89cd188ad3d8e7102263c71a7ff6a9fba0cf40c6fd4e240abbdeaa77bc91ddc6

Sharing

Copy URL Twitter E-mail

General

Target
TheExecutor.zip
Size 1.2MB
Sample260707-2k977sf14q
SHA256 89cd188ad3d8e7102263c71a7ff6a9fba0cf40c6fd4e240abbdeaa77bc91ddc6
MD5 28a0ffffca83ecd53dc379b3f849dd66
SHA1 287cb75f7d078d452f28dc7cd130ddfcb1479751
SHA512 cf0a030f6acdcd935c28c13d1026d537d0379e5365b74b5c7307d79fba3f8164ebe49911a838a46c3fa97748c5e4f0ffd210b40a7f895566ce16fb320ac00b6f
SSDEEP 12288:ri3ge/iD56RmzoV537Ogr2VAHx7JijBZdPfP+Q4AFUBNgVr7FMQPlZW:0gfZoTS3VAHxKBZd3PT4AHfFMmlo
TLSH
T163457C4427FC8767E2FF1B75F474421687B6F406E96AE78E1A48A5FE18937808C10B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TheExecutor.zip
- Size 1.2MB
- SHA256 89cd188ad3d8e7102263c71a7ff6a9fba0cf40c6fd4e240abbdeaa77bc91ddc6
- MD5 28a0ffffca83ecd53dc379b3f849dd66
- SHA1 287cb75f7d078d452f28dc7cd130ddfcb1479751
- SHA512 cf0a030f6acdcd935c28c13d1026d537d0379e5365b74b5c7307d79fba3f8164ebe49911a838a46c3fa97748c5e4f0ffd210b40a7f895566ce16fb320ac00b6f
- SSDEEP 12288:ri3ge/iD56RmzoV537Ogr2VAHx7JijBZdPfP+Q4AFUBNgVr7FMQPlZW:0gfZoTS3VAHxKBZd3PT4AHfFMmlo
- TLSH
  T163457C4427FC8767E2FF1B75F474421687B6F406E96AE78E1A48A5FE18937808C10B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ARMClient.Authentication.dll
- Size 66KB
- SHA256 9931b5d62e7fb38eeb8f86f6204b6055f7eeca08cba780698167c8846ca90647
- MD5 bc1b4885c1bcc757113a7e2c000f4821
- SHA1 e1153f6423567ca4a2b7d4947cbdb1aed5ca11d8
- SHA512 5fcdc9d31956437a4bdf459e337b76f93070bbf430121a651e52517e833d79f38ce3c3c124d099bda5e039252ccb32f40f64ae3517250a47f73134402e0433c8
- SSDEEP 1536:M9vycbM2Ur9ozNPl9kIzGcGJVOvALlqwhuPDmLNzR4INnS:Pcj7kIzGcO0DSRLNnS
- TLSH
  T196636C85A7FCCA23E6DF5ABCD1A4D1471B72E7966810F78E1C8CF4EA244338046416AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ARMClient.Library.dll
- Size 32KB
- SHA256 90d4ca5ab2baf128d46a3f5d5a71bea524c413f40bdbc4a03668436bcfcce5f3
- MD5 d6bb28c67f08bead73403ae90787b64d
- SHA1 449086e0b990918fc4f15c8ef9e8d48a6486b7d1
- SHA512 6b29dec43b7ccdea3c74afe7a40d6391e26702238f4a9ecfd0fb223d279021ebbe0801723006beadf340bcd50ea8752adb696622dad83e0b32a5e75c6663fb1b
- SSDEEP 768:OZmbSucRuI3sUeaHj2eQLUrDj08BkaXQyu6ewxaaicmhH9AIIKqU:vbj3yeaHjTQwHPkGQLNaa2IdkU
- TLSH
  T1FCE27CC48B6C9523C98B5EB896A8C1436E35D3DA5D21E65E08DCF8EA1CD33C9970473E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Autofac.dll
- Size 203KB
- SHA256 c9e70658befe655ab80b4f6caf38bcec57d9d3bab143305cd214bffcf9abd8cd
- MD5 e0dfdb31cb96160e2a56c168665c8ece
- SHA1 955888cf96ba50a6637f76cc83f3b3729051f121
- SHA512 05a1f7539af4aa7f97454db8fe8ead032b5bc18c1542144477105085d0784d3f6af518fb1f2d17f934704e912d9394623a970f34812b4d14e44284ebff64d616
- SSDEEP 3072:oJtUPVpBadGe/W/dSmcLOZPWHQ17n56Wwmz9lWbv7C9DahVP:oeXe/ikSJv17n56Wwmzyz7C9DahV
- TLSH
  T180143A4523FC2737D1FF4B7EA47450418BB6F517E845E64E4F9810FA06A2F05AEA0AA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Newtonsoft.Json.dll
- Size 531KB
- SHA256 7b1bbdd36dfccf96d8b941782bc79a43072130989331242548c3553d5c8578ea
- MD5 859adf11b4d2a656a8ee2d070b726743
- SHA1 d53682045cf3b3d674b0c957643bc2abc7fa42c4
- SHA512 6540acb9f3e8884af60394aad8e17964d4cf1469d7f0df589dee86a672f711588b70d3fd4033ecef5d954ef4cd7ba8581c2855d6311921da68a6a9b7c20e0eba
- SSDEEP 6144:YeC37wbJmJ5bd4m15M+S50cK7q2UGu7WEYEaWdDBLH5WHxJ16Wi/h4aBTBFFu4J+:s37Ogr2VAHx7JijBZdPfPi
- TLSH
  T19AC43A502BF89726E6FE2771F438061557F9F45AE67EEB4F5A4095AA1C837808C00BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  System.IO.Abstractions.dll
- Size 53KB
- SHA256 7da16ef846948a94f665b694b9b65e6882496dbb27ba57a17abfbb51f7cf07be
- MD5 f239405f612d8f172eaa8291be224ff1
- SHA1 3328282fd11c277af4e55747dcfda358243d9942
- SHA512 038d20ea3aa0419032b34c7dea4e4b613fe4f7bc75256820c94cbaf7bb8a5dc5f6bbcc08d21f3a6129cb5fb9773100d11bf7561dc11844a04dcaf3d6bb6ef0b4
- SSDEEP 768:Dui8/DurjNnJRqqjqqBqqjqq5c55c3dxgYk9A9yu6eTLSnEKmh0QSnE5:Dui8/DurFc55CjgrA9LNHCIHh
- TLSH
  T19B33F75C2FF4E157DC2E05B479A0C22A6B38D682C803E31A2BB5BDF56C733A5C61245E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  TheExecutor.exe
- Size 305KB
- SHA256 576b74eb4ab1287fc39e4f1dbecc478deb8b0bd14f7104ae1c6446946ffd4a28
- MD5 6d9dcaa75e1846e79d6f0eeef87aae10
- SHA1 0d6231f8ed4445e7b1e716bb34b55e5e362a825d
- SHA512 eb8edd40ff7881b15c809febdcab209ebaed7a6ea1098425f035d2b0cdac3f4e0ce832ef35b5e3802e7cbb4c7df661c38f471145c584ec3ff167654ca6c4f88e
- SSDEEP 6144:jIQ4WYGDlFUBnNgVUq19v5pwOMw1cilZg:0Q4AFUBNgVr7FMQPlZg
- TLSH
  T14C644B86636CC7A1E16F1F76B86282EA8733F9069CA5D7DD194CE7EC18637818C10727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14