2c46c2bd60b38bb60eb0a5e3468bfd43e9235521eae2910b8c81455e46335c5c

Sharing

Copy URL Twitter E-mail

General

Target
kodi-21.3-Omega-x64.exe
Size 74.0MB
Sample260707-cbjlfscx4m
SHA256 2c46c2bd60b38bb60eb0a5e3468bfd43e9235521eae2910b8c81455e46335c5c
MD5 73b6231c2379602a2266fbb0b94e9f30
SHA1 43a7300f8cca2263e133bf1771cfd319a93a4fb4
SHA512 3c11f87e2804d13bbcc4b5897c0b6f916b1acded2ee7302ac32fd89d21458b370903e0af24274a4fa230baae93dd01c1d8f48b519855040aaf254f900a711d5c
SSDEEP 1572864:mkHtat458mGfRGLPnpD/ceKbox31r//XiiDoyntF9u8LA:mkNat4OmGfRGzJ/HiYpXiirntXuIA
TLSH
T1CC083340B3BCD803EEB9CB7C9813667066F47B4D9095822C5BE536AC7DB13A26C7E161
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  kodi-21.3-Omega-x64.exe
- Size 74.0MB
- SHA256 2c46c2bd60b38bb60eb0a5e3468bfd43e9235521eae2910b8c81455e46335c5c
- MD5 73b6231c2379602a2266fbb0b94e9f30
- SHA1 43a7300f8cca2263e133bf1771cfd319a93a4fb4
- SHA512 3c11f87e2804d13bbcc4b5897c0b6f916b1acded2ee7302ac32fd89d21458b370903e0af24274a4fa230baae93dd01c1d8f48b519855040aaf254f900a711d5c
- SSDEEP 1572864:mkHtat458mGfRGLPnpD/ceKbox31r//XiiDoyntF9u8LA:mkNat4OmGfRGzJ/HiYpXiirntXuIA
- TLSH
  T1CC083340B3BCD803EEB9CB7C9813667066F47B4D9095822C5BE536AC7DB13A26C7E161
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  system/Python/Lib/xdrlib.py
- Size 6KB
- SHA256 a9043dad797d72c31a4a01ad4069d83ac894720ef8e72490831676a8517d0853
- MD5 ab44399a4abb9874b0f2c2d5f9fea306
- SHA1 0e1f67f497d7e3a497a6ebd8ed6dbaee11a83656
- SHA512 1b905f86af613d9af99e2046aa82eb2c1271c7e2384df010dbcfec37736c2cc2592956ceb08df567fa3cda12b8135c55e75081727ea258921e4f8fca6ac6c6eb
- SSDEEP 96:l3vVO5EFsFUxepdMJhp1ygk+3PGo7YytCl:l3ujSg0w6GMYywl
- TLSH
  T119C168A15E8BD813C073E41E4875F41AE72EA303766C3113B8AE52682FB4519C5F8FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  system/Python/Lib/xml/__init__.py
- Size 577B
- SHA256 8e7bc2b8a9974751e0bf0be8e8fd3c116fb0ed2ff2e372f693a7e3659a46f8dc
- MD5 bbf47a853581da94f257137fc2931942
- SHA1 7f92f135deeec0c2305d13edabe46326ffdbf74c
- SHA512 7db6463c19416a01b51b87f84af5ab44182339938f9f1b919e49d44c4da62ea3cf46967a8a23f8716dc43a3f779f01fdc3c2e83a09d127eda04ce6e2ff07acda
- TLSH
  T1D1F0A630209261B30B3A0A3D784D1682DB2949742367C09A74AC839C4B2163982A6D6C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  system/Python/Lib/xml/dom/NodeFilter.py
- Size 963B
- SHA256 125b3733259b454a33b339e5b20ab0b814dc4fba6337db0bf92c3e8b35f38dc6
- MD5 9958e8a8d21ffe4e3f7bdc7779266848
- SHA1 2649b95de7342e1ea1fedaf5a4177aeac1b1b670
- SHA512 70dbbcb137d11e90075dacc54b49652990bf374749123f7c9abff3f474922cf2ad87f982f676ecd155ba5f59ef32cbe73d6c52fec240d5f6c23a4c5ffa3d76b2
- TLSH
  T15911C080944B94B6E63F60657C167929C78BB1A3A1E54C43F46F4E81CF36C12E9A07AF
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  system/Python/Lib/xml/dom/__init__.py
- Size 4KB
- SHA256 205d03f2e27639a136047a7dc21c37fd3ac7ce593899f8bfc482b33274c090ab
- MD5 52a7c6d8927595a89f26eecc28a9f27c
- SHA1 056019a0c1d1b5f32ca7333d796176648593262d
- SHA512 a2799115a9b5d0d78b9f18a3a066b6db17741354b2b65443ce4242092ae43d71b047e035bd3b22ee9fa011d505a9b89333c6d48cef0d43e8d1a6ad6c3b57b506
- SSDEEP 96:NRSUBXmSRzMdQOW35aBEqRsKBkMUXz7DZW5Lorzi7xA/knQQ/mDvTNm:bXbMdcUEcBkMaz7DZWLorzi72/kCm
- TLSH
  T1948110349D5626B702B748A724BB80A8E97AA34356C8187BB8FC93D45FF4410E22365F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  system/Python/Lib/xml/dom/domreg.py
- Size 3KB
- SHA256 174faca21d253fb4ac50624823614b5b3b41e7b8bdf64d59ef75e901ad43b0a9
- MD5 1428a8ad8e0ff4731ec5f42bde8a7add
- SHA1 d90646b5b206e70d933b825cb714360c8bb0694f
- SHA512 8e329fbefcb9537c3a59b7001c912be1972c2190decdbfc963c8f082b55697dea8b9e6268eb76f7ef451e705c6eff03b0230611aa9cdc4586c3589fdd5485ade
- TLSH
  T117710B9F3E4275176A3B5DBF691A905CFF3643973C100112B86D82583FF09A887EE088
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  system/Python/Lib/xml/dom/expatbuilder.py
- Size 35KB
- SHA256 9c3919fa11f9ace4ed4451fe959b3f264606e6672fa2e14d2f387513b9173d56
- MD5 8edc9617294bf463307892b12c017629
- SHA1 e0ba76dcac93742b023cf018e204b054035baf4b
- SHA512 7c0a351ef5d93643ef159a82b6eac6aeac40cb1ccf73077cba78f2255d7ec71a8cf6625c6c5d04142d6b6387f5bf7b7a2acae5d664f97db59fea6aef6810543d
- SSDEEP 768:9Ds8sGC94+qzypUsIwoDrvkiG9OxBbTgQlMthUKmYKWk8:ps8sGz+pyvk6tlhKFbk8
- TLSH
  T1E2F27371AC474A262633892EAC66F627E72E1313142C91633DFC52582FB1914D2F6FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  system/Python/Lib/xml/dom/minicompat.py
- Size 3KB
- SHA256 99ae261e514de6d47a11ff572d7139eb9dbcc70696e3f6710bb17543f321f4ae
- MD5 d2c69b5b30e8e272b3fcdfacbc139787
- SHA1 9361e0d6b31be99cca23ee02e47a5df2dd7ff0e3
- SHA512 f5c4784b9c4204ab2900fc4af7f26b519a46a87e3e5dcd67b2217737060196ae9bec1d65a0f15c92cbf6f4d99dc1737b76a6f70fe853c06cf3fdfa1af60e0f9f
- TLSH
  T1737185426F4BF8516AB3C49E486CE65EF32A134347345163397C91581F3AA68C3F88DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  system/Python/Lib/xml/dom/minidom.py
- Size 67KB
- SHA256 c83ba1361af8f36892f4b7ddec88ca3bff4c592b40db1771b30ba33fc03e71a7
- MD5 8557765ffb9e82d10b2d48df53307d05
- SHA1 333bfd771d7753a59ef89c5adc57f7a5d1f21077
- SHA512 5a053a5a40797845f32ef87fa21d7816f85fb8371a528e4527ab399f15f0231e1c297757fd42e66f12198371797e9d9325ca271f1fd7b859cd13d0771ab589a0
- SSDEEP 1536:f0k59wIUnDlAOwFkBvYoacmaKl/LfH16BvYqcAe:YAOwFyacmaKVz
- TLSH
  T15A632F76AE0BDB676233C46D58A6F107FB1A1343596C1213B9BC81542F30864D1FAEEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  system/Python/Lib/xml/dom/pulldom.py
- Size 12KB
- SHA256 26a2c6ddca4b34cee3bc91e71c45a1c5ad603cdeef9e267049c67af69ffb19cc
- MD5 0a230380a4e3be76ec953c0f6ce032c5
- SHA1 e353532521d155279451399b38bd23a650947e54
- SHA512 c1ee98f37818c78a086e5b565379dc200bdfb2ffd3500977a8b7852604c6e37f68b6bba68495f77fbdf8d871ee25ec62fe03e805369ff4155a9cec4ed79b9504
- SSDEEP 96:X+UnLXkCP+QE9H9PU1IeBZGiZqQgAq5e8QHqGhe3+BN+x+vjtUH2GppO0Cphyd8o:/LGiktGMtUl0p1CQ8T1oqVw
- TLSH
  T13942EA325C17586914378C2EADA6F51BEB1F26C3A92C101378FC98195F70A51C1F5EEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  system/Python/Lib/xml/dom/xmlbuilder.py
- Size 12KB
- SHA256 ce6de0513a6b01607c04b07504077a74778bcaf4ff35cc844ce029a732573f00
- MD5 708a87e4b0fa08a9bb4fe4b8285f5dff
- SHA1 3c1c486f07609584fdf259aa6d4afe970e340065
- SHA512 5772bb6b461c49e3bddba81101b9a9dc8f9adb8128f3681735484e038109db544e4818e91969984f969afcd829a1cf248ceb73fa9d479e434c22e62aab764f21
- SSDEEP 192:czlret/w/z/0/yt/i/p/V/l/T/3AjbDFNPO0NOG624BhDXYkYKNfAjXZH5ax4h4i:czdeoDY24BhDXYkYKNfyZH2BAM+
- TLSH
  T1AE425137DD42E9160033E57E8C5AEC47EB298317192C892778FCC1682F75A24D1A6D9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  system/Python/Lib/xml/etree/ElementInclude.py
- Size 5KB
- SHA256 ab16341a3645310b700a3f6ef425872ae8456779ad46c8195f0adac22f6d958b
- MD5 a8a45ee4b667eb2d494ba57167da8073
- SHA1 5b61ef0bf7ade2cf8f3b22f7e04e8b0015b7bdcf
- SHA512 625f9927bb501cdcd832531145612a8bf0ba0dc529691e263363dab48ad0a95a31daccfa060b58694f5b10267cbcde7609b3c174d0b281dd60371ea6ad4f2e18
- SSDEEP 96:psWM0NvZ2qWyxDl8Qu5T0RGJwJktNPbNQG+zuIWQdSiqcmkh61gxMkMg4WZOvUG:CWMqEix5fu5TMiJ+GAVX0Zc+Bxg7A
- TLSH
  T173B17112BF1DA2B54571C55E6957F809F005B6AB36121903389CC0DC7FB46A8E2FF6E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  system/Python/Lib/xml/etree/ElementPath.py
- Size 13KB
- SHA256 3a03bd285a96418e93cb8193771d9e940d7ecb16d50a80f68119d13f28518440
- MD5 06bbfd7d8dea4a10c59da1318face4c0
- SHA1 83320b0b6b7a80245f760b6e57133efc5870a9c7
- SHA512 60bf70fe742d71b776f561cbf418ddd6a7883d11674cba5c10678fd08d261020b20c866a900722b195362cc1cec0c5dd37933a4de8bfac0d4a82ac32788a23c8
- SSDEEP 192:g0zEix5fu5TO/yZdmNpwvbKRLsPc8CeSLbYjDTb7RLEqt2dIIS6I:vx5fu5KsdcKt9t
- TLSH
  T1CF5243752E06A835653BCD1F0C66E411F30E926B68444A03B98CD2ED2FF1165E2FE79B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  system/Python/Lib/xml/etree/ElementTree.py
- Size 73KB
- SHA256 141b8df62d1a5ddba706cf4a4b454906779300b4c60ffaca8e52587ff86ad777
- MD5 573e89658543b06153a23de69f21c775
- SHA1 a94eb2bd408f3c47a7161b6db977f3bad4fe882c
- SHA512 90bc28c49fb002d15295bc466e57a241cffcac046be645f50e516e55853a7afb10bb44922cbaa1cb7cc55e86eb71920960d9f2edef28a6bf8baf5c2c98b76d32
- SSDEEP 1536:9OzE5PEGJLTTBay0Ob0itJMTkdN0EK0yaltjdm/Xi69w6lYCOTONCj4yUIZ4FR4X:mEufi69k4XFJCJ
- TLSH
  T168736136FD4B9A628537C52E5C4AE51BF309839B252951173CEC80683F3192192FEEDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  system/Python/Lib/xml/etree/__init__.py
- Size 1KB
- SHA256 e9e8e1aeb152cadd62f5c596e334a017ce86a45dca996a7da6ba3681e9db8dd3
- MD5 a2956f52a5aeeb5bf52ab21daec97529
- SHA1 366b39e33651c0f9e77a18d4dabec8c3b2b1176f
- SHA512 b7051fa87dc0e140102b24cd642a8281ac59fda01685eea494dacb6cc1d267c154aa8cb14216ee97e8968b86a774701596c2fa66548aa4fa65c278c165e03222
- TLSH
  T18231950B6F6267A60E77CB1A6A55FD8DF206B07D77130925345CC1989726A8A807F1C0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  system/Python/Lib/xml/etree/cElementTree.py
- Size 85B
- SHA256 a42c14e24d69c79d1a1462486dc28ced30875787cb9407bd56a62cce83c349a1
- MD5 94dd5dd6a9695867e33608f69f470973
- SHA1 d20b89cfd1e442f114279f1ae7fe1934feaff5ce
- SHA512 fe36b9cf3837f490fb1d0a528c59191e8df521fd84c791918e63fd47f0e4560e848ef087eb681c5678a79c413f480d5f178f5e65d34cc90f5d629899d0520e9f
- TLSH
  T173A00273645B541549DDDDC9300502B5115515395F014B0EA558972F5365DC404C4C69
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32