12e8a5fceec847b75b5d6084ce236c574a68fe5b13802cf8987bb8522c5a2ad5

Sharing

Copy URL Twitter E-mail

General

Target
ligma Doesnt use wearedevs api.zip
Size 15.3MB
Sample260708-pc89qags6j
SHA256 12e8a5fceec847b75b5d6084ce236c574a68fe5b13802cf8987bb8522c5a2ad5
MD5 513d254b2d7a1e38d5ba9136385bf1f0
SHA1 d960bfe2c53d238e60af4889425d91bed36c5356
SHA512 642bc645b83a87ca42ab0fd46368f5076062b797d4cfebb2285bfaa25d22fdeb5d9a67e9d3c5127380decf56f3a2c66af143f417b9358742a73b86b36cfb5604
SSDEEP 393216:mom6wxa3obZiDTVXbL7XD2ZV8ODFYHjPQYTb+lUrhoT:wXCVT2j8JT+l7
TLSH
T177F6232322A40044D1FECB3DD437BD84F3F2A2768A82DA7DA9D964C52A737E1D613653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ligma Doesnt use wearedevs api/Bunifu_UI_v1.5.3.dll
- Size 236KB
- SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
- MD5 2ecb51ab00c5f340380ecf849291dbcf
- SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
- SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
- SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
- TLSH
  T19D345B1137A88D6BC67E4BFEA4A40240D7B2F956B1DADBCF9D9510FD24C33664B02263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ligma Doesnt use wearedevs api/CookieData/animid.txt
- Size 4B
- SHA256 5040625b1fb6fa4af07226683f6e6003b29e5e70b16f8cfb24be7a752393f0ee
- MD5 eb4585ad9fe0426781ed7c49252f8225
- SHA1 084d24bbed96773031b898def2a3fb8c46134944
- SHA512 f3c2e807fc928347fb9aca7fff43fcb0a02a7096752b1f42dfb9a4d0f66a4eb92cd7c7a0913176e07859c247eecaac23f5fb66b7ebb5fe5237f3a66e0adc0ee4
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  ligma Doesnt use wearedevs api/CookieData/cookieid.txt
- Size 3B
- SHA256 564739ea8fa5926d4fa5c9734fed462061960a22e6b8d5c06e94969d97891bf2
- MD5 e4ac654ba9b61686c2dc854a1128a323
- SHA1 49dddb3b048c671676b4519855d137e37cf71fdc
- SHA512 5218d075c818ff1fd5f18cfa5e8fc468950a8b9b1f99b2d4383c38f335288818285b0b121573ba51efeba298d5924811d3e7406664ff60b57ffd086d681235b1
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ligma Doesnt use wearedevs api/Dont open otherwise it will currupt/Project ligma.exe.config
- Size 189B
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH
  T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  ligma Doesnt use wearedevs api/Dont open otherwise it will currupt/Project ligma.pdb
- Size 43KB
- SHA256 824c64ebaa21500e54741014c8f5d6488fd331e59bfe07b48ee9a2ff8137f89c
- MD5 dd16eb8414c22c2a47a6fe525b38d9de
- SHA1 079196c0afe8829614e6059ffa864711042817a5
- SHA512 335a9872ac95a437e786ba561f741df478f7a58c9810ece1ec3fe1dc46f9670d10908b0190416c52bc9d915458ee693a63e37f25aebee76b1f21f5e1a24bc76a
- SSDEEP 384:+IQPJQPO1YPEigZ2GDBY4qECvTECb6pxxsQIWzG1YPEigZ2aBR:+IQhQm1YPtgZ2SBVp5IGG1YPtgZ2aB
- TLSH
  T1C013DF0BB301C572D69805B277A38F686135EC008E5977BFE3DBB26C6DF16A84DB4249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  ligma Doesnt use wearedevs api/Dont open otherwise it will currupt/WRDAPICONF.json
- Size 25B
- SHA256 cdb5af8c4d74b14bb46400b1e80627bf4b2dbe860169ddbed29319003b3785e3
- MD5 4e30fb0370f9aa7a580b6e8cb58558ba
- SHA1 4adb8a5d0ced80229b21ae9040de2f28229468a0
- SHA512 33b03332a3758bd7133abfa32e90347b3555aef96710d934010f3ae5e72f7229eaad9ace6861efd562b1ed742c69ceca31f097dad35e5496a7f44ace73309e6b
- MD5 SHA1 SHA512
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  ligma Doesnt use wearedevs api/Dont open otherwise it will currupt/WeAreDevs_API.dll
- Size 607KB
- SHA256 7ba0ffa49d4b1ab59b9b1293faf5bd021ab1a2172c2172e22042ab70b3489eb4
- MD5 0025193fb8ac07ab3bac031604fa4c2f
- SHA1 1ca60ea4d0f3b8dab2cac98052d95752f62a61ef
- SHA512 0ebd381ba822fe5ac4f9dbaecec3469ddda83e1463a14cb73350072450c1cbe45c6eabede44258a51c4e888c5a46da81fa3a11f2cffd6e12528ca3eb0ea7b6aa
- SSDEEP 12288:OURkGrbk/x95DR7XZdfrXg+JwuKt/S/60pR5kjo5Bda7EptO:OIkyk/x9L7Xfw+Jwz/S/69k5BkApt
- TLSH
  T1BED423401AE91214FABBBF7858BA00466576B33BCC97DB9C554A241C4B393CFC962F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ligma Doesnt use wearedevs api/FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH
  T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  ligma Doesnt use wearedevs api/Ligma.CETRAINER
- Size 35KB
- SHA256 2f03867515ca8b39e2b6c19c38183437ce5f07f7c2e84ac1a2c8e5d2ad55ee80
- MD5 4277454f28a46c696c365e944f88a99b
- SHA1 908a29436fe4e5cd813a84dc84d8262e19b5b43d
- SHA512 b00e06e0397aab739b24327139e634a9e221426f34df384c15014adf5639ec404edb752930df3f2056bc0ca6da171d38d058bf2229090eac179c8638bca046aa
- SSDEEP 768:7z6jAc5b9LM29HTzRb275re8Wqx4Hll0w0q86TED51/N:7gAsvng75S8Wqx4HDtREDN
- TLSH
  T15DF2294DFD9A61C09667207CD0BBC84454B930E6311AB5B4FBCC747A17282BED672ACE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ligma Doesnt use wearedevs api/Ligma.dll
- Size 260KB
- SHA256 df376408f0719d9a3f149d5c832bd18d865089d06a7cc6986352849f95fe9b0f
- MD5 97d5693088c94689d4648a6bbe17aaa5
- SHA1 21e80c09542d37906ae7f00cae824d9ac0d819d7
- SHA512 f4a69b627044f9257cd720fa298f8162b5cf412ed98aa733ab68cba83823998f1759e480a19f887e90c5c910e5eb7632bf27929fbe828d24ece4cd59d84c6fa8
- SSDEEP 6144:3sQYrwkN0fTQlTCznxSFz8sslT0w4YrQaW:bjclooz8VlT0wwaW
- TLSH
  T1DB446D80205354A8C01D0AB4392F3B9BF8F479588A87C993B7DCAD77DBE7151E887D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  ligma Doesnt use wearedevs api/Project ligma.exe
- Size 79KB
- SHA256 1c6f99590c85c1b014e756931dbf3ff5331f37ad87d61355da3b022e7fb08c76
- MD5 184dfffccd7e320081893c14785e6493
- SHA1 8c6b738c912e46c7a96dae3dfc233de2c6f1c906
- SHA512 483d623e194839945f8714c259df2d72708b989f40ccc76fae2ecf756c1356f95bedd5c13725ab84fce437515783dec51c66d56c9431250376999c043eead653
- SSDEEP 1536:tHtemE1f1MMcLhJyN4k8+klKtKsKsNyocb75+McLhJyN4k8+klKtKsKsNyocb75J:tHtemEYVk4kxkQUmUoI+Vk4kxkQUmUow
- TLSH
  T1B983F115E7C487A0D0351F7A4DEF8AAC1B3FD8680955F72D1C9012E9DFA93018A26F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  ligma Doesnt use wearedevs api/Project ligma.exe.config
- Size 189B
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH
  T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  ligma Doesnt use wearedevs api/Project ligma.pdb
- Size 43KB
- SHA256 824c64ebaa21500e54741014c8f5d6488fd331e59bfe07b48ee9a2ff8137f89c
- MD5 dd16eb8414c22c2a47a6fe525b38d9de
- SHA1 079196c0afe8829614e6059ffa864711042817a5
- SHA512 335a9872ac95a437e786ba561f741df478f7a58c9810ece1ec3fe1dc46f9670d10908b0190416c52bc9d915458ee693a63e37f25aebee76b1f21f5e1a24bc76a
- SSDEEP 384:+IQPJQPO1YPEigZ2GDBY4qECvTECb6pxxsQIWzG1YPEigZ2aBR:+IQhQm1YPtgZ2SBVp5IGG1YPtgZ2aB
- TLSH
  T1C013DF0BB301C572D69805B277A38F686135EC008E5977BFE3DBB26C6DF16A84DB4249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  ligma Doesnt use wearedevs api/WRDAPICONF.json
- Size 25B
- SHA256 cdb5af8c4d74b14bb46400b1e80627bf4b2dbe860169ddbed29319003b3785e3
- MD5 4e30fb0370f9aa7a580b6e8cb58558ba
- SHA1 4adb8a5d0ced80229b21ae9040de2f28229468a0
- SHA512 33b03332a3758bd7133abfa32e90347b3555aef96710d934010f3ae5e72f7229eaad9ace6861efd562b1ed742c69ceca31f097dad35e5496a7f44ace73309e6b
- MD5 SHA1 SHA512
Score

3^/10
behavioral27 behavioral28
- Target
  ligma Doesnt use wearedevs api/WeAreDevs_API.dll
- Size 607KB
- SHA256 7ba0ffa49d4b1ab59b9b1293faf5bd021ab1a2172c2172e22042ab70b3489eb4
- MD5 0025193fb8ac07ab3bac031604fa4c2f
- SHA1 1ca60ea4d0f3b8dab2cac98052d95752f62a61ef
- SHA512 0ebd381ba822fe5ac4f9dbaecec3469ddda83e1463a14cb73350072450c1cbe45c6eabede44258a51c4e888c5a46da81fa3a11f2cffd6e12528ca3eb0ea7b6aa
- SSDEEP 12288:OURkGrbk/x95DR7XZdfrXg+JwuKt/S/60pR5kjo5Bda7EptO:OIkyk/x9L7Xfw+Jwz/S/69k5BkApt
- TLSH
  T1BED423401AE91214FABBBF7858BA00466576B33BCC97DB9C554A241C4B393CFC962F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  ligma Doesnt use wearedevs api/exploit-main.dll
- Size 4.3MB
- SHA256 a8d7907c72e84afd6d3fe2d1dfdea991185a7154c3e9dcc39e1491182a617618
- MD5 924381db2220801ebb20d571db6c2a9e
- SHA1 61768024ae7b88ed0479d4ec43282066f01fc5b3
- SHA512 75e414174c14cbe6cd197f328acca2202e34d3bfc1a0f7d650920f7c1f1d8a379483f202bea5a2b74ff8f0e8c1ea01cfdc24d190d180a5661ed7b6ab771433a9
- SSDEEP 98304:O4cjPILKcrX/8TQx1IHDqTI8k9EcC3a/QYps0anZ:OHjPILYTbjqlcCqoYha
- TLSH
  T185262377D2A42084D4E6C13D893BFED97BF741AE8B41E4787895DEC228669F4D603A03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32