759dd82b719119e80eaabce0392053ca86cb84aa384658f54518f48b10c752c8

Sharing

Copy URL Twitter E-mail

General

Target
dark.zip
Size 46KB
Sample260706-qeb8fabv7r
SHA256 759dd82b719119e80eaabce0392053ca86cb84aa384658f54518f48b10c752c8
MD5 cc4b9723c345fb99ca3e7d3fb7b55aa8
SHA1 10e7c3949b0e0fb34c8859dede77a524555ddd03
SHA512 ab68a84c24946afe60f5a955024ffb74c67ea241510589d7f657afcea879deb9ef0ac5096bacd26bfd242e5589b35bc8555c846aeabeb4f172f8fdea62d96a40
SSDEEP 768:qNgkmOPzH5bTrAnMULIIJB+iI3CksAMNbaFkZA8fvcuhNTe:qBzpTknMuDP+cNbaFk5PhQ
TLSH
T105239F69C41E34DBFF0F85B4C50D865A986DA70A84F2671E53889C4B9DAF2C13B313DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  dark.zip
- Size 46KB
- SHA256 759dd82b719119e80eaabce0392053ca86cb84aa384658f54518f48b10c752c8
- MD5 cc4b9723c345fb99ca3e7d3fb7b55aa8
- SHA1 10e7c3949b0e0fb34c8859dede77a524555ddd03
- SHA512 ab68a84c24946afe60f5a955024ffb74c67ea241510589d7f657afcea879deb9ef0ac5096bacd26bfd242e5589b35bc8555c846aeabeb4f172f8fdea62d96a40
- SSDEEP 768:qNgkmOPzH5bTrAnMULIIJB+iI3CksAMNbaFkZA8fvcuhNTe:qBzpTknMuDP+cNbaFk5PhQ
- TLSH
  T105239F69C41E34DBFF0F85B4C50D865A986DA70A84F2671E53889C4B9DAF2C13B313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence
- Drops desktop.ini file(s)
behavioral1
- Target
  __MACOSX/._dark
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral2
- Target
  __MACOSX/dark/._Install.inf
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  __MACOSX/dark/._appstarting.ani
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral4
- Target
  __MACOSX/dark/._arrow.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5
- Target
  __MACOSX/dark/._crosshair.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  __MACOSX/dark/._hand.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7
- Target
  __MACOSX/dark/._help.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral8
- Target
  __MACOSX/dark/._ibeam.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral9
- Target
  __MACOSX/dark/._no.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  __MACOSX/dark/._nwpen.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11
- Target
  __MACOSX/dark/._person.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral12
- Target
  __MACOSX/dark/._pin.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13
- Target
  __MACOSX/dark/._sizeall.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral14
- Target
  __MACOSX/dark/._sizenesw.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15
- Target
  __MACOSX/dark/._sizens.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral16
- Target
  __MACOSX/dark/._sizenwse.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17
- Target
  __MACOSX/dark/._sizewe.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral18
- Target
  __MACOSX/dark/._uparrow.cur
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19
- Target
  __MACOSX/dark/._wait.ani
- Size 212B
- SHA256 e8e9049400cc4a3a8e7278ce04d69d1a0cd9de4ee49cda1a1d287262792886c6
- MD5 87dbf735c86e55deaeb5b7b9644d31f1
- SHA1 090ce7540183d9f7dcc26572165861af83159cd4
- SHA512 8d340036e4e2f91ae8961cd04cc36c814089b2db244e74faa3a47018e4ff604452ec8e3c64f9cbeea8fccbb2e0cd69c2292428df721079bfbabb973121f7a856
- TLSH
  T10AD08C9A82000788C802A9B004D39A80AAB892234EA25623BA2DE1811B009953258716
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  dark/Install.inf
- Size 2KB
- SHA256 82c8dfd9d384325402602628da7e2ac0ede79c2cf5840b0e985b76e11520669d
- MD5 648204713b4ef86f6a57eea4c32157de
- SHA1 9e4bb96bb72b70e441948a05962552e99f6b6b61
- SHA512 26eec80e3ee42714d398f3289503258beb709e4994f87da92b1dfe43010ecdd57bb2ee414872442912166ba8722092f9995e06c9a84d9f24479db5dac0d207fb
- TLSH
  T1405106055E91962BF9AACB1D7BF16F4F2017F6128CDC141D304EB4562F9A8D18F683A3
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral21
- Target
  dark/appstarting.ani
- Size 155KB
- SHA256 57ffec7713ad16ac420f58727408d34216e6e380263fc93185280207a647653b
- MD5 4be9da34ba180b5009cd80b605754646
- SHA1 b054ededce20e8acfc3372b7a699efc7099cbbca
- SHA512 a15acda5c38855f91b3c9ea216570727f6fb5d4b0329ef00986c3c1affeeef23298c9c396c5131285a207417eb7eda83b733121178144776f424c80efc7a475e
- SSDEEP 384:Cf4P4QOY90giIlZ9Zd99v9Ea9O9SC9HfLeIMnLoSmrPITD8uljg29s9DG5g97iWT:zbOY90giIl6+JESmrPI38+jgokW0
- TLSH
  T1C4F3236337519A06D0840B39D6F7C3757238ADA09F072B6B02C9FE7F39B22D4A766194
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22
- Target
  dark/arrow.cur
- Size 4KB
- SHA256 5d147ce99167984abbcddcbd90ffe8679fb267399165029d3d367d99cbd11141
- MD5 7603b647d1b5511f5ad20c2a192da257
- SHA1 b1c2497766872fbb555acfa5bb9496070d8c07ed
- SHA512 e2189d8cc2a873d0bb49d3a4128808654fe724602a7ff9d318168da694a86937555d5ab97f0c1e976b006b977d40ca89d26714e2f706d7c5dbf2979ffd056fa9
- SSDEEP 12:Cudy6C5s1j8CvXtyAtfrhcXdcVeBkCf4PB4lM7zNcMWGK9QOq+G55BKD:TdyE+C/wMhKcVcMXzBWGK9Qz+G4D
- TLSH
  T15E91A342335ABD0AE4182635D8E2D2F0A2245CD54F122B270ECABC1739B52E5D039943
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23
- Target
  dark/crosshair.cur
- Size 4KB
- SHA256 a08c66bd12308f80c10de35b4485aadd700adc2ee15bef382e100ea702f6e6d2
- MD5 1528a840b4bc573baf62b0dfd6d1c0d9
- SHA1 bf31f4e1ceac6e466fd70053e9ef2fa7304c6005
- SHA512 b521fa24c55e2319cc9d57ae44b4858de579a21615a2842fe537586ae72d72b7375143acaba0229d2a5ebf99ac022e17c2894a62d547f2a90a0443eaaa79905b
- SSDEEP 24:jVLlagX8RCD8IFas7k5SZya9Cr2rtkYJraWR+08IRFxLjqoCI/1s9kJUa1zaQkbn:59sCiSv9CrktkIZ9F9f/laQgdaiN84
- TLSH
  T1EE911D11EB21D96BC02A5B79DCF3CB326364899067060A1F52F4B4533DD333A8EA259A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  dark/hand.cur
- Size 4KB
- SHA256 591238c23d1957c7d702eaaaa3536e71bfde6bf0d75dcd46639d938f7f73ee1e
- MD5 82367b4561293dd9816b49987dd74c38
- SHA1 9dda17e22c8b80ee241fb3d140dc392548045d71
- SHA512 eb6592be60d67cd892e145ffd4e69d9c05ce5d1753a789bbd5d600e74d54a0d81d649287ac0ec2d68a7e608441081cb64421809c53c8e6151d9b1f024aadf804
- SSDEEP 24:KdBa6ltTonr9aMKSfgAYvWpVVeGazalSanB+HFzt:oH3oJKs/+W3QGaChB+L
- TLSH
  T1C291CD5696958D07C8E40F78E8D7C2345E715D8016A34F2A77C87DFB7C712E039206B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  dark/help.cur
- Size 4KB
- SHA256 26eb9dda636d263b3c6a3faf70c78e64a5aa965fee58e4690571db197754eec0
- MD5 ee405ec1aab3cc6446d63a1c63682c61
- SHA1 66f3b112e56868556ef4db04518b059ff38afe1c
- SHA512 883469b2f0b97de2251c8c290b8c71a5f124f53862c042adca852ba6d11099c378bd7294324105d86e63e36fb07e35ca3d3db680f86ed93ddd6ea29d13c8f22c
- SSDEEP 24:TdyQu++CAiytwAnmh0c8GEvGUx6pK/QVEHa1hDNc28tl5FMe38jHGV+Yf:JyLZBnmhnREXqhDNcbti44sf
- TLSH
  T1FF91CD0163996E49E46D263588E7C2B1A2305CD49F832B274DCEBC1B79B63E69039543
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26
- Target
  dark/ibeam.cur
- Size 4KB
- SHA256 ee1a28b7c3af8006dff6a4235445a8bad4dd5e862e2cad24315f7570486a1c96
- MD5 d7622621d6b88d619f4b1a1ae6f13beb
- SHA1 b0dc3783735578dd66b8bf2f45ccfa27170d512d
- SHA512 1bdb408c58df1916c57c6ac051789674819dffbdff81abcfbda1c3317e65d382db265e0644f81936fda8220112d6191e4664a3e10b0a6f9c6e0de42fd649c201
- SSDEEP 12:CeBaXXM/Wp/uGXGXGXGXGXGXGXGXGXqnMBi15WPU:jkh/vWWWWWWWWq11
- TLSH
  T1E8918C65B230CAC5CAA906724EA1CCFD051DBD56FD04292B3CD1375F38B32454C12E13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27
- Target
  dark/no.cur
- Size 4KB
- SHA256 b6a99a68e18f99a4028cf26866bb720af8eca3eff88f5f09aeb9cf2dc315b88e
- MD5 818dd8d33a2d8dd315dba3d026643c19
- SHA1 717cf1d6cd7e6477544a8cd865e2bc329a8a8615
- SHA512 e22c5a0452de1a2d2f94d9717603fc81b0947f22117813cc8e341e65556625fde26ec93a8ea0280dc8c9c450a76449da7ba2fbfba30d29851381ed595f999816
- SSDEEP 48:4NqcqCWACyOTHT+fFSbs4NS4Ivy3r/Z8882b:4NBOAVOTHTOElM4Ivy3W88a
- TLSH
  T14A91690D9BA34D15C16C0339556BD3382BB0CC454503870F03E9F9777D2639D6E872A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28
- Target
  dark/nwpen.cur
- Size 4KB
- SHA256 de4baa56f6be8b705488f329317e456fa1de61a61dc3ccdf4a8a016a1b6c4b18
- MD5 67047e9d382bffe6bd9d3a1e67e14644
- SHA1 8f763f2e95b2b4eb0ff00ed76b0fb7feff90b68e
- SHA512 08bcacd8b0b76cd2f597928b2a57e5fa48a8b4d1a7722bfbc5a15090b269128d339105e9ffb886c368709efc8b8f6b6b54fe7267cdd9618bece182da77b3bc3a
- SSDEEP 24:15ORKCLg6KfP0fDfRfXTfrt6f4HYfoo44M9Ep9Y7KJoFs0B5kw1rDiG:ConvALtLrAhooNpp9YWGsWPiG
- TLSH
  T14E913AC5BB645F44E43642BAC8A5C3365320DC91A202CB6749E4FC7B7AF36681D9135B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29
- Target
  dark/person.cur
- Size 4KB
- SHA256 c6c3ebfac60d8252f8669b606e08eb0666cbba5df02126d7f2d462046be355b8
- MD5 1df585fa1ce06eeb72c7b32f54afacde
- SHA1 4d035fdab7f94d3a1ee7e718a2cfce71778a15ae
- SHA512 1b13d386722e6ab6c378ba11af37261d761b34455c1cfb4940efd2dad69f47d0fd8b5ce8c4a71c674981ffe8d1babdc34df3c3391f8e5ea3ef852db4b2de9ee4
- SSDEEP 24:KdBa6ltTonM9anf7DslXVBFMY/LananXFJzhnTPRKB:oH3Hg7D9YTXFJzh1c
- TLSH
  T19B91DB1A9291CE0AC8A84B74E49BC2306E308C805697472F53D87CBF3E713E7791B265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral30
- Target
  dark/pin.cur
- Size 4KB
- SHA256 66a167913634d0d85c0f137cb360cc590530c4f1e56b57870eebdf53ff9f126f
- MD5 bc1b06679df2229207056b23bae873f1
- SHA1 0d631077191dfca3bc4524c8944ab884dd5f6f64
- SHA512 5c25c86f0ac7a8237844364ae4884d0bed6bd2b3af9767d122d134bd2004e8ffd1a2e37877db6acf786964eb9c55ed1a95ed7c85ddf57771ee4d3b25142d0d19
- SSDEEP 24:KdBa6ltTonM9aMKqfs0g/6e1EoUHaxI3Gt+Wawyub/RoKeEliRux:oH3HJPs0gV1JUicejpodE2w
- TLSH
  T17E91E10996A2CD4FC0640B74D6D2C1309E305D809B970B2F53D87CAF7D21393396A559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  dark/sizeall.cur
- Size 4KB
- SHA256 2c1a145366a08f353d67fda560edf3337f5b240f49db7a8810fb4d699d4b52cd
- MD5 4f7038d3613e71717be64b689e172280
- SHA1 46757d9804dd0ab59f5a07f9b79420d91edd8a8a
- SHA512 9001daa048e477ecbb2db57811b4bf84e0bc2fbdb0e6dd4b1f7e8924c6c5ae15e5e514b2c4573af78fca6698b1a417ca5eca782a9ca0f7de596fc6aaa4e9db2f
- SSDEEP 48:5EbCxr3SfGoAI+Glus6gNf3KeBUT4iqPKl8v80:5Eir3SfGoAlGlF13KsUT4iqPKl8v80
- TLSH
  T10191AC1867546E29C098C6B271A7CF705525CE10E1E85FCF22D9649F7EA73B506032AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32