32377565fff2cba35c80bfca6b2c19eaaf26511f7fa36cdf92685574e2fe7b39

Sharing

Copy URL Twitter E-mail

General

Target
azahar-windows-msys2-2125.1.3-installer.exe
Size 39.3MB
Sample260707-e9sywsez9j
SHA256 32377565fff2cba35c80bfca6b2c19eaaf26511f7fa36cdf92685574e2fe7b39
MD5 3cf089f4a85942b763e5c3169be6d97f
SHA1 176cb816f3b019cc4cfd3e432fcdc1703278b589
SHA512 b11cfafd3b99a3705056b8ab73e5ad0883c3efe61cd83b193feca4394362c53672ff9650423cf13ec9e60618dfe157134678b134de8b468436719f7cf961ef99
SSDEEP 786432:5X7mWVowjs67EFsXMHBcKT0Q1+X3UxFEAWbL4DBtKimiwKl:50wj7xMKK+XkxFjf9Aimihl
TLSH
T1659733898E5001C7ECD31A77E010DAF124629D581EE6A64E35E93EFF3B396163934E87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  azahar-windows-msys2-2125.1.3-installer.exe
- Size 39.3MB
- SHA256 32377565fff2cba35c80bfca6b2c19eaaf26511f7fa36cdf92685574e2fe7b39
- MD5 3cf089f4a85942b763e5c3169be6d97f
- SHA1 176cb816f3b019cc4cfd3e432fcdc1703278b589
- SHA512 b11cfafd3b99a3705056b8ab73e5ad0883c3efe61cd83b193feca4394362c53672ff9650423cf13ec9e60618dfe157134678b134de8b468436719f7cf961ef99
- SSDEEP 786432:5X7mWVowjs67EFsXMHBcKT0Q1+X3UxFEAWbL4DBtKimiwKl:50wj7xMKK+XkxFjf9Aimihl
- TLSH
  T1659733898E5001C7ECD31A77E010DAF124629D581EE6A64E35E93EFF3B396163934E87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Qt6Concurrent.dll
- Size 31KB
- SHA256 d3e06a5012c780d0bbfc6fad848ac444c5c921af082f1f4af84bb5ded5d74ff2
- MD5 a0739a05aa973f787f73dcd59a437ce6
- SHA1 60e724e91d203aea0be9e10993127866b3a7338e
- SHA512 1e1a1d1aecf05e9ef20adaf63ce61e13d88d896077ecc8d982e4eb0ed331f5cfce1a95aad7a9f4896148e92ef96dbef3cce9648043a23a45dde139c7b7993765
- SSDEEP 384:Dl3Io4u2uFVlp++Uxl/Cna7tcfq1UB3PtDGcFy7Y:J3Iozs+UWnYtB1UjD7M
- TLSH
  T1C5E2E9A11F5D499FD8C2EBB5C4E702BA35B7F9011B2B86DF0580963C1E6BBE44631B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Qt6Core.dll
- Size 7.4MB
- SHA256 e570e239af6abdea1e930dfb3c0d568c1ae3f87c34a4b02fd213284219050b34
- MD5 1a20685496d844497fabfb94f24d09d7
- SHA1 3de58f39611d6c52e349b5770c896562a6e005fd
- SHA512 ba9d045f9900e83c059f3a731b562b636dec3ce42e9238da60bb6f08dcad03b6cc40a603764f5f66b00815462e3800c4f6a31d0017b82ed7de97e8b91002da02
- SSDEEP 98304:92vaQD+nXtWLRX8FNF2uMcZdVKFdu9CwJsv6tb09WIsiWvGlNWP0EKXgXCFlW7/:9kGxyuM+KFdu9CwJsv6to9
- TLSH
  T1C4764B42B28691A9F46DD334DAC72322F9327C828B3669EB47849B356D67BD4173F301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Qt6Gui.dll
- Size 10.4MB
- SHA256 af7db34e128100d485a1bc49f28a4704186a40552bf3ee8d0fe7863e9c7e392a
- MD5 2f060b0fb92670c5a962e3884a20db85
- SHA1 8938c7a2a1084365a0a9647e25e3262f6495789b
- SHA512 f859504dff9fbb38a772ff9671700109407c72f1946511d58cc71ec030543c6bbc997633e45a949720fbb0ed2edf0c4430029473f507fb8c4439d8e6efa76a61
- SSDEEP 196608:XPv1+wasi5GUXf7KfMBVSYtkpCycEv60/4h:XPt+wasi5GUXf7KfMBVSYtkpCyjvQ
- TLSH
  T1F8B65B42B64295ADE41AD6349AC76323F9317C454B76A9EB43808B393FB3BD0273E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Qt6Multimedia.dll
- Size 1.9MB
- SHA256 69518a967178a4676009adf2095a979358a79b8697d4f0ee3cb740786d49f6b3
- MD5 96ee72f232c7db5c10a05f3796124e4f
- SHA1 d39e1455a2cc72d39720e63e28e780544c7ddabd
- SHA512 48f7164b7a4501aa613bc0e90c3193db3e076a173877569144f20041f19595ab7b8ea3042c071521f7da4ab5cc66a98d960ced2195a650b54cd592534cd48ae9
- SSDEEP 24576:01+6P9HHa7tlHLq5hz9CQzqv2/bu/D1OZ9+iN6G+fl1RyUj0d:0o6hY+5V/bu/Do3N6nRyUj0d
- TLSH
  T168956B52B6419A9FDC9AE379E8C74322BA30B8514B3399DB5380867B6F67BC1173D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Qt6Network.dll
- Size 2.3MB
- SHA256 900ff1b0cd76d698321e40f27da96c618275493588bfd76148067a227f26548b
- MD5 90421c7e353160555fc672db3e456c01
- SHA1 39d211789369b0148628288e89ea4779804c3dab
- SHA512 6cba6712d27ebd41d398f5a1f4a069ad2c2350b89462b812d9aebdd8a2dd10bf03e873e0bc7ccd45f86b0d758dbce03260007a8989abf01590ea074cd8d10f9e
- SSDEEP 24576:2ujxoGjyNlIQgmsu5lZaobxC45iR43ZuR2SE1CqZd/W/aZq47S5qxk6bjb:Hjxbj+lH575mECTkZukS6ZdOYFxksjb
- TLSH
  T120B54A42B64195AEE85DD634DA876327F83578418B3AE5FB8780877A3E97BE0133D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Qt6Widgets.dll
- Size 8.2MB
- SHA256 d3a62cfeb078b83cbb0e02d7ac68e572eb341be904fcee46ec901b4853c8fb38
- MD5 80af5899eacd1e69169b9032669c5dbf
- SHA1 ea56aae61e7dc17497a65523f7640c981fd147b3
- SHA512 80b181f6c9f748b67fe8e0855294423a5257b60fccdb195ad4118a5ebc2f2e4ced4c6f245444fe191d9b82dfa042893fb2f533cc84046da24902cc86f98982b0
- SSDEEP 98304:RP/X3bcKBKUUg1bslOlmgokr+9/ufei0oypiZCXHTyo3fBB7c1fL:JARUUmYcG8ZCXz9vBBm
- TLSH
  T1F8863A42B24295ADD85ADA38CEC75323F93178858B37A9EF468047393EA77E0173E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  avcodec-62.dll
- Size 17.6MB
- SHA256 f86d23a1e3eaf90070a9649f471e6ebf6d65047258bf6228ce5f32923e091f45
- MD5 09f6a2bf9ccde2b54e37d3b339723684
- SHA1 2a220d5cac6782a9d30090c88a367d10e5c07cb8
- SHA512 4e7fc7cf08c73dbe0036e6259ea9cba55babac922bae310a259d24d414fb35d1a2bf3cdc40acccc5fdc72ef0792fee2008de45dc9d235d3df35d3c4b21ef2f4b
- SSDEEP 393216:bppsY/tug+twiVmRoyvBHgdUuuGZ6MwAX2Ql:VKBup46Mj
- TLSH
  T1A007AE4FF19350E8C50BC57082ABAB33FA3434AD85157CB727A496347EB6BC06A59F48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  avformat-62.dll
- Size 2.7MB
- SHA256 75e63a657617b461a934d94df4e53381e9c30a7bf9683cc921bc4062286649ab
- MD5 617debb990cc2f6b824533a2fa4d4bbc
- SHA1 8efc21d584fbbd3d55ae22a6acd1a12d65944763
- SHA512 c1778504b6506f6fd02ca718872a3e04dc56c55d6d182dc742412ee272dfbd4a4ddcdd0b8bc98c37ad35d4a93e55ec70cd724c80d940a913c2fc56a77ba7dcad
- SSDEEP 49152:3h/K1RYSP37PcZWEmmtWG8yuZf6WJ28XAJ6nKmgTARQ:w1V4J8bzRKmgTARQ
- TLSH
  T1BAD56A03E18215EDC55AC275478B6722BA35B4490B32BEFF1664C7392F65FE0672EB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  avutil-60.dll
- Size 1.1MB
- SHA256 96b18a7b0a6ba3914c68ba2f203a5b45ac7817233a3868ebd3b3429843f04ded
- MD5 9e08793b90635f47a741af5c583102a7
- SHA1 6815017fd5c7cbe205b372ec843700bbf237fcd1
- SHA512 32d5d859d7b1df0d72f3f14af6907c6212f1b3768f5741d439a876173ac3e584f737fa0fe87b1422d884c8a425f01919fa9f7e70e2b656ca75091e1ac5e4faca
- SSDEEP 24576:Xs//rRNRXBih9a8OtJk/Xm61N/LBMMy657WnFz:Xs5XUh9a8O7om8pL7570Fz
- TLSH
  T1B8457D02E5C2556EC447C270869B2A06F2767046DB66BDAF22918A343F34BD07D6FF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  azahar-room.exe
- Size 3.7MB
- SHA256 f9de0dd7fb587fcde661e7a1c9583bc4813a822fa3ae24eceaa13e93c3d69724
- MD5 e77821517ee268421e0a3fe84febdd10
- SHA1 12b4a182694a1fcd565ea2ca5ee958e1481751fb
- SHA512 4f7dbcabfb33307da8bd59c8654c58c0dc401e2f149350c097f5aefd2c5bb72dcd3f2ad6d902d3351dc871f671c0681e2a255a87cd3cec021271f68bf1bb1271
- SSDEEP 49152:qt0C9J4zpsrVCR8Pp1Jdo3+ay/XZC8ip2lXIsX+cZllJEdHa4OJ3DVwf975pbx7R:qX9Jyy1zo3WXZz9SHaCf975XiO
- TLSH
  T134065C47E28580DDC45AC17443076222FA70BC995731BEDF1694A7312F7AAE46F3EB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32