5e72720f3d02ad4f85ae8498bef75946e127a3a5b15e98005a2ba80fc2417bc1

Sharing

Copy URL Twitter E-mail

General

Target
DS4Prada SZN 3 FPack.zip
Size 5.3MB
Sample260707-c2cktsf19z
SHA256 5e72720f3d02ad4f85ae8498bef75946e127a3a5b15e98005a2ba80fc2417bc1
MD5 2d9e1ca1cea6dab17f017382f4c2d99a
SHA1 966946f37fac63197da7ece56625cf17f8f9b2dc
SHA512 df37afa713f2883810fe3af404a935957771b43cebc763800c8f8a5f7ca3ff0f3978a3b2409138093a06769fd201ea86f27384962d73a592b5656dde99989411
SSDEEP 98304:qfEsMjL2bwSaGVX3O3mx1SlvxkAUWNcGpXml51ITKD4LjgIh9cCfT3nijUq+G7e:kbbwSaGd+eMrUWDIsJAIrcQrnqL7e
TLSH
T13D463354413276DDDEC7777ECA93C6E89EBF001BE8A0CD881E181160A1D82DEEE9527D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DS4Prada SZN 3 FPack.zip
- Size 5.3MB
- SHA256 5e72720f3d02ad4f85ae8498bef75946e127a3a5b15e98005a2ba80fc2417bc1
- MD5 2d9e1ca1cea6dab17f017382f4c2d99a
- SHA1 966946f37fac63197da7ece56625cf17f8f9b2dc
- SHA512 df37afa713f2883810fe3af404a935957771b43cebc763800c8f8a5f7ca3ff0f3978a3b2409138093a06769fd201ea86f27384962d73a592b5656dde99989411
- SSDEEP 98304:qfEsMjL2bwSaGVX3O3mx1SlvxkAUWNcGpXml51ITKD4LjgIh9cCfT3nijUq+G7e:kbbwSaGd+eMrUWDIsJAIrcQrnqL7e
- TLSH
  T13D463354413276DDDEC7777ECA93C6E89EBF001BE8A0CD881E181160A1D82DEEE9527D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/BezierCurveEditor/build.js
- Size 431KB
- SHA256 fce907cf01187e1ca0afb91341fb6d793a97d359918278a759ad03ab4dd71348
- MD5 61b6490d371c57d566ae713880f3ab40
- SHA1 36c2071e549545f02deb5500c296f343d88b08f8
- SHA512 b6c5b64ad02e85087d2ea71938ad1e1cafeba13184e3ed3eca31a3da47bcdf8e58fed3dae50917a797f7d0bed89a12d391fbcfe0246c264e82bb581866f36953
- SSDEEP 12288:9eTeocrhC4KAl6QhcrlsM0q8btBFWW5Ovyf6Bv+JWcwxXAc6EHmSZGlYBDdyNdyI:IqWcwxXAIG6RdyNdyFmL5NyiBDpgnU
- TLSH
  T1BD94735AFA9024759177B3389A3F8505F6B6032F128989173E3C84991F7286C9376FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/BezierCurveEditor/index.html
- Size 193B
- SHA256 fbd5e846237145aaa4b1d5275eaf95013a31d41e9cdaaad032d583245de54a7e
- MD5 b7f3e0aec1e9905b2706285819ad8627
- SHA1 c86d0c917ef8b6e1ee25d034fad53b0b9f6ba5c4
- SHA512 036375d1801c4b85c8454a874267cef9dc49bd7aa73a49e308584fca8cd188857ba625f1033149f0a9aa395c5ccb78d1f1abc73e2b85339a6c5895d46759a080
- TLSH
  T102C022B61C846C0800B0A6B068E1F2A82082E01462E4AE0070E020033E423C9CE83180
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/CustomMacroBase.dll
- Size 297KB
- SHA256 80dd258a12f478973e515d099aaeef7a3877feab46aac9d79ed375f58afafe0f
- MD5 2fcddec3da26f492f676b2e46416be56
- SHA1 1795edc7a7cf654d4f8a50cb2287f0f1531b0b22
- SHA512 0142922a866badfa447ec0ceacb6147599a26cda201398151acb1ef6f77e519517b3c78f8b52932ec0cb7faacc1bd9beffca3d82dbff14ee726af94445aa61cd
- SSDEEP 6144:vi9oa72w2RtOrZ5UOMFNHqcQlKo8B7F+fN1:vXAM/C5bnA
- TLSH
  T1DF547C10277588F9C9EF1F75502A41D4A3338A0687E1CB0E55CA2DAEACD77878A437E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/CustomMacroFactory.dll
- Size 97KB
- SHA256 533c549c902ed53223e5509fa4f3878087931734522b9674bda593be559a3125
- MD5 a2f6d5cfc0f25d53c1b20b54ad7ff9b4
- SHA1 25f13c5ebf7d0c9182f426e7734effd8738afa2f
- SHA512 dda7640fbda7b0561214745fce178e4b321cad6ec3d1ba7f894aee43ba51be35a03808ba0fc9126ad2f9a90c075caae52b89234e5d3f35e050856b7924c0dcab
- SSDEEP 1536:gXr2+Ry5EuSHRYzuAt7YO6K/o7UfeBYkFM/YBSOanUJBjSDici7SCSLNGe:ga+Ry+HR29f/MUGYaMgBfaUHu4lpe
- TLSH
  T15DA35C04367E5BBDCFEE9F39242851802773A2566351CB5D04893EED6CA63864E03B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/CustomMacroPlugin0.dll
- Size 25KB
- SHA256 de7e6c2fa960943ac0c5dbddffa54a2d03e23ed1b8bea96e9242058611b8238a
- MD5 74b3eb71a7dd8cc85c086a632c2e44cc
- SHA1 3247c3773db639aa6449f3d38754940e87375510
- SHA512 50134d5c93ac00583f70587d0a2828273399452142d85d7a2156b23418854bdf0e2dea57c7ce8aa58b5b560d2753536b19f9cce7505df59a9795862ff76e8b85
- SSDEEP 384:GZkkCNlLLmTAO2rU9JveMahflcKjkhSRvOHPqgWm+RzxBX++TU:GZkkC7LWPeJhfZkEZOiVvxR4
- TLSH
  T1A1B20B1853F40773CBEE4FBB69A141583B3595437862CFAC5C85A0EA4F8ABD11712E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/DS4WinWPF.UI.dll
- Size 137KB
- SHA256 2a63c266c5e3824390f0c3d0f189999a77f3397c65fe662cb187cc997077ec46
- MD5 44b39d05a64224584883e6aee70365a9
- SHA1 649642632fe5b60b6a0b44d7fea9baf1c092f228
- SHA512 d61bdff1bac395d0f245458cb0265e4bd6f985f6519f0d4b05134e7c25e947ca6aad9672e087e5cacb7b2d05f57f83079028c3ae05266f8dfcfb4f0eefbdab99
- SSDEEP 3072:NwZe7D9RrCS2OYLBImYYrVbDMxVwl4YzRT3:drCbrVDMXwl4Yz
- TLSH
  T11CD35A683B3144B9C9330BF065A54998F232685657F1CA0D69CF2E4CFCC5A478A637BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/DS4WinWPF.UI.pdb
- Size 20KB
- SHA256 a2bf3030715f99f44ba03be743c993e5420ad76b1eba7c221b522faa0531f4fe
- MD5 d26544830c5ac2803691918712c73e97
- SHA1 c940a0480fd450e02e8aa97f65dbee24f0ef0219
- SHA512 98ecfbff9db12d21b9a2984940dca8748df9af68360cda6a94d4fe8a2684ef95696de9007a4bcaff02140f651e40bebaf53c460f5390a062e57286504a2cd6d1
- SSDEEP 384:+ehyxRx0si97EJiIUqCdfaMsb0xButYiHC4DfCLTNPvBGboIfCIHEfYEABb2h7kO:7hyxRx0siCJigFLiib0Df
- TLSH
  T155A219339358CA21CA5165BB6422C79C3B3583201746EFB8F2E47A14EDAF74907F76A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/DS4Windows.deps.json
- Size 81KB
- SHA256 336c7337722c3776dcbebd7671da255965e2b8c3f4d1f92f53c68672fb4fd344
- MD5 b84ac60ed47b18b591ac38d71974f9c2
- SHA1 890b052d0a7f41059a6ed6f703fa96e7e63fa97a
- SHA512 8e63ce7d3aa70471e558980d7cd7f0bfd24903b47eeb95e3806e174e831c5dc8e87e26d8528171ead3797a3d78441405fa183dd8e4efe8a2636f29894a90a61e
- SSDEEP 1536:sklcu714yAmOp0DqBWBRyhL1OqQ04CZJSOVgqi:sklcu77qBWBRyhL1OqQ04CZJSOVLi
- TLSH
  T158838625DA886DA306766BA218358192F361832F51106DDF78FC218EDF73E8B1265F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/DS4Windows.dll
- Size 4.0MB
- SHA256 d7a3fa0c2e1a374f598e40ebd718d4255034b907c136d3e5cd6ae9e410d59f4c
- MD5 e4fb8b66726228074194f10c58bba3c2
- SHA1 c86044ab5616d336f6dc2a7e613cf0f31ca846a0
- SHA512 fc2d7573644ddb3a87f8e192a8887f9d3d1323b66178a7e267207f81ce954163e48f2ba247eecb2d7a72b8561359122ac7ef763ad8fee62d05e587284b8396c7
- SSDEEP 49152:vvfBljzTPpFaGXFMcyaOphev6CMkLwOCyuYdPJzD4Ht3JzDubzwc:vvfBlnueuYJzkHhJzSbz
- TLSH
  T1B616AE2533A4866AE06F8771D454C8B48372BE12F702C79F31D4BE9F39FA7508512AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/DS4Windows.exe
- Size 548KB
- SHA256 44766c140ce2f95cccea358ef7b6d5aa10af6c1f82ca0bbd1d1e2e6378dd973e
- MD5 1f8b553af8c60647d6579a2c9a30d757
- SHA1 345f6eb1e67cc3dbc281cb59914ee195a7f272c1
- SHA512 4a10f9b56fd88d3d93bd5cec56a9047076c2afe3650285a9dbee59cee3625b6cd49e23ee5b597dc7205f305dab40842d44c288965ad226ff89d1419627110cf6
- SSDEEP 6144:siS4ompB9S3BZi0a1G78IVhcictjKYPbz0YM+SS5hjS8kfdjS0gNsNHZBfh:syB0aI78IVyJzm1S3O8iNS0YQHbp
- TLSH
  T19EC47CA7718800EAE0339130C5856571E3B2BC76576247EF33D8B67E1F7B5D0E929A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Drops desktop.ini file(s)
behavioral11
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/DS4Windows.runtimeconfig.json
- Size 549B
- SHA256 37b4fbb913a102f13063829f827a5030168a2ba4cdf88593aee1ca266309fc58
- MD5 d2e7aa8f1b739e4896f676105034aa3d
- SHA1 6d002fad5216f78c2abfcef8597bb985995621fb
- SHA512 599067b3efed5d9cd8ccaaa33b2fdd76308df23696584b291dcf14764b2c2a06cc660800cfafbcc4020d1b6c8192e88cfbc54592d32a01d081e1bf7617c1cd25
- TLSH
  T1E1F0277ACE106CB705F973BEC526C182EB30132710001CA675FD140C6FB76A65222F4A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral12
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/DotNetProjects.Wpf.Extended.Toolkit.dll
- Size 1.1MB
- SHA256 165f7a5662db4c4f454435c31fef927cd7bb1ba5cff0eda9b653e0c1fc2afdfe
- MD5 9e515282a9b6924f281f7e640f67297d
- SHA1 d9c71e7b5fdf47590d5868c701fb80dcf666730e
- SHA512 9f0d9a1d16d242be7c61acb96055b6ee786e7794c87946909f391ffceef0440bc5bc56fbc463a9fc93b2a3dd53d30a82b20f834baa11e48a842a6df94805d5d0
- SSDEEP 24576:140TB/vnNDIIs6tc9KwRzAKl2Rz691anp+vMmLLbolvUlvtN2Zk8XxXaReV8MHOW:14GB/vnNVtiKwRzAKl2Rz6j5vVL4lvUm
- TLSH
  T190457B513374C96EC8BF0BB9907521146B31ED4AABF1C31B61891BAE6CE7B124F407A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/FakerInputDll.dll
- Size 14KB
- SHA256 7e3d67a3e6b4ef2aba039a3b1e079acde3ad95e0286a87623949ad74607d1a50
- MD5 7c87a11e5c2bbd4e2414c568ea4f4360
- SHA1 c67a1108118994de1cebfc7149aefada4b2db416
- SHA512 f826b4c8caa89aa27489de32ac426a7f76971c9bfe797a679cea20514e79aad6d35d17d0226ad54b19f13be3b104b77afa178d3ebf70aad66c6361b5cd37a01d
- SSDEEP 192:F+vcSldLwhPcoJFYMV2n9ywc5I9uUcAcqy8:06JgMAn5yIpcgv
- TLSH
  T16C620787FA9A1CFAE56941B688671D28E679FA25433147CF03B013090D7A3C63A7C669
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/FakerInputWrapper.dll
- Size 10KB
- SHA256 4792671766a575394d3402a9365af9908af94e812ec1969bfe4975c0ab4f5430
- MD5 25989ccc74dcf12a2216c196d8c94b9b
- SHA1 ae0693dfa6da746c952f2f0140c33ca9e321368d
- SHA512 23ebcad4e9eb948c70a557c815fd31af188808ec5ce1c301a912f4bdc6acc7352941514bef801b249fdf6384aa60f120b0b4c27b1929d42fc70c85a3328e4614
- SSDEEP 192:4VwjZiJ1OhXNgCBViwTYrXx5ic2XGIlabgU3K5shX4vJAyT:fiJALxgXx722Ilg7a52IBvT
- TLSH
  T183221C19D79C8137DDA68B79F0F30612622AD9A47202EF6B265C90445F137C9E6332BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Fastenshtein.dll
- Size 6KB
- SHA256 6d7cb44582df231250cc975d5c132577bae550b68902f4cdb5b1a1258c05653f
- MD5 87a07565221fcdd81c4aa0d356931ac1
- SHA1 857b41cdf6877e752fc981f0ed4ae435bbb1900a
- SHA512 f94f9ffa34afeab4439e42270e3e0edeef78f93857be731e0052d6661a5c1f6afcb3a5eb3afe9c7fc0d339ced6a6b2e302febdd8df72d70fbbd617fc4227d887
- SSDEEP 96:JJCDKTMiisX8TwXid0cx+ei5ZkNnsRHpC:JJKUFis/SdDUetNsBY
- TLSH
  T1DFC1840153E48236E9B35F32BDF313525135BEA09DB3C72D0D85415E7E266909A33BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/H.GeneratedIcons.System.Drawing.dll
- Size 15KB
- SHA256 db38f1c4765cc89bf559bb0e0a37cf7f8bab730042e1a8a5018fe321a773848b
- MD5 5dadf6d69bb435eb694e9bdc4cb6b3cd
- SHA1 a4c2ed6e0eba9392f835a02aba5c43fd5885e75a
- SHA512 58df305982fc8d4b11022707dc4065d45f0cdd953a445638a3a7aa8cce6755c9a436f86f2125740dc7d7ccd5d95f554ec2520cc732514456f135331907df5454
- SSDEEP 384:saTNQciF9r0wLyI9srH9k6YQlfyElgbuFiEpop0H7TdwW:FTRhwGfyElgbuFiEpopeTdwW
- TLSH
  T1A0628F27B2F49239F8FB5F3655B396402235F502DC66CB1F0A985E1FD43A6105EA1B34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/H.NotifyIcon.Wpf.dll
- Size 188KB
- SHA256 36439cd74874657f28abc961eafdf0d567d8f056c834434429d3864482fbf18f
- MD5 45a2a0bd8e774f13704f379e7f6000ae
- SHA1 f50ca9c5260de8ef70352ea15dc3bbdb98b26930
- SHA512 8a1ee3f29c1892595884c0d1158761cbae0cfbe4852320296dd12b983f34a5e7d12f7f96a41e1800e86361ba5e0cfd6b74fbc8e58a9137caba557f6516e22acc
- SSDEEP 3072:QoMxhywgofNfC0F7UbQBnL0XK3+oTvRZu0JlKtsfDnWfRdzZg4fdAMrEpgM+G3:QofwgMNfCchvuoTvHuCKMsiWdAppJ+
- TLSH
  T16014AF52BF59DA2CD3AE6E7DF848033D4B38C659722EFB76076094BC389675572000A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/H.NotifyIcon.dll
- Size 373KB
- SHA256 ad19da4e92fa1d76d60a2f25a05e5942e3bb6238ed4db17296bb6deb598da4ca
- MD5 b3dda4b7ac031c242dfd4a8788100de5
- SHA1 7ac0c664a96e8ee951e5857d0acc3a51b02596ec
- SHA512 a285bb4b8235eccd792cac29e9c7bce931a701d354461bed4907ce279eee2927541750c9aeef6f9a33be83601f3e4a1e949442dc24a7676d46e579a6c0fab47f
- SSDEEP 6144:zVIOazazazaqKZAxdhlUbbP69Bn9T8TiZ3YByj4OKVbzvd:z2jobPwoiNJsNVbzF
- TLSH
  T107847C5975271FBFC608983F7031190BC4AC4508A14EB27DC5EEABBC29F5E821F946E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/HttpProgress.dll
- Size 13KB
- SHA256 a6c28242c760db5713f12a292a87c470e39e42aef8663d02af8e72a3658b97ba
- MD5 e97fb25cb7d477d5c3116f3add7c060e
- SHA1 a764ff39dd41f97f0a4d224acec348d75eef337a
- SHA512 6c1580d60755fc2f89403138ac082ab7b57d215cb20493f092502d30fb5604340cc016aa5c72300bfc22d3e4add0b12d487f3bcf213044d41c6c13e9b1dfbcaf
- SSDEEP 384:D4DXA5xR0vFPNBJYEk7tpwkjRdmTBHeu5unsEga:D0e0dN7YEkPPmUuDG
- TLSH
  T14C52091467FC5237DA7FABBDD9F147814332AA12A412EB5F088CA1DC5C933498C6079B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/ICSharpCode.AvalonEdit.dll
- Size 607KB
- SHA256 d41138d2e17998e77aeba0a5dcdedaaa08c2601aa72db6a6b7b9b56910372515
- MD5 36bafbe39e16b7827e04c2a75e40999e
- SHA1 aa677b03098bf2a601e5d8c7c52ce62124d528e0
- SHA512 caccfa7c357d5bd0e0fce3280b6af4fd5a0f70d7b500176df1ea518ed4cf15b2ecf60efebac5bba175af17efe46b2b2fdd0dede10c8ebbdb4510eebce814c75b
- SSDEEP 6144:YrbNGioV9q3JxbQ+D0eQ/8NLjdkEJwZCOjka+WPXjWbUORPsXlZjou:8R+q3w+Vo8BdkEJJbI
- TLSH
  T16FD43B2833AC161AC3BF1777F2715204A3BBFD56B269DF4F2584A1BA2C427635C41A93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log.txt
- Size 2KB
- SHA256 70764fc984f14cbd18f51b7125877fd5360835a40da69b9b8931d07fcc05f993
- MD5 cb5f672e0b6524a6d1b33ebff4466f24
- SHA1 488732f0e556d978ca133fb80fcab35d2355b2a8
- SHA512 a8843aff9fb2c7af37b9a7501ef5a6d43bb6996716e7296049707e2626bf0b4b2395be90fa135ada5f6d9a1643e2ff53c9704a1d4e1f176523e124d0fff2da96
- TLSH
  T19E51375CA53491A2336B10CEE3664FAE433671D2A128BCC73B30688C34D26858E7F237
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log_20251230.0.txt
- Size 2KB
- SHA256 fd629bde0c8cd6ff7bf4b1b4543700b10d6768bad466865185c552ef6c8e6b95
- MD5 d2ac995aa3dfc9803bd79524d6493c0b
- SHA1 9efd5715fe07f63d3a26882cbc2c572f05d41dc9
- SHA512 8678ca69801c65c2e9224a159c97c79218bfc4db19bd48ca1936c5b3225ab77aff09a978d2439fb88e37c7032e0c187b7f709cc25b2e69fec86a4c587f89dd3b
- TLSH
  T188513B15621C4195826F104FF28AD77ED33752D39112ACF930B0B8E415C16789E7FB6A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log_20260102.0.txt
- Size 2KB
- SHA256 3c420dc21105c498ac2dfd7817ba773c7efe5f039dc2527677392586e42b133b
- MD5 871d274014aa45f62e6263bc03553a29
- SHA1 2a857a555f08edf587bf739b193849d64264e95e
- SHA512 c447047bd856487a7e9230672e798221109fc7aa1bc7f17f8fb92e9162a7eadd78678e188d4f7c7c6dcfa8f03152add4ac0c13489ca40b5c182e1b94099d1957
- TLSH
  T1BA419B3151381122033B69CCE59E7FAD463ABA84A33AB8C736B42DC455C3571DABF09A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral24
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log_20260102.1.txt
- Size 1KB
- SHA256 27d79fb7f38ed5092bb3d1294d2c1624764a301c9174ff03ce7c0dd92a022345
- MD5 41ef311e1a0bc4d0889e453949d7c1ad
- SHA1 353a9d98875fe5477a90a4e8ae485b6273ffba37
- SHA512 5d1d96bc06e4981c4508c2f39067701d12a9bdd8e215a3fe0b07b9abf8c52ec38f075b274291fc7cf17c3f5e8f7965717b61987375e9590f3d494271b598e11f
- TLSH
  T1B2413638223C0696133BB4CDD2AB7FAE5533BD897739A8C536345DC0A7912708A7F056
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log_20260102.2.txt
- Size 754B
- SHA256 b5a7cd4ae6a8ef193357f1886d1d55229b861f2d8bebd30dbbf1507fd0836a52
- MD5 aed22d664a98e10212d602e4dece9309
- SHA1 8bcef1adaadf8fac043fe28151fdde48271a573b
- SHA512 4bd067947a3022a02a28aee1ba0a6f292ba1b11b5a6205a725706d65a0fef14fe8bbbd043425720b88611d386853d8dfd2bcb70d3f57108193f980fc08b87271
- TLSH
  T1F4015221237804C15BFB808CC1BB3F9A5436310D303564BCFBBA68D4568516AAB3E157
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log_20260102.3.txt
- Size 1KB
- SHA256 028afb88fa48c6e9f430e3dc99bd5fa48ee23a934806689fc453651f9361a68f
- MD5 fa59f6887fecfab94d99828827505a33
- SHA1 c9cff30586a80aab2ba260dbacc52424b693e256
- SHA512 5ccf087953340a63183b73f84b9c58716e13ccd93954f05f60ab3d2922c77ac27b917be264f7fc367792c9fd10ce67959a0bdfd63b01bc66cb52003cb27dfbb9
- TLSH
  T18A214720663C11A203FB6A8ED1AF7F6D4632714D7B347C997BB61CC422C5261AB3F54A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log_20260215.0.txt
- Size 2KB
- SHA256 9e800eff87a1296b38d39eee0cccd239a05d6ba6562f3882c87d114906b33a9c
- MD5 66714b5558b99457d13efcc2747aef2c
- SHA1 529e5f7f8657e688d17c301c9e258fba64a90f3d
- SHA512 14d6bbcfdc9c6c070c42f9e00bad448f2737ab1aea30732e664e3ad32ee9fa718d65c24f8fcfdbdfca9557d47eb9036fd93a25728e21e2cfe2e3c05fbb68f342
- TLSH
  T11E511620603F3921126B548CF1D67FEF423376C2A71978CE797566C824825828ABF5F2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/Logs/ds4windows_log_20260215.1.txt
- Size 708B
- SHA256 18189dfce7e299872ea79e55dfd26fedc8529618754022478067ca6222faa4ab
- MD5 792b624c2f586fd5a7f6eb00c6874c45
- SHA1 5b9697475b93de15ccceab13f2655467d82befe4
- SHA512 62c9d6b896db61026ab4f608bf1d80752ea07b65244e717ed506d283414868b7c029c1b09e0088ac2be0c7ce15d47084052801c0bfc3763b2e9d5b5d55e56f7a
- TLSH
  T1EF018FA36230854225BB0909C1E20F4B13333A3320CDECF87BA464C57AD13178ABF943
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/MdXaml.Plugins.dll
- Size 12KB
- SHA256 84fc480bedbf9c7acba1959264d099e4bb6617203a82a6eb1a13e80c70326d50
- MD5 0c67ec9300175ad493c5bf52fc9d739f
- SHA1 382e6cc21888d56085244cf438e592541d74d25e
- SHA512 a9daaa0a9dd887bbb12703fd95a46b07d09188d9dd94c47eb698ab6286ea5ecc71e015f5d93c6a2dee8581e8e09f1fc8e366af2e5e4c9f3d6957c2a0b43b95a0
- SSDEEP 192:Tom7ymXzlN4SDepV+tQFgMjV3kj/FaasAChkW4l6Z4nQC5FpS3/2V:7zl+SDeuuBJUj/FaapCyW4lFQC03/2V
- TLSH
  T1A642F9276738E33BCD68873EB896954D22B18F903603DA678A54B1CE6D573661033E31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/MdXaml.dll
- Size 149KB
- SHA256 f4e17fb362edfb4f6b3ebcaa0f7b582dba3f3c97bbae461e3c060d944bb57efc
- MD5 5f1b0e3d04b499a0386a15fb98975a75
- SHA1 863a3185b412945af7fe3591bbdfc606d07c65f3
- SHA512 e731d20ecead72295c31d5c29a234650ca0eaa58363cd83af43e1ba60715e2209b2ca41e244561810ab707d71bb05df8aac0604792f2a7c278f262fe5c52a7cd
- SSDEEP 3072:1wKKG59pp9cSuPBN+xJFmL8sUv5TK50Bu:1jsRixJsLT8K
- TLSH
  T13FE36B5253E41922F69E167CAC6465152333C26765B3FBAA0ECE28EC1FCF392491077B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  DS4Prada SZN 3 FPack/DS4Prada BO7 Freepack/NLog.config
- Size 812B
- SHA256 0b09c52503e6949bbed09181e5bae9506752b64bc1cd9e571e1bcc51a5e34e5b
- MD5 11896215efa8bcec73387ef26ab68619
- SHA1 276a76702b80f85da7d5e18afa0a48a8af1b75cd
- SHA512 6f80e74a559497563f67e9844cfc27531a934ad93674856f4eb4931b40f5bb3d3d10ad4b5cfd8e9eda9c14d858582eb343eaa7131212dff2247e1235c992639e
- TLSH
  T1BE01F14D42494DB28F317520BFB46647FB9392E7449879C6F49CA27B3F3610314E7246
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32