a4526831d757f55982b5
SHA512 a9760b6305ceb63e18ba3e9ba77a76def95a8f86cd6b9d227c5ea3aa8fd1e33ac5b266b42f734741db5a2885eed9661fb877c73d9a65a3451021faeed0a5b609
SSDEEP 393216:3NJZTbRDY1wWWhfiGTLgIpJmIlaVfaYyE4Q+ZIGghB6WmT4nxdBkx2EHXJ:ZTbRDY1wWWhHT7bmMacYyE4zZ2H6WmTT
TLSH
T18CE633922851CF3EC4B89CFD654C973CA2B6ACC3823706D1C4AD15651492BEBEB6FD09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Arkasm.dll
- Size 13.0MB
- SHA256 ce637e40c97a020a355d5b5a2577c90ea655dd9344f395808cb40ac247affb56
- MD5 5c93548ce1c4ade34131cc58c28e7705
- SHA1 a166c24acc3123dfc6787c356739155f4c36bdd6
- SHA512 9a7295a6bf6442e1b3add732ae056b2dc2e568566304a0879e7701f895a5fb1f55eb27e5cb1142cdd7b0592174883a9d033cc98c7d599b1a1d127e82208a21fb
- SSDEEP 393216:PJQl69ILatDy1fo4/lGM7AzydQlqyaso4/lGM7hyl:PJd9ILatDy1j/X1d1yaA/Xtyl
- TLSH
  T134D6E1F46FCEDC04CCBAADFBE022A5D5F532DA43A692C514EDFC101E1DA678B5856202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Arkasm.exe
- Size 335KB
- SHA256 49dff10e1ee0e5baf734d2333aec826854e7eed0174200a40524fb1fdc39d495
- MD5 1237ccbe53f1b11334d767f0fc0cc1fa
- SHA1 2c8f7415c0cc68e690e7ef4bfeb0e899993ded68
- SHA512 0f243e031b8c7d05a1d488678ee4e900c461d9e99fb8f16c37b016cfa919fde99cc8415c3c3bbd775d59045926c9ecaae3925a70613c6cf9b82f0ea46f4dbbec
- SSDEEP 6144:yvgvkNFNaxmNETJMhBbLnqM5LwEU5KRiD+Gm5t9gLl4q2OUvls8:yvggNaxmXhhbqM5MEU5Wijm5gGqwv/
- TLSH
  T1B174CF03A2A841BEE1B6DA39C9924941FB73BC558771A6CF535049761F73BD0AF3A302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Discord.Net.Commands.dll
- Size 134KB
- SHA256 2e2564acdb1ebffc5c4e5aa829c2e38d7e680ce884991b640793bb923b73cc48
- MD5 139fe2811f49e478f44bad7ec3a22892
- SHA1 1b31dca42742a6a7048ed0f7a794a21f72c76be2
- SHA512 88d0a9660d18d57f15b61b321236f45346a580958dfabdf975bd8f191aa03dcbe5e10f6458d73fc02f583b51fe8246944c63fbc7b278af23df231010d92fba63
- SSDEEP 1536:yzTLbqm4ds47OpU3hONr4nssMloRaj+2CqYsAaiOUtfMjYgmz9zvKedWXk0wJ61C:yzTHuxOu3aqRajDW/aAWYg+9ziO0DC
- TLSH
  T1FBD35D3993EC4B23C6AF7BF9F4A0112507FAE60AE8AEF3495D9CA8DD195135059103B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Discord.Net.Core.dll
- Size 899KB
- SHA256 562ea915901f212c133f5cdc5153f00fc221564064cbecb02934450bad77004c
- MD5 4d0bdcbb77dac55cc6de7e5d83b8e0f6
- SHA1 f8daa22140cc7ff38ecde8d9c70f3ac80f88d939
- SHA512 5c6ad56ff2b77f56f27f3c8ed64e32468eb6dd586760f36aa311db287f5fe230e53e19274cc35fc9f600642e9dcad3b662ae8227eecf537bb59f50addc95a191
- SSDEEP 12288:2fd12Z6dnzsy2DFB7BuGiz9UDp58aO0cscwiYyAvgvu1znGOWWi4iYyJ6hsTwh6S:EdwAdzsy2DFB7B
- TLSH
  T1CD15224022F45A3DF9F79F33667AB4512679BEEA1A72D64D0844344D087EB8289E0F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Discord.Net.Interactions.dll
- Size 234KB
- SHA256 ccb837985fe7e0c6c55578a5e51692fc0acce80829961a4e02cf4c5f16ddb56d
- MD5 e52379adaf39dc650d09f0a567298533
- SHA1 36c57e234ebe8229eec44756d43da033e6050531
- SHA512 92f4563a154ae035e5c9cbf85f360a6dc7b2beac92f6dfa0cb0c037e77ee207c997183f3803323c778809b0b573e99c69fbab039577b5e6eb2529c76f773c3ab
- SSDEEP 3072:CJGjBniwwOXVp7oq7lJRTIM6Q5fVA0KLCftw3aqEqbLABoLY6SZQ55ZBYnxOvA6:C89nsCz7zlJRzf8LDrEqsmZd
- TLSH
  T102344B3463FC4726DEAF5739F4704418CBF5EA0AE5A9E75D0D4CA8E928A7B5098403B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Discord.Net.Rest.dll
- Size 1.4MB
- SHA256 da0e80e2a626acc8ef5da93e97593247d74776d6f6731d7bebfefd8825d46d86
- MD5 6803bd968c4785da8f6a6aaa03b49325
- SHA1 e095e6756067a6f492b59fed1b32d7f3822a597a
- SHA512 6fd0e47344cf9acdc3a3e45243f35b3fa13e05e881710100169ade85dc25b58501688933b5650acbb5c18f5fd7e97b0c8176663b79026eb760b88a41ed7a8793
- SSDEEP 24576:hP7Q24mhykII2s+aBK///rO4NU8mqTzD5XqYXbQqh2AvX:hTr+u8DTEYZ
- TLSH
  T1076509663A98FB39C59F6135E460C2299772E5C097D2E7EA0768BFBF3C427411C08276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Discord.Net.WebSocket.dll
- Size 917KB
- SHA256 477dfad5b54c07551b4ef1f472933ab42fe0f4824d71ec5edc5dc86137f364a1
- MD5 b82a8d717f6f34b64d31853f29411a63
- SHA1 f0f4ecb3dcffd07cf0a4bc87ee10c34254f54ece
- SHA512 ef8c070687adcdc80bfd56e84cb5ffff9a52b700f9cb1f1f791e15ec3cb6ca9ea330d4cd4c0f65dd083717acf77a620c287075958587f4530bd866435cfa2848
- SSDEEP 12288:BRGAUZ/C/GglB1xsC3Uv9ZoBQ4TmMBEBtjY:BRGAUNFwBQX3BtjY
- TLSH
  T154153D5773A8DA36CDDF733AD210829483A1C696E1D6F349170DE9F6BC423434E286A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Discord.Net.Webhook.dll
- Size 31KB
- SHA256 0a6fda2521102afcbd1313f4bb176e485b17d65494983bd79177a29de3fc6a5d
- MD5 857e53594b844ef8f023d13fa9b0454d
- SHA1 8ca1893a65bfa22b45b0e3020188e5473d9c8952
- SHA512 f698a66f4d40b1f608280eec2728c5ff581feba5afce342f1aefc1d3be44babe35cf4f0f2750eba959f9fa6f145a29d0cbae47ba904ab48d07539eb5e6df7db8
- SSDEEP 768:MwURE2ig0US4qfhkuqXTDg+pUJ35qXtFZu:zURN0US4Gk1ZpO+FZu
- TLSH
  T1E5E2181853ACC72ADAEF6BF9F470121917B2EE016413FB451D4DA6ED1953BC22A04BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Microsoft.Bcl.AsyncInterfaces.dll
- Size 15KB
- SHA256 5705d245072d3eb78400547b32147dbb6e2c8b02ba8bda76729798f5efdeaecb
- MD5 8074b0eeb2d4cf9b1a6b26865bf91aa5
- SHA1 2e438aef830795b2d240cf3160a3353bc6cb0232
- SHA512 05f7d9003427e611f011018844fb8180403cd6ca807e4c5a8beeed03e4cd7fd8babd89dec51a14510eef7c266ba4505b731eb065606d066b061751c89a1d772a
- SSDEEP 192:mzuPwZ40ytyqjaWeb/WIWOL8/pCuPHnhWgN7aAWDr/MqFCfvXqnajJ72h/j:7G40ywqjaWeb/Wg/uPHRN7yM9Xl172hb
- TLSH
  T10C722A91C7A84203EDB57FB05679D5463C3CB6D26C31922D1189E29A1CE7BC1EB31B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 62KB
- SHA256 a0106a638facae621f870eda720cb6c980c1d5d49c2f4351134e3fe043b9291b
- MD5 38236f9c2408bda46c13efef364326fe
- SHA1 03178026c200fd723bb75d08b9a4b70e93f6a45c
- SHA512 4abadae40a459be932359d6964c30e1e5fbef300736943bab42c1d66b5fa56c45ed10910acf6b36c302c8a40bc364df444220e2af8ff5854460c6a9542ff88b7
- SSDEEP 1536:KCYbKF0XEQqb72cfdGWQAE389HD6dDCN6rzf:MUbQAKuj6dGNAj
- TLSH
  T1C7534A54B3FC6727CBFF5A70327250219738BE4B2041F70A796BC0B509A27D855A1AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Microsoft.Extensions.Primitives.dll
- Size 38KB
- SHA256 5cd1d5c39b226ab4cc310d34f4f750803eccad0d22aa727dd9c24e592484d6fb
- MD5 f1dc305b279d844d3bf7c22a0ac4ded9
- SHA1 65d36c828a0c497b5acd02c33ec5b1f8f6857baa
- SHA512 ffd7a2bb2b23c17ab34505dba74acb04cc0b9cf0875400d6457511dd68f675458137071201430ef412fad426efee1d39da18533e7c8e472d92475bc4a9354ae3
- SSDEEP 768:QJ+wHl7tqTFj3HdiQVZyhZJ0zGOP0/WmmM3kuiWwZ1wDvd1z:QJ+w9tK39BDyhZuzGOP0/zmikuiWwD6P
- TLSH
  T1D6034B51A7E84333CFFE0B716065D1915B38E39A7422EB5EA44C61A40CA3BC597327BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Microsoft.Win32.TaskScheduler.dll
- Size 327KB
- SHA256 64e766bc4a5797079402a55cdf54b30d5d4a22f0dd849e83db3fe53d7b6feefc
- MD5 413a6c2790fecf21e19326c8c837c204
- SHA1 6412de7a715c6b88db191ccf81d6293c4cc56e27
- SHA512 6fb7164e731fabb241289da9f7f3246580b12d7eeb2af2a38f1cce583bb1f579de0d9a90b705b1b6d10536b32ea22442ee7d23eb1b4e957c4763a7426cfb5aa5
- SSDEEP 3072:jjqmC1WugqPHEJqTNSlAUEoo5gdg20ujQQMn5rpJoiZBHUKSRbS1xBRaKoRBia6I:KmjqjNSvjFM5dCcHh0StRserSo
- TLSH
  T18F646C6017FC8A36EEEF6739F07109118BB6F906E8A6DB1D1590D4DD8E23740D92236B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Newtonsoft.Json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH
  T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Semver.dll
- Size 71KB
- SHA256 a99edcb96efce3d6ff019c667e132d81d879f5a92bc9337591e0b7309d7f493f
- MD5 eb3d9a2385331f53c4c347ca6a9f9ebe
- SHA1 7ae49bbd5d79ed618511fbfe8286965d1daf051a
- SHA512 6a76bd50d158b762229acc73fd6b237f1b5f9388d49ee8ed8524d908a0ff12376d87954e878fb9d37a9baf86796bef7c57d74864b5b09314ab371e0642191778
- SSDEEP 1536:jyI1dwvCC7pE9NTxN//MWA62rj+UKOkyDjlAr:eI14CC7p0NTb/MmGaUVkoAr
- TLSH
  T1AD630A9123DC975AF2FF2734B4B022400B71FDA6BA75E75E8E4881E61823BD449617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  SteamCMD.ConPTY.dll
- Size 31KB
- SHA256 4e1567d3a1f4db6c03cea8390226447f68d7644812a87fa6eb88ddbe72458622
- MD5 490501b07ac48168a61675209b841db2
- SHA1 a60783c195e8b4158f11c9c5012e1926a441f396
- SHA512 296ef87662e2ad2d08ee79991a20212ff361488d97e41a7eae6bde922016a184fe1c24ec436b2648b08df6cf66240f46d687a23a9e77330ef1972cbbe7b64edf
- SSDEEP 768:AnsccEfhkQynVcK834opDrhdC1NZn9Y4M:/gu8KzoNhw1NZa
- TLSH
  T179E26C409BEC8677C66F9B7CEC71171243B2BD46721BEB9E158CA0D81E6336C48603A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  System.CodeDom.dll
- Size 179KB
- SHA256 ec5040b3470b1b50f94ce821d7a496fe664c461026ee3db27170f05088873913
- MD5 af3a38e10b41b9bb566080f15e98e1c6
- SHA1 e531c87f5a4c26c21a0d7e3b6745eaa39b35fc81
- SHA512 9034d7a22d2ae35fd967edabdaea58439e69ee95ee1a1fe24505376eba10885c65a16d20d527c121df5e5c3d0e7e182ec461714e2915b76b9a58712d64860dc4
- SSDEEP 3072:gguoL64ILt8TyvhrUkufnNdOGKUPSl4bru9RYSH+l0Qh1T5pM:i4ISevhrRanNMsu9CSKH8
- TLSH
  T1BA042964379C83B7DBAEA131E474065566FCA50F3242DB9F8D4664E55E23BC0FE20A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32