19b973dc9840eb085b625412174bbc674669f46e436e6b658e9e46e4eaaf0c89

Sharing

Copy URL Twitter E-mail

General

Target
latest.zip
Size 7.8MB
Sample260707-vs9hbaav2v
SHA256 19b973dc9840eb085b625412174bbc674669f46e436e6b658e9e46e4eaaf0c89
MD5 8a31f4e138cd96e76d0c0d74d3658e38
SHA1 46468b9e73759a61f714d2d94572adec3e459e30
SHA512 36abe662da6c6c308685a77dd54d4a6ec084d703147ce3ee41a027a519ce8778cd93c084b4864e4cdad61c92b12f92e078b1a61afdb1874eb06bf291c974f31a
SSDEEP 196608:XdSSpo6UQLXSLWs83VqAynZOkU3L/jkmAz:Xd3ogpsgMRvavrAz
TLSH
T1408633179FAD674EF0A003B5397AA2BE724722E77E3D210CC91293A85991149C7F6C73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  latest.zip
- Size 7.8MB
- SHA256 19b973dc9840eb085b625412174bbc674669f46e436e6b658e9e46e4eaaf0c89
- MD5 8a31f4e138cd96e76d0c0d74d3658e38
- SHA1 46468b9e73759a61f714d2d94572adec3e459e30
- SHA512 36abe662da6c6c308685a77dd54d4a6ec084d703147ce3ee41a027a519ce8778cd93c084b4864e4cdad61c92b12f92e078b1a61afdb1874eb06bf291c974f31a
- SSDEEP 196608:XdSSpo6UQLXSLWs83VqAynZOkU3L/jkmAz:Xd3ogpsgMRvavrAz
- TLSH
  T1408633179FAD674EF0A003B5397AA2BE724722E77E3D210CC91293A85991149C7F6C73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Content Manager.exe
- Size 10.8MB
- SHA256 2367612db7c754bf4f07a0f71188c0cc7ed0e39bef12b7dc3f4af3d0b3ec5bd4
- MD5 60ed4bfbd48a0d1c161d123749ba6586
- SHA1 f21f2d4b038602ebf923fadcb4cbe07cd3b4979a
- SHA512 3e11841e4c1c65ec8d19ff125c515d4ba1f3afc61a92ae18aa8466ae50dbeba4b9ee179211ff3b7b47f31675f761e02bd6cc00fdb373d979b7d10c2d297540db
- SSDEEP 196608:frtCBAX8r+YmyLN1cLu481HQSMj2f/ZaZR97IB/Nv1:DtCBi8yY5b4+wS+8GLi51
- TLSH
  T199B6E04863FCC92CE4BF4FB1B97150514B797E4A5F82D39F1904786C2A723828BA6367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4
- Target
  acmanager.acsound.dll
- Size 13KB
- SHA256 8a1ae2bc213bd35998885f914a95520830ca226c767305350a1cdc9e21420524
- MD5 87706599406900c42ef8a393160a3447
- SHA1 17585d2839cfc18e52fb82613dbfe5af829a424f
- SHA512 42c012cbf8399b3f2dbe72e89c55625ebf5ab2955204df25af350cd083d9bf51ae99d76e336b9465e5b025c02e3c524599a08ba659ee81757df66968a295caf6
- SSDEEP 192:wMjDqvJ8L3tNX8cro/79g0OkK+p8Lj/Nq1t21flEgMALXy5gIDtiMyMHW:Gqrt5MX8vSt2BlEBjstMHW
- TLSH
  T13B52E94EA3EC4336E97FABB6697212510F71FF22A422DF9D158C90495CA73440F22B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  acmanager.contentrepair.dll
- Size 56KB
- SHA256 40b295b589042bcfe068a7de4916eca5c7bc23066d9f5d131b797aa87ade7a30
- MD5 62203dfe72bf31e422f3d6594edc4992
- SHA1 44b4e8fe36b6ea65873526c601aa05849e330fca
- SHA512 e87caa3c1c6ae71866518acb0b22872f74e78664153a04f86a880762a8ccc16637e5c463b591d8cf0c09e053e023697625e91e83cd986bf1c1f96720c215c90c
- SSDEEP 1536:8L970fJ0DB3W3S1R79FqSdLLUzf9yhsDb:8l60AOFqSdPUzWK
- TLSH
  T108434A0163FC4275E6FF7FB9AD7492554B74FC8AA432E70D5C5860EA09973428E20BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  acmanager.controls.dll
- Size 1.2MB
- SHA256 f7d2b258bfcf7d53659786df2a901982ed85187a8126dffbbb04b3295f014471
- MD5 4f175f2dcf8e3905988d39d48dcfaa34
- SHA1 2c66858e278790b3461bead92f8033fd0f096785
- SHA512 54ede8c27b9f6de6ba7b8672d4d0ea34dbc5e58dedf73a90e5af1c2e18a2bb250948f4c1f6b708d3002ca80335684fc77dad6e37d76c46c106a25fcdeead10b1
- SSDEEP 24576:HSu81Xqh+tqzsFeqvXdqAGrbDvH/UHzLItJRp1CncTTQAxMg60XQ:yT1aoSkqAGrbDvH/UHzLItJRpjQAxMg7
- TLSH
  T143559D4463FC8A3CE5BF4FB934305924A73A790679A1C78E588D6D6E1CE37424E523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  acmanager.discordrpc.dll
- Size 29KB
- SHA256 7554b0bfe77591432379d8dac816ec0b24618a50ff400ac4f0efa54691a803e0
- MD5 0286ecb652b2e63527553bc7e12086ec
- SHA1 e2f9cc72ec73505cbec83909a4f823374bd64c84
- SHA512 77d8aba0aeb2f8094ab9c23e2fe05ac2e994f57582e881733405fdb8049eb5916b3bf6dbdaab4e64ca5f3300b5f7a45dc679a84c5da806cbbee418af94555e26
- SSDEEP 768:zw4dWpRnzne2Yo+tuEoamWc7UHknUJZD+1/GP:XdcRzxYo+oEcF7a0Uyi
- TLSH
  T1D8D23B4C77EC8627FEBF5EBAA97052434775A72A7412F74E188C90DC5CA23808901B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  acmanager.internal.dll
- Size 156KB
- SHA256 df56b589ad01ab2c2dddbbf15ab649929744dc8d583cb9a48f76656e3411aaac
- MD5 a3b692f2a2e6f4566475cdb786877114
- SHA1 4b8081086584d8c266da5cce95fab7924fb8a5bc
- SHA512 92b1311e94fc2a417462490a0c8b1c87844f2b872e054823fdfce11f1757745142557fb59cbf32ce9f433d701126dfe2a0e8d9930623a7931993a6d9fe819f8f
- SSDEEP 3072:waAnNmeIB2MZsIZqP35FK1HSZSYaThWqZNa1F7ve9:jGmHZfEPuHSZSYaThWqZNa1A
- TLSH
  T1BAF3C29C3654B2DFC86BCD768E682C64AA60A477430BE243A45716ED8E0D9DBCF150F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  acmanager.largefilessharing.dll
- Size 81KB
- SHA256 9564b40d62505a9d4521698db10972fed1ecf1ff5a6b6e0e2e411776294d57b6
- MD5 e51cfda10eb431b630131dc51755265e
- SHA1 f1a7d615560c36eff15393233a51b287eb17e8ea
- SHA512 f90cd4191d3a294d9eeb936bbe8493b1d77c3938ef6b264853fd7d95d2f675aeff9434aca3e23f2cec5a1b394fe5d1d7ead7debbeb9fe5a8c2c8bab427bbed8b
- SSDEEP 1536:X4QcugzCRuhSoFs4dYREYW7FGk6fvuu8Uq4pY6+QErQ4Wnl1Ux:X42wrFhdYHesuuRq4pYZbx
- TLSH
  T133832B4573F84A13F6FF6BBDB9B452444A75F606AC1AEB8D184C95DC0CA27408CA2377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  acmanager.tools.dll
- Size 2.6MB
- SHA256 c72622d754f1881e0f851046935a2fd2c9e850b26cfed3b38bca0387628d10cf
- MD5 0a42515ee78b3846a229ac10cb77d0cd
- SHA1 abc8574b3fd6ece83bd90526937f2dbed76ebdf3
- SHA512 662541d4203dabd10a8a925f83bdeca9e0dcbbc09500c7c7f5efc989ac32e113a62588c0eff549778828bd53bfaec70e416d521dd2d7ad39459086d4e9ffb5c7
- SSDEEP 24576:Db0aC+zfThXNC6uMOn55jrTuJfyfn4FuNSKy0o+i48mDZYC0pbr/GBiIb5/6UoVG:Db0a7In55HTuGNcbr+N/6UQ3Ot
- TLSH
  T169C55811A3E88F3AE4BF6B79B47440351B75F8525B23E38E2A45A0FD2D72390AC55723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  actools.acdencryption.dll
- Size 6KB
- SHA256 b534ab585bb6227a715c70fe3f16ffbf5f66e3bd1c0723cea0e7bf4221cda36c
- MD5 67adb36b27cefeb03d20c81c0ab95099
- SHA1 c742931f520da674b28ea4bb4c24b616a6137f39
- SHA512 7fd6496ad7fac47f3cc78badec9d639d66305170a1c0b2a1344e6a8af2af3736d669120978eaf082bcafd7e1d7287ec0cd84a041ded81e77b48640b6f498aa9f
- SSDEEP 96:ONdUtlWX4mjb+WiT0mquwSdTQY7Z+c7hBhRlhpfWcp5NbFK:OHcihChhwSyY7kc7hBhRlnucp5G
- TLSH
  T1BFD1A41167EC8771EEF70B32ECB6916157B0FF68DD23A76E0C4405066C2AB914972771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  actools.dll
- Size 536KB
- SHA256 d444c32fbd948057f061ee39a4b483323acb7feb30420edd554f878502e060d8
- MD5 e1510c5f691a7d42461bec1c3893dedc
- SHA1 4c6e81b6cbf53533071886a6f98c0fef14c6d0bf
- SHA512 6bedaf9d7a7ddf12fe2a4f41ff8e47c030b35fbfa7f5416595c56f51594e124d92133f3a80ae025b01874bb56efd8e7549247705b2eda29f7edacd170863a848
- SSDEEP 6144:5RR0gLJdrEehemjK9wcmbTP2byAHsequofmT4XTBYQ2MloZslD/CMqjTbZZcvr1/:50G7rJImXOhuvfkMloGFqsvR6IQ
- TLSH
  T1E6C47B15B3E81A2AC4EF8BB9E4A40D595370E329AB6FF71B6954B2F40DD33454C027A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  actools.extrakn5utils.dll
- Size 148KB
- SHA256 a987475417b7d7e40ae7cf56d60975b39e5db117c7dbf0177229e79ffdb4bcac
- MD5 7bb00160f8d37ffc4d6ac97bf35953b7
- SHA1 1889d1ebbe29f28266939be1fc8ba4b03aca81dd
- SHA512 801d16e1fefb09de967a0afeb24a5e1287543eb1a1560c5d67ad0e4a48c5cd4330221eca090dd935bb3909f8a60dd56035d262e5492688550e5247b84ed5d4af
- SSDEEP 3072:j5wmuSJM+Y0QqojZxLq2xEwZDjkyU7DHQ+Tw0m3xjp4pW8Ao:jnucY0IjZxLq29nDUxbA
- TLSH
  T161E37D2977EC0A62C9DFABBAF4B0501403B0FA17D56BF74F894CA5F80952B815922377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  actools.genericmods.dll
- Size 29KB
- SHA256 9e3c236ed733641b46dec02176111fc69dd91675d7b62cd5cd4168a742df3ae3
- MD5 b10b83445b31ee63d16f186f2b54979c
- SHA1 0af77a13f91df71c21d50ec9c4985b759c84cd75
- SHA512 1f0878f16037b417880d9ba25db5ba5d1090081a4ba656755600b8b072a903695d65e2bf441633508e1bd180867c56db57ddf5ee83192e73bff26d5b66636273
- SSDEEP 384:vc5rsXBY2jEGpFQILHA3pgZYiEOrHKtV3KdDVkV4VlPu5kPFSytvtMHeCDCyjlmB:vc5oXBFjEAQFWOOrwVodibEEmRFC4a6
- TLSH
  T115D23A4237FC4372CAEE5F7A69B5A1910BB1FA67E903EB5C1D8C20D61C52B4006217B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  actools.kn5tools.dll
- Size 181KB
- SHA256 d9b05a94651823259994cd67e27d580667586b1c947c4c6c72c4597146060f2f
- MD5 44c3b0f4f45485adc8f01b00667ae705
- SHA1 aadaccc7d004039d5b69d36b06ef4fcc6da4e928
- SHA512 47866367fd9be883ae22b2d57ae0be64f121d463bdfbcbe1d0aef459647b32529ea5d45ce3380d18acfd087d523610d3a02dbeefb8da4f9ed50d18e7c3a75c26
- SSDEEP 3072:fuI4FA4bgdNct2kNP8yPGfFAEFJMJNozatoZYjPD5MLMk8/RyJ5h:fuI14cdN+240SGfCOJMJNozatoZYjPDa
- TLSH
  T197043D9D3654B5DFC867C9768AA82C64EB60B47B530BE203905716EDAE0D8DBCF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  actools.laptimes.dll
- Size 18KB
- SHA256 a29a9b1fecaf8e1be8a787927d7945b7e84c6acfe0019d5ca92dffd74aa6a4a2
- MD5 ef418d88be5ac5eefeebdcbe0df09772
- SHA1 e78299edd91bd352701f2a40d055581e416a8db8
- SHA512 c4698dfd0028e94dd50f7dfae59f00c5108f554e9c883428831aee9e0c3733ac39d2d0469da660fcc0263f74e92c4a2485301be2353b82c3d20b1cecb450b654
- SSDEEP 384:F3aYJUP/YScTW2mOR4eoKNfXY3ovqnM3Vdxowj7kncM26:FvJoY+sRtNQ4vTSncMd
- TLSH
  T1D682280D6BEC9366CEBF0FFCE8B1019407B5EB536517EBAC4CC966A56C677010820A27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  actools.neuraltyres.dll
- Size 36KB
- SHA256 5af41e4038cfc477ce66c647699df23701599bf29c6c102ebc70bec915ba0758
- MD5 5ba2a314c84d8fc2b21eb83347851882
- SHA1 a742d183c6c6984dc3f7ce30300c85a928b84608
- SHA512 26b13bb1f7ada88998b76cabd9470bb9180b5b4cc494b0f99357ebf2661912b8d761dbae0ee87960aa79fe0e18ded58ca9287771e5951e7a26ecb183c0d1a052
- SSDEEP 768:F2s0oibIueu8EZTHYDU7kPC3Q3CKybtpY2W/nRX5Rbxr+688IqZWxFnJ6gjT+V8P:Fh0oibItu8EZjLk8Q0Y2W/nRXzbl+681
- TLSH
  T1F0F23B09B7EC7723EB6F1BBE5AD9A0454335F8136412EBDF2C8C50E9092A7914D107AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

ConfuserEx .NET packer

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32