0b9fb151dd1f80488ce3ccd8fa792da27950174f3aad01b392ae8589aee1682e

Sharing

Copy URL Twitter E-mail

General

Target
Windows_executable.zip
Size 37.9MB
Sample260709-1xasfaas3q
SHA256 0b9fb151dd1f80488ce3ccd8fa792da27950174f3aad01b392ae8589aee1682e
MD5 08cb5bde6d12344b3189bb480ab2222c
SHA1 cae0cde09c8c56ad005bd72630503c75b4442cb0
SHA512 fc0fe901dee63e904e9ef5ce38d2672db1e0b6045f8f6e3c6890659823a6e157b8c32ef2349738eb09bbe5cb41040b60518fafae1d1a609691b08e01373fb1e6
SSDEEP 786432:syHqIA5V//MGVlg6zzgCraLlvZKLgDvzt0wiDQZh4s4HWB8d0Fb7SOK99eF:syHqI8VcwCF9ZfvukEKF49eF
TLSH
T1319733A551BCD0D8EEBB043E91541C142A2EB8E3AD3B937C7575C5A32CE39CB9A3D049
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  main/_internal/PyQt5/Qt5/bin/MSVCP140.dll
- Size 576KB
- SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
- MD5 01b946a2edc5cc166de018dbb754b69c
- SHA1 dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
- SHA512 65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5
- SSDEEP 12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
- TLSH
  T1DBC40923A74901A0E196E3B891C78306D7F17C468312E3C792FAD66D2F5B7D5AB3B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence ransomware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  main/_internal/PyQt5/Qt5/bin/MSVCP140_1.dll
- Size 30KB
- SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
- MD5 0fe6d52eb94c848fe258dc0ec9ff4c11
- SHA1 95cc74c64ab80785f3893d61a73b8a958d24da29
- SHA512 c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86
- SSDEEP 384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
- TLSH
  T1F9E24C8AEB688883E963587085B9DD47FC3DF7D15B60529F1259E7680CD33C2AB3461C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Core.dll
- Size 5.7MB
- SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
- MD5 817520432a42efa345b2d97f5c24510e
- SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
- SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
- SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
- TLSH
  T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5DBus.dll
- Size 426KB
- SHA256 1aa70b106a10c86946e23caa9fc752dc16e29fbe803bba1f1ab30d1c63ee852a
- MD5 0e8ff02d971b61b5d2dd1ac4df01ae4a
- SHA1 638f0b46730884fa036900649f69f3021557e2fe
- SHA512 7ba616ede66b16d9f8b2a56c3117db49a74d59d0d32eaa6958de57eac78f14b1c7f2dbba9eae4d77937399cf14d44535531baf6f9db16f357f8712dfaae4346a
- SSDEEP 6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
- TLSH
  T1D1944B2BF3941A91E06BD238C967C912D1F374484391AACF6369CF655F33AD27A3A341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Gui.dll
- Size 6.7MB
- SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
- MD5 47307a1e2e9987ab422f09771d590ff1
- SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
- SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
- SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
- TLSH
  T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Network.dll
- Size 1.3MB
- SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
- MD5 3569693d5bae82854de1d88f86c33184
- SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
- SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
- SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
- TLSH
  T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Qml.dll
- Size 3.4MB
- SHA256 30035484c81590976627f8face9507caa8581a7dc7630cccf6a8d6de65cab707
- MD5 d055566b5168d7b1d4e307c41ce47c4b
- SHA1 043c0056e9951da79ec94a66a784972532dc18ef
- SHA512 4f12d17aa8a3008caa3ddd0e41d3ed713a24f9b5a465ee93b2e4beccf876d5bdf0259aa0d2dd77ad61bb59dc871f78937ffbe4d0f60638014e8ea8a27caf228d
- SSDEEP 98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
- TLSH
  T128F55A4773D54296C06AD278CE4B8907D7B3B8044763EBDB02559B5A2F33BE22A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5QmlModels.dll
- Size 428KB
- SHA256 51e4e5a5e91f78774c44f69b599fae4735277ef2918f7061778615cb5c4f6e81
- MD5 2030c4177b499e6118be5b9e5761fce1
- SHA1 050d0e67c4aa890c80f46cf615431004f2f4f8fc
- SHA512 488f7d5d9d8deee9bbb9d63dae346e46efeb62456279f388b323777999b597c2d5aea0ee379bdf94c9cbcfd3367d344fb6b5e90ac40be2ce95efa5bbdd363bcc
- SSDEEP 6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
- TLSH
  T189945C5BF7500491D0BAC279CAABC506E6B378440791E6CB22A9C7692F73BE13D7E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Quick.dll
- Size 4.0MB
- SHA256 c81ad3c1111544064b1830c6f1aef3c1fd13b401546ab3b852d697c0f4d854b3
- MD5 65f59cfc0c1c060ce20d3b9ceffbaf46
- SHA1 cfd56d77506cd8c0671ca559d659dab39e4ad3c2
- SHA512 d6f6dc19f1a0495026cba765b5a2414b6af0dbfc37b5aceed1cd0ae37b3b0f574b759a176d75b01edd74c6ce9a3642d3d29a3fd7f166b53a41c8978f562b4b50
- SSDEEP 49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
- TLSH
  T131166B4B37958091C067D27C8A9B8603E67270805B5297CF22798F5C2F737E12ABF7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Svg.dll
- Size 322KB
- SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
- MD5 03761f923e52a7269a6e3a7452f6be93
- SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
- SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
- SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
- TLSH
  T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5WebSockets.dll
- Size 145KB
- SHA256 6b56f77da6f17880a42d2f9d2ec8b426248f7ab2196a0f55d37ade39e3878bc6
- MD5 a016545f963548e0f37885e07ef945c7
- SHA1 cbe499e53ab0bd2da21018f4e2092e33560c846f
- SHA512 47a3c965593b97392f8995c7b80394e5368d735d4c77f610afd61367ffe7658a0e83a0dbd19962c4fa864d94f245a9185a915010afa23467f999c833982654c2
- SSDEEP 3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
- TLSH
  T17BE3F853B76112D2E0759278C69B82A2F773B0448B129BDF52298F3E1F237D2AD3D641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Widgets.dll
- Size 5.2MB
- SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
- MD5 4cd1f8fdcd617932db131c3688845ea8
- SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
- SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
- SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
- TLSH
  T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  main/_internal/PyQt5/Qt5/bin/Qt5Xml.dll
- Size 208KB
- SHA256 ebdf91f0310ab67a79abd2385fa428205856f81e3a753e6e47c31d5946ddd590
- MD5 5b795fa24584ed85bdb39b9d2287cd59
- SHA1 067c3c7b4ca0ecabe48d02ae2f13058517d444c5
- SHA512 116f1c331758b663a27c20e1f3f686ba8727726fd8a8b71ac52f5ac67f95b61aae595c66292c42d8e50b5c4e33157c26fc494e5802890298c684924e54acba17
- SSDEEP 3072:jBLpK7i4eNHSb35XAE8vnIjmbjYDKGOUO2S/51YpdEH4pkg7/kFBJXT9t0rLvP:tLpWi4eNyVAbvnIibjIGLepkpXTXSbP
- TLSH
  T1CA243B4776254296D06BC138CE5A8D07E6B3B85017639BDF81598B3A2F33FD2B87E250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  main/_internal/PyQt5/Qt5/bin/VCRUNTIME140.dll
- Size 99KB
- SHA256 5e197a086b6a7711baa09afe4ea7c68f0e777b2ff33f1df25a21f375b7d9693a
- MD5 971dbbe854fc6ab78c095607dfad7b5c
- SHA1 1731fb947cd85f9017a95fda1dc5e3b0f6b42ca2
- SHA512 b966aab9c0d9459fada3e5e96998292d6874a7078924ea2c171f0a1a50b0784c24cc408d00852bec48d6a01e67e41d017684631176d3e90151ec692161f1814d
- SSDEEP 1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
- TLSH
  T1E9A37C4A76A882B7D56BC174C0F25A47EB31B844873053CF037599AA0F57BE19E3E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  main/_internal/PyQt5/Qt5/bin/VCRUNTIME140_1.dll
- Size 43KB
- SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
- MD5 6bc084255a5e9eb8df2bcd75b4cd0777
- SHA1 cf071ad4e512cd934028f005cabe06384a3954b6
- SHA512 b822538494d13bda947655af791fed4daa811f20c4b63a45246c8f3befa3ec37ff1aa79246c89174fe35d76ffb636fa228afa4bda0bd6d2c41d01228b151fd89
- SSDEEP 384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
- TLSH
  T156136C4597BC8086E46789B0C0A6DF17FE38F6926760928F0B65D25D2F537C0AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  main/_internal/PyQt5/Qt5/bin/d3dcompiler_47.dll
- Size 4.0MB
- SHA256 e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
- MD5 b0ae3aa9dd1ebd60bdf51cb94834cd04
- SHA1 ee2f5726ac140fb42d17aba033d678afaf8c39c1
- SHA512 756ebf4fa49029d4343d1bdb86ea71b2d49e20ada6370fd7582515455635c73d37ad0dbdeef456a10ab353a12412ba827ca4d70080743c86c3b42fa0a3152aa3
- SSDEEP 49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF
- TLSH
  T14F167C46B2A440F9C1AB8139CA5B8717EBB07814173497EF12909625EF73FE16E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  main/_internal/PyQt5/Qt5/bin/libEGL.dll
- Size 24KB
- SHA256 32092de077fd57b6ef355705ec46c6d21f6d72fbe3d3a5dd628f2a29185a96fa
- MD5 bb00ef1dd81296af10fdfa673b4d1397
- SHA1 773ffcf4a231b963baac36cbef68079c09b62837
- SHA512 c87c0868c04852b63a7399afe4e568cd9a65b7b7d5fd63030abea649aac5e9f2293ab5be2b2ce56a57f2b4b1992ae730150a293ada53637fc5cd7be0a727cbd4
- SSDEEP 384:KEyYvsyDQrjwgut4Maw+XZndDGg7Dgf2hU:RvszjwgocwOhdDGEUf2hU
- TLSH
  T13DB218779B250C52ED3283B4A4968B25D672FF425762C3F7126CC05C0E92BC2B5383E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  main/_internal/PyQt5/Qt5/bin/libGLESv2.dll
- Size 3.2MB
- SHA256 50fad5605b3d57627848b3b84a744dfb6a045609b8236b04124f2234676758d8
- MD5 2247ee4356666335df7d72129af8d600
- SHA1 f0131c1a67fc17c0e8dcc4a4ca38c9f1780e7182
- SHA512 67f2a7bf169c7b9a516689cf1b16446ca50e57f099b9b742ccb1abb2dcde8867f8f6305ad8842cd96194687fc314715ae04c1942b0e0a4f51b592b028c5b16d3
- SSDEEP 49152:sU0O89Onk/cNTgO/WSLqfTPnK+9eaOiY95ZEQryD1pPG3L:MaHUKt3L
- TLSH
  T1B3F57C4BA1A800EDC1FBD13CDA576A07F7B2745583A0ABCF16A046921F47BF1697E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  main/_internal/PyQt5/Qt5/bin/opengl32sw.dll
- Size 20.0MB
- SHA256 963641a718f9cae2705d5299eae9b7444e84e72ab3bef96a691510dd05fa1da4
- MD5 7dbc97bfee0c7ac89da8d0c770c977b6
- SHA1 a064c8d8967aaa4ada29bd9fefbe40405360412c
- SHA512 286997501e1f5ce236c041dcb1a225b4e01c0f7c523c18e9835507a15c0ac53c4d50f74f94822125a7851fe2cb2fb72f84311a2259a5a50dce6f56ba05d1d7e8
- SSDEEP 393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
- TLSH
  T17B278C5A72A401D8D47BE17CCA535A07FBB178490321ABDB16F44AAA2F23BF1193F351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  main/_internal/PyQt5/Qt5/plugins/generic/qtuiotouchplugin.dll
- Size 66KB
- SHA256 a9bffb0f3cd69cd775c328c916e46440fe80d99119faebc350c7ec51e3e57c41
- MD5 750a31de7840b5eed8ba14c1bd84d348
- SHA1 d345d13b0c303b7094d1c438e49f0046791de7f6
- SHA512 5c0a68ed27a9f1bbff104942152e475c94bb64b03ce252eaac1a6770e24dc4156ce4ade99ebcd92662801262ded892c33f84c605ad84472b45a83c4883d5e767
- SSDEEP 1536:mQ4IT53ign4CbtlO705xWL3frA5rlhgQJ7tapgUff:mLIT53Hbtk70OLs3hg0Cz
- TLSH
  T1B7636C6BA7691198D86BD135C5A68B17F672B40103618ADF432AC41D2F337F23EBDB06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  main/_internal/PyQt5/Qt5/plugins/iconengines/qsvgicon.dll
- Size 40KB
- SHA256 42dde60befcf1d9f96b8366a9988626b97d7d0d829ebea32f756d6ecd9ea99a8
- MD5 313f89994f3fea8f67a48ee13359f4ba
- SHA1 8c7d4509a0caa1164cc9415f44735b885a2f3270
- SHA512 06e5026f5db929f242104a503f0d501a9c1dc92973dd0e91d2daf5b277d190082de8d37ace7edf643c70aa98bb3d670defe04ce89b483da4f34e629f8ed5fecf
- SSDEEP 768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
- TLSH
  T1A1137D93B75206C6E467C735D6D98A0AC972B5518B62C3CF8229C9341FB37D3783CA98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qgif.dll
- Size 38KB
- SHA256 36174dd4c5f37c5f065c7a26e0ac65c4c3a41fdc0416882af856a23a5d03bb9d
- MD5 52fd90e34fe8ded8e197b532bd622ef7
- SHA1 834e280e00bae48a9e509a7dc909bea3169bdce2
- SHA512 ef3fb3770808b3690c11a18316b0c1c56c80198c1b1910e8aa198df8281ba4e13dc9a6179bb93a379ad849304f6bb934f23e6bbd3d258b274cc31856de0fc12b
- SSDEEP 768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
- TLSH
  T160034B56DB7804D2E5138638C49A4E1BEA36F5615B62D7DF836680290F337D23A3C738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qicns.dll
- Size 43KB
- SHA256 f4a229a082d16f80016f366156a2b951550f1e9df6d4177323bbedd92a429909
- MD5 ad84af4d585643ff94bfa6de672b3284
- SHA1 5d2df51028fbeb7f6b52c02add702bc3fa781e08
- SHA512 b68d83a4a1928eb3390deb9340cb27b8a3eb221c2e0be86211ef318b4dd34b37531ca347c73cce79a640c5b06fbd325e10f8c37e0cee2581f22abfbff5cc0d55
- SSDEEP 768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
- TLSH
  T19B135B47A7A901D1E15BC238D59A4A3AD671FA029B52CBDF0169C92C2F73BD13C7CB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qico.dll
- Size 37KB
- SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
- MD5 a9abd4329ca364d4f430eddcb471be59
- SHA1 c00a629419509929507a05aebb706562c837e337
- SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
- SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
- TLSH
  T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qjpeg.dll
- Size 411KB
- SHA256 fb4e980cb5fafa8a4cd4239329aed93f7c32ed939c94b61fb2df657f3c6ad158
- MD5 16abcceb70ba20e73858e8f1912c05cd
- SHA1 4b3a32b166ab5bbbee229790fdae9cbc84f936ba
- SHA512 3e5c83967bf31c9b7f1720059dd51aa4338e518b076b0461541c781b076135e9cb9cbceb13a8ec9217104517fbcc356bdd3ffaca7956d1c939e43988151f6273
- SSDEEP 6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
- TLSH
  T15794F742F1616D82E3D184BCCD95DD66D3503C2D87F786FB3A95B2FA3D32AA03925244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qsvg.dll
- Size 31KB
- SHA256 b3498f0a10ac4cb42cf7213db4944a34594ff36c78c50a0f249c9085d1b1ff39
- MD5 c0de135782fa0235a0ea8e97898eaf2a
- SHA1 fcf5fd99239bf4e0b17b128b0ebec144c7a17de2
- SHA512 7bd5f90ccab3cf50c55eaf14f7ef21e05d3c893fa7ac9846c6ca98d6e6d177263ac5eb8a85a34501bcfca0da7f0b6c39769726f4090fca2231ee64869b81cf0b
- SSDEEP 768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
- TLSH
  T173E25B2ADB265842E537C274E5468F16E532F4215B52D7DF422B82291FA73C23CBC35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qtga.dll
- Size 30KB
- SHA256 5b641dec81aec1cf7ac0cce9fc067bb642fbd32da138a36e3bdac3bb5b36c37a
- MD5 a913276fa25d2e6fd999940454c23093
- SHA1 785b7bc7110218ec0e659c0e5ace9520aa451615
- SHA512 cebe48e6e6c5cdf8fc339560751813b8de11d2471a3dab7d648df5b313d85735889d4e704e8eec0ad1084ab43be0ebdfbacd038aeac46d7a951efb3a7ce838eb
- SSDEEP 768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
- TLSH
  T12CE25C6AD7790C82E52BA274E6928E0BD532F6205B22C7CF5255821D4F7B7C27C3C399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qtiff.dll
- Size 380KB
- SHA256 825174429ced6b3dab18115dbc6c9da07bf5248c86ec1bd5c0dcaeca93b4c22d
- MD5 9c0acf12d3d25384868dcd81c787f382
- SHA1 c6e877aba3fb3d2f21d86be300e753e23bb0b74e
- SHA512 45594fa3c5d7c4f26325927bb8d51b0b88e162e3f5e7b7f39a5d72437606383e9fdc8f83a77f814e45aff254914514ae52c1d840a6c7b98767f362ed3f4fc5bd
- SSDEEP 6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
- TLSH
  T123847105DED049ABD876813456E7C612F3B3B4893F02CB9B9658B1343E027D125AB6FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qwbmp.dll
- Size 29KB
- SHA256 0f05969fb926a62a338782b32446ea3e28e4bfbffc0dbd25ed303fab3404abac
- MD5 68919381e3c64e956d05863339f5c68c
- SHA1 ce0a2ad1f1a46b61cb298cec5aa0b25ff2c12992
- SHA512 6222a3818157f6bcd793291a6c0380ef8c6b93ecea2e0c9a767d9d9163461b541afaf8c6b21c5a020f01c95c6ee9b2b74b358ba18da120f520e87e24b20836aa
- SSDEEP 768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
- TLSH
  T1DCD25B5AE76548D2E57ACB74E2D68A27DA32F1125722C7DF1266821C0F637C23C3C789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  main/_internal/PyQt5/Qt5/plugins/imageformats/qwebp.dll
- Size 498KB
- SHA256 6e37acd0d357871f92b7fde7206c904c734caa02f94544df646957df8c4987af
- MD5 308e4565c3c5646f9abd77885b07358e
- SHA1 71cb8047a9ef0cdb3ee27428726cacd063bb95b7
- SHA512 ffaeecfae097d5e9d1186522bd8d29c95ce48b87583624eb6d0d52bd19e36db2860a557e19f0a05847458605a9a540c2a9899d53d36a6b7fd5bf0ad86af88124
- SSDEEP 12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
- TLSH
  T1F3B45B4ED5563788E56BD0B8DABD960BF6643C5C438085EB03D5F9392A33BC4663BB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  main/_internal/PyQt5/Qt5/plugins/platforms/qminimal.dll
- Size 824KB
- SHA256 05d1e7364dd2a672df3ca44dd6fd85bed3d3dc239dcfe29bfb464f10b4daa628
- MD5 2f6d88f8ec3047deaf174002228219ab
- SHA1 eb7242bb0fe74ea78a17d39c76310a7cdd1603a8
- SHA512 0a895ba11c81af14b5bd1a04a450d6dcca531063307c9ef076e9c47bd15f4438837c5d425caee2150f3259691f971d6ee61154748d06d29e4e77da3110053b54
- SSDEEP 12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
- TLSH
  T19F057E87F3A905A8C567C239C257961BE7B274091321ABDF15A08F697F13FE12B3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  main/_internal/PyQt5/Qt5/plugins/platforms/qoffscreen.dll
- Size 736KB
- SHA256 54097626faae718a4bc8e436c85b4ded8f8fb7051b2b9563a29aee4ed5c32b7b
- MD5 6407499918557594916c6ab1ffef1e99
- SHA1 5a57c6b3ffd51fc5688d5a28436ad2c2e70d3976
- SHA512 8e8abb563a508e7e75241b9720a0e7ae9c1a59dd23788c74e4ed32a028721f56546792d6cca326f3d6aa0a62fdedc63bf41b8b74187215cd3b26439f40233f4d
- SSDEEP 12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
- TLSH
  T17EF48E87E7B506A8C567C238825B862BF37574051310EBDF16A44B7A7F13FE16A3A324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32