6fe07835a56e0e401af580cfb9167cd460973f066c162f7e69dfc256b1f9a90d

Sharing

Copy URL Twitter E-mail

General

Target
ACPreloader.zip
Size 614KB
Sample260708-qd9gjsg13p
SHA256 6fe07835a56e0e401af580cfb9167cd460973f066c162f7e69dfc256b1f9a90d
MD5 2c744885f21f5459bf038abeed4f7c6e
SHA1 9f3e04cbc655c3b0839af81f80beee51b4f112c6
SHA512 bd6938f06c494c7d401bd48aa41b61170b7042c1bfb28fffc2f7aa15844ef0c0c07f57c034ea0e3a08663e4edea7ae954322039701aec1bf9e7131be7384afec
SSDEEP 12288:t7COKOsozSXDc6cv3PnDlB7KVEBThyyU1oEgJt33x1Kh4tbifL3kZLBk9ruT:QZOsOSXbMPnjzB4yU1iJt33xE45iz3E9
TLSH
T14DD42353E3852052D04BBFF6F8902BBC57921F5258E2C677CC22789391691BA1DAE3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ACPreloader.zip
- Size 614KB
- SHA256 6fe07835a56e0e401af580cfb9167cd460973f066c162f7e69dfc256b1f9a90d
- MD5 2c744885f21f5459bf038abeed4f7c6e
- SHA1 9f3e04cbc655c3b0839af81f80beee51b4f112c6
- SHA512 bd6938f06c494c7d401bd48aa41b61170b7042c1bfb28fffc2f7aa15844ef0c0c07f57c034ea0e3a08663e4edea7ae954322039701aec1bf9e7131be7384afec
- SSDEEP 12288:t7COKOsozSXDc6cv3PnDlB7KVEBThyyU1oEgJt33x1Kh4tbifL3kZLBk9ruT:QZOsOSXbMPnjzB4yU1iJt33xE45iz3E9
- TLSH
  T14DD42353E3852052D04BBFF6F8902BBC57921F5258E2C677CC22789391691BA1DAE3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  .doorstop_version
- Size 5B
- SHA256 2744735fee2ee237e29f592f88ab669dc8d478fca31e6da4caf9a4a1b3abb7f1
- MD5 c9e4dc50b8d6ed20385fdca95873b3a5
- SHA1 dcd56eaf2c48d9211abe80a49ca88a31709c7e78
- SHA512 80cbdcc7a0d4a5808e5f39ae0e53d7b7c8f5a2238ef303beacfca9fbf459d73f2ab7ea09e2c1d8c4f43c58f65cb4b7bdee5f41f76ae71432ca4f3e72fd697ce6
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  BepInEx/config/BepInEx.cfg
- Size 5KB
- SHA256 8443d78f427027c263511cf66eec454ddf96dee397d042b4f8e00673d3653719
- MD5 6fbb79abb157e750f22ca08a527f5e43
- SHA1 55334443c0634bfaedbe4d3b33c825a26245a3ba
- SHA512 0d99c0603e99b90295a0ce521bbc0c08763689df6928d3ec11c1a8801fed33ee3cbac90f70053cffd7d6adb7c9bbf195e7f7a7a7cd8f88747b8a51471caabe21
- SSDEEP 48:5XUersx5gHtjYjnnV7xdT9xD+KFNel2ieevnrUn3V7apmvY7rUn3V7apuenY2z09:5XjESNjYjnxTLDtnUdxU36pU366GCnOU
- TLSH
  T1BEB122653F8EF23F0F30409A990BF1D59618890CC36379B8FD69511D5650BEA8372BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  BepInEx/core/0Harmony.dll
- Size 200KB
- SHA256 1a21cc03424fc82c3dd1346905d16494536b9595ae4162228d99fb7c285c1031
- MD5 4705aa1c7a9795d2787722bc8c419ae8
- SHA1 aa1552cf0311f27ca02d34df0558a718d16fb660
- SHA512 2f2bb761d21d7288c2b373958a5eab228797d1a348147f8ff0ea603611c6d79e938a4ccf45f23ffc82500731a68bce8feafcd26a5264d79fd5d7435e6ba69b93
- SSDEEP 3072:VQsxAaNWfZKtIZWTr7MDiIVXQ9PsMIuvq14e3Lvvv9L2yZKDVkNCuwMTfyQV:GBa+UWi2XCH7s3RqyZ5NCuTeQ
- TLSH
  T124145B6267FD0616D7BF6BB4F47050040671FC17E9AAEB9D6C8464FA0C12780EA513BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  BepInEx/core/0Harmony.xml
- Size 260KB
- SHA256 d1f02fc3ada3a13da307de421225bfe56ebe24064370980979391c4be021672f
- MD5 e6363c10ec87b6ffbe44ac84036ee93d
- SHA1 d7083c94cb5cd4753cffa6e0510f4f70ed29498f
- SHA512 b50eee9602fe0b92a3a36ee33be51ef46d889b106b31d102748be3f9d0de3e457534a1f5407b7045cae937e1739004a33a07ac7b6298f7402994f2ec77fd972b
- SSDEEP 3072:iWFaW5MGApgStNsHGAxvum4ARo5OvdmrqvKUtwr6D:iWFaW3KgSvsHXxvum4ARo5Ovdmrqv84
- TLSH
  T1954400A87AD5AA124C7603955D5DF8C8FE268C33211E1C5238CD3D635F7BEE282BB506
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  BepInEx/core/0Harmony20.dll
- Size 109KB
- SHA256 d256c5373692a184018f171144712460ced1a6f01562fde26e742b077b36cbd6
- MD5 5c687ee768406d650dc1d0878db3cd91
- SHA1 8af12954ed868c21d8ad9e7af13ae4b27c2a3795
- SHA512 502f8f4ea953539884d8fe12ecfb58ba1e706496fc238523c475254d92dddfdbf389cdf6954b2cb019c67925f180aff418c7840e047ef34c952efab125abb1f8
- SSDEEP 3072:hm7VJAkz0vtACBsSh48J03NtbiWYl18bx1SzKkDXZr:mZz0nBPpJ2uWYl18FE
- TLSH
  T10CB34B6433FC4B23D6EE2B78A87436510772E817E426F74EDC48B6F91812B8256523B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  BepInEx/core/BepInEx.Harmony.dll
- Size 5KB
- SHA256 d0739c4a13f369094cb164c205ee4cca5392bdd7241b9f242ee13f0d4c0b1856
- MD5 dbda2a5dce19f10b1d28e4c9f6132f33
- SHA1 28cdb90e0ff909e125c97a1a16ab567387548395
- SHA512 515b30fa0479c8fdd9d5dfdbe7e4fd407ecf31d8885caf2a5d76ed02beafe2c4090aba94533cc844e7a04c552a642cd8e38623fdf91a8f7d3a0e06544ce10aa1
- SSDEEP 48:6Pw5Kgf/sY1jYyx1mG9dt7kjYgKYbLkark/G/wKCogkglufVkd6u9FFUpE6lPkgg:gQT1tx1mG9dt7kc/YbLkmA3okYKdWx
- TLSH
  T1F9C17422B3954337EE7B4731BCE7ABA00538B540596F7A6E2641F2056C666E40932B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  BepInEx/core/BepInEx.Harmony.xml
- Size 3KB
- SHA256 a04fedf08f7c81f5d01aba6f2840a7ffce50b79bbd24587d8dbe69ab73971d29
- MD5 a9ed47b1f141a3c4e36fa02a47e99b5a
- SHA1 8c312db6f4730cfd0a94065c49407de6a98d0427
- SHA512 0a2265559cacb02c603d9018cee487a12d1623c29af5b0993333c98c0e47633d980c88d4893e8ece697229e3638309c7557b4a5181258d9fda70ef532adc0ba8
- TLSH
  T199812820BBC09E121C33035A6E6DFCC8EE250967311D1875368E3E175FBAAD256AF462
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  BepInEx/core/BepInEx.Preloader.dll
- Size 41KB
- SHA256 116f8b879b1b87566f5ce30106fc5d5718da69d3870315d184a4460379a765c7
- MD5 b0df694c373fbda5be068a407ed8d1d4
- SHA1 5514c4cbe2270e8fb4e3c31e46b793fb940ac1a8
- SHA512 c9db37ae84e6cea8086b69ec650a6545a13a318725bea1280e07deca7b7edb20c38f3870028dd5bbb70eb7f7d9a24469a743fe6e8da21163eb6160ad4b7a2122
- SSDEEP 768:0moH3bJwTZrQdRaOGdOk4CEw9mdBMMGjIb6ogub86c9gmMUr:u3bJkZwaOGdT4BMIGT7gmMu
- TLSH
  T15913194033F98709E5FE2F347D71615506B2BA47AE32E34E0D8964AF0D26B945D20B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  BepInEx/core/BepInEx.Preloader.xml
- Size 7KB
- SHA256 5ccaffcef1c41292d94931b24f140ca82b47a879e3439e89293285054490eb0a
- MD5 b484a68fdf9952bd141a20bbcfb02f92
- SHA1 f26bf9b17ea0b5c3c54f135cba42af82e3eb0a8d
- SHA512 baff337310a25fba727bea5dddf0a81a790beb791d96fbbee6268f790e8b7f6919b2af7d882744b122046f6cd9602a2e192c56a5d5680e9985e657266ffcadcc
- SSDEEP 48:7y5fFHr1iG3hEZLzLH4SOtLzfd8TrRMug5dNztVOb5gHYYRRwoctXygoGkrdR8+3:udJKUtffo8xt2u99MC3rYo
- TLSH
  T10AF1BAB475C0DD000C325146DEA9B8C8FE9A0EBB1446543A319D2E5F8F76EC2A56F871
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  BepInEx/core/BepInEx.dll
- Size 124KB
- SHA256 c65b42034bc8ffb9f0b336e416dc3884e3f99fc5a5a89eb1f2ff7868412322cd
- MD5 a7d497dac6ba93cd93acae43f35d408b
- SHA1 45abef98afe654aca3cca103900bc3db82b8c4ad
- SHA512 efaa782efdb7c71f122871dad12ac2f0a4bd47239d1d91a4e5a8889102c09d5a6306561ce8b35c609ab4a443e6c222e4c18a3b903315c59766a93de953c6a569
- SSDEEP 3072:1QfEslO3FJ1TR2N0gvQvoMF/8mfFIs29gXKBQeG9VRBkmw1u:Fs81D9uw5amw1
- TLSH
  T1F8C33A1563FC8A1AE7FF5B75B8B010154B71FE07E823FBDE5A8824ED09227819921772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  BepInEx/core/BepInEx.xml
- Size 87KB
- SHA256 c0c7799bbaf1e37398f85f0ba8e02d8136c55a3165db87063942e3fedda0a68c
- MD5 3f510d17b1ee2968da9d498e23bb4b26
- SHA1 6ae1734ae2eea03270907b43355a954d6cdcf2b8
- SHA512 b33ddcd2c9cd4f7c4e5608516f21e65ce9f60ceea14a92421cd1ff0b180dd8d6bcebc53dbb1d2a993dafeceb8d97905ace29b9fda3f282f03e9134b1da2e8bf8
- SSDEEP 768:MP+8prSsY5RtecdztwsqlOuKx0PbAUwbrOmzgLpOCU:uisAisqlOuKxWe/8pOCU
- TLSH
  T132939C25B7C4BE120C3302639D98B5C4FF350EA321199539B19D7E1B5F3A8D662BBA60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  BepInEx/core/HarmonyXInterop.dll
- Size 23KB
- SHA256 4d6175fa6dfee743423380f62fb5cc7f1811b469748538bd1b974ded34f3f907
- MD5 7435a263fe29d707305c6f7df2a43c74
- SHA1 7ed6e5162f50b3cfef2737211cf09b08060711d4
- SHA512 bb4f049394b0d778c2c2d560687f1b8f638c72d4ee764cbf0acb61074211e418c387e410455aaaadc61abed021fa5f720537b6e33ef9f4abf9832c89dc24164a
- SSDEEP 384:SnZ+u8rdpVwx6ycbCvVOnjhTyO5P2F2KqY3DB/ZU2CamZM2/DVejhUF3fC/bUAGp:SnfqVBlC8VyePqrU2nSPC/oAG2xj6
- TLSH
  T110B24C49B3FC8BA2C6BF5A7979E1325907B4D66BA442EF480CCD21DA4C437681721367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  BepInEx/core/Mono.Cecil.Mdb.dll
- Size 42KB
- SHA256 5896d1898f616701fff18f3b2c71e6b844d2390ef9f41e1c5fccce8cb27c698e
- MD5 5a8b48fcf5e445095799e2c9149ff932
- SHA1 d4c514fbac7a30ddee7d0f597c3eae23a32ccedc
- SHA512 b99b02f296e5c817b8f984317e67c885099a3cc1198ee1808a0033b48ef60d27866719f0986d7f9a1ad547939bf6dc1886e858b9db7ba4375013b96db31957b6
- SSDEEP 768:XgjgMVEdS09ayuzjF/RwmanXdIiO1nqP+7y4CRIJZTMRTIzcRuYhpzt:XgUMn09ay6jF/WmcITIlITMRTtuYnt
- TLSH
  T12213F7112BFD8B1BC29D82FDA4E625061BB1912DA653E7878FC4F1E7BC13B8515021B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  BepInEx/core/Mono.Cecil.Pdb.dll
- Size 84KB
- SHA256 174db44a067f58561510af746f3caeb032037762c57a31c8d9ee32db25174984
- MD5 427e0464246b1e364c5a1a898db2ecf4
- SHA1 dc968ab6e3f9202b5550efb04c0e17c1df04d7d7
- SHA512 02ef1f9246e6117e6e958f019333720f07ff13feb5778b343e69d6e27e74e8ef1e6f122b486ce12b1e1eed546b17499ce906e8660babf281676bd8c6405f0dd6
- SSDEEP 1536:qguHKU52yKfwZyrw03xFjeylsP+ndKFi94lNSex6SU:qguHKU52rwZyrw03uZ+Um4lZ0SU
- TLSH
  T1FF836C39B7FC8972C1AD67B728AB4D0507F2D32ED243A75D49896EF8091776608322D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  BepInEx/core/Mono.Cecil.Rocks.dll
- Size 27KB
- SHA256 54ac539fb5ddc8b44c0e9acd0fcb7324f89d1a072edf8ebc1b06dd691e3d3927
- MD5 36a8284f264bdb2cb3420f5d2b8b10e0
- SHA1 b842aa70ac6ff9cc3922189e971a62659299ef64
- SHA512 3979601ce74b72e1519d020832e57e21b5269bda955878ad52e2d162d6de47fde4793fee9a163551f52081bc2dff90e197f030f8cb83128d07b8571073451e0d
- SSDEEP 384:ZNXMT7GsmR2jm13u4NcU11qvJCyIXcMeDz8PmR1uhLoXeuLMBG9UphJAprjE+J1H:v0I2jo3uobeCyV8uRsdeeum1pg1w7H
- TLSH
  T1D2C2291527598F37C9EF85BE78E1720807F1CA561213CB066CCCA4E9E9877D01B12BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32