aaaae27de81511cc9149a6c2d774ef02c2a7155712336048f3e88d9960a940fb

Sharing

Copy URL Twitter E-mail

General

Target
Nitrox_1.8.1.0_win_x64.zip
Size 44.6MB
Sample260709-aksvdaby5t
SHA256 aaaae27de81511cc9149a6c2d774ef02c2a7155712336048f3e88d9960a940fb
MD5 e5b39369b1cf53442b3f80519a9e62c4
SHA1 2742a3beda75f605635dfbcb99e8a0a6f5323335
SHA512 3879e224a85692a0b9466cfe1908dc84b864489c759b9421b91a0f887a7b2aace80880edcee7f379282b9b57a5fe39405bc3254737752ccb3729a6a57c2581dd
SSDEEP 786432:ndJskZOjkFCVOwfmM6MF1yOw30kZOjkFCE92DD4Au+4cyY692DD4Au+4h:noFOwfmrMFUOw80QD4T+6Y6QD4T+0
TLSH
T16CA7331D9D675E97E889AB30159B981EE1E3C35A9162CEF33CF7B844C87E792C740A04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Nitrox.Launcher.dll
- Size 6.7MB
- SHA256 ba61022bcf543e7427c9d364f3c6e588f03c9490e822ceeabb5b726623a85657
- MD5 2d5ef462f382837f861434b1539163a6
- SHA1 a49f272262d48e258459e6bb3d6ec5f0857f3b09
- SHA512 0079cd1952b1a4372be4922496d57babc22413b159f5ba603d01f1c34afd3ad0bddd698e780af8e804dc7e03fa30aae17a94c6d9f025c4543dfda0ab51babb44
- SSDEEP 98304:fF54/c2uvUfc/76jlCndyknMXEodcuwdF4/7Hto/E9UKwZQNSuEe8HGgADtgNNE:fF6/1u8s6QndJnM0+bt2vKwmye8mgi
- TLSH
  T199661206B392C706CA7E2F7086F41A604E79EF2AE7D3CB5BA19CB660145F7550D0738A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Nitrox.Launcher.exe
- Size 175KB
- SHA256 f630ce312a88f4e567b88e8801e2ca5e14d648a2b29b16e348e59429b3a80b6d
- MD5 53a7bffcb96828e539bd555c45bcd2b4
- SHA1 bbb9864985d5256cf648d308178af92f0f564f63
- SHA512 f2bbaf14c49c8009507db7c2c1cfb9aa197bb25ab22e986d2ca676b941677b414c19ae708131cc439ee10cbfd78da2b373ad35029b51c84e6917c99896a6985e
- SSDEEP 3072:ypbmtWSkvEV42bdAw6O6Vqmpgx8vBpEwc1hf4LOaBdmf3p38T:ypbmlGEV42bQrvBewcPf4/mf3p6
- TLSH
  T144044A52B2A801FDD1B7A37899A21901F77B795A473197CF0390863A1F73AD0AE3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral3 behavioral4
- Target
  Nitrox.Server.Subnautica.dll
- Size 353KB
- SHA256 9c529aec77b44c3febf63e5998a8a0edbb80d3b02d738f5ec67aea7cab75ca1b
- MD5 f94157cba000209858c46481d72a2714
- SHA1 ed5b443d0677777f466f356a707a9286e203b521
- SHA512 8bed6dc63c3e9f28adbbdaf340bf89c84a76c00a8392c722c69ab625ede6f33962a2f145f318ccc4054dc7dacd7ceb12d680d9f2ee060bd5ae002b54aa9ec312
- SSDEEP 6144:hGOqqo6d+8H4m6CSO1fah+ztv7rH+mPhy8KYtyawP00DkF4xFE8okdiPckD:Sw4mTPExtDkFeFakdWD
- TLSH
  T1DC746A1123FC0329E5FF2BB5B4B0092846B2B907E4BAF75D5E85A9ED2D9374098107B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Nitrox.Server.Subnautica.exe
- Size 142KB
- SHA256 92c140942cac986b8d0eb09d51490e18d8efa955d41bef475cfe22391072f704
- MD5 17cf854c59c8c3de23cc1fc202ba00e1
- SHA1 06c89880660dc1212b5990545314b5712ea21a0e
- SHA512 e42bd6f50aec4a87e5d064e119e110e40726d7cc989946bffb5c95fe5025d481dd51bb455d33352b72cd3e6e3d5391f89a60fc559d6bbbbbeac127c3c6d88195
- SSDEEP 3072:fpbmtWSkvEV42bdAw6O6Vqmpgx8vBpuwv:fpbmlGEV42bQrvBYw
- TLSH
  T164E31703B2A911FDE1BBA37889A24901F7B678194B7197CF0350857A1F67BD09E7E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  lib/AssetsTools.NET.dll
- Size 214KB
- SHA256 f6e326d1779d5a0b123e5f2683da7d5bb8f2c0bf209d03b9b96d46a2ce5dfa8b
- MD5 d27a9339b7c64a8aa9cad38fd3406bf1
- SHA1 e75b7d0ea51bf6a87901f769ce96dbd419b8f09c
- SHA512 8cded2fd35835ed96f824afcafc3f9be1121c7fc17fb62424c7ff2020a434b8e3f985e505187dc15abda1093b7901fcefb37e02999e2178bb9dc707d1b71521a
- SSDEEP 3072:eRnBGXRsEbeHIQ2sYIZjpX+bS7/tq0DiMMQMT1PAouz2iMK7CaaouV:eRBGBtbaactqrMMQMJPhipK
- TLSH
  T11A246B352B9CCB57F9DE1A75E070458283F1F4366516CBDE9C01ACBA2E5B3C298126E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  lib/Autofac.dll
- Size 225KB
- SHA256 20696945aa6b4de87bf0cc9bec75ebf8447e9148c11522849f86fb0d92d5534a
- MD5 40b3b404b4cbc42a107b18705367bf37
- SHA1 d8f579d3f72aa0ae4f59277192f16c80bdda4d1b
- SHA512 1118ac02bf160a46d4625e5bd4ad65280d7fefde579fe3484755a16613bcbbcf665cc899a5ec395599cf359800fd28c731affa41cfa85d7e11646aadd8e9cf7f
- SSDEEP 6144:ZMhQeL3LRAgxL/kIEhpk+r7Un+GCSXOHRTS:ZMhVAypacp
- TLSH
  T170342A5667FC2227D6FF1BBAB43050064676F907B84DEB0E798C90F91463B505EA0AB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  lib/Avalonia.Base.dll
- Size 2.0MB
- SHA256 5834385b8bdd97111e4e5216065b0320548ee4fef9cac8976323aee86949f6f4
- MD5 1cf02c1873b193b1920adf56df3b418f
- SHA1 d99820f03a993197e12219e7b0e6673f51322f8e
- SHA512 36e4cc0aecfc8b192edcf172561c71bbdc59dbaf562183090bec4983fd5ea8ffc37c768dc3fb70c797590db45e613e6afcd23e756d9e9c865d593fc0f1be8730
- SSDEEP 24576:O/gjfXD2a0Lr4owlLftR93f12hEWg9rwWnjQbODk6/qTCXJzmph0MtnysAHT1FOO:BowBH93f1cg93QbODLquYH2HTH
- TLSH
  T131A5392273E54F26C86F5B76A0310610137EE4455761CBEF66A4AAFA6C437A08F847F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  lib/Avalonia.Controls.dll
- Size 1.0MB
- SHA256 f7355a6f1f05c59d05098a6b40e4395cc334719346c07285bb74580cb5eac7d4
- MD5 b0cec923fc1671379bc3235e04394cd4
- SHA1 0bf5b20882b73adea4d36f36705829f6614beb0f
- SHA512 16f7e8d1f1ac9fa13e6f858ef71a6824195eee67062868552621f4001ba2cc7b43403a013bf7e6cd96adc7fed67409ab2d400941beecf2228f6c4212e5315be5
- SSDEEP 12288:HzUVs5BWqTcqyvpgoilvALUKMuZ4EBtqCzFhz0CAvVLDI/DOHZIz6Wic:TUVsWgyhgfafPFhICuEDGZIzJic
- TLSH
  T137354C52B3E88B2AC49F16B6F07001395770EA53B799FB5B6948A5ED3CC37621C403E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  lib/Avalonia.DesignerSupport.dll
- Size 204KB
- SHA256 8b4b0b685c87d55c7833cf0692a9cadc6af9b5485b250bcf4221a2b5ce8a9501
- MD5 8ea7cb0f9c18a7cea05d8ee4d6650010
- SHA1 7052b5cb5b92ed82122c06fafb892802a3734731
- SHA512 c0cdca6fda79625bdbe1954632ab79f8b031a5318434306baddb2b4178a45d2760cc967adb05fab163149f8f24b68cf9523e8ceaf0cc63a9d41581151fe15ebb
- SSDEEP 3072:aC2gSR0gu5c60mtja7smjpAs8YSJdqi8YlCGJ5RqHfNumwB6BUPy3obIyB9B/nk:0Pid7jZayqHfNumq6BusyB9x
- TLSH
  T16E14E04553BC4633DAEF8B3AB0EE31430732B55B7EE2E7891BA8B1D809573114A61727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  lib/Avalonia.Desktop.dll
- Size 14KB
- SHA256 52384c7eb0aae749c82356594f3ca6faf7a0c024889521293d5913e756c6447b
- MD5 87f7ea6d706b9b2ec2dfc6e2d3e1463b
- SHA1 86d7aca822a7b2d97054c49556426bd60b87bd50
- SHA512 8b0d58155c23ab909aeea10241e61d795aa8a67b44b0c8e72edaee9bafa2d016df43aec7eeebcd5085578168b44b0c712feabf079cb10d80dc4cda9d11240c96
- SSDEEP 192:urt218PvkK3C7eAgY6DMZPGQVuV9TpBxK:y2DCYZhun
- TLSH
  T10F62B8D4D3145163ECE28A32B9FEF9956137B682ADE2CB565230734AC827B300F62F15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  lib/Avalonia.Dialogs.dll
- Size 237KB
- SHA256 d4a47e288859b162955ccd8a9b39f5607b2f198ae1c2a80095ced06a9f92ed30
- MD5 c3328bcf796c7a57a4bbaa3a51b286a0
- SHA1 6e58b38901f64451da753f3e5d78a1e2d266c26c
- SHA512 b399a3930bc3690d2bb58ab8076ac1ecee7da53eb7a1ef2873b1827b075c344be1f3e45ea1e02de931eab76c1ea71a2836a626a0fb8889572964656df1fa9dcf
- SSDEEP 3072:tpCQOQXlLgbEmk0/Dv6QKwRr4T2EUtxq2FquPt3/yzBuNOIOU7og2Fn2SqmZYR:tpZqXpSIE6Ey/SmWUMxFntq
- TLSH
  T163343900D2459B39CAE6A2787C7CB3BE0975F429FC9AE61734C5AB7105C5A10EC58BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  lib/Avalonia.FreeDesktop.dll
- Size 192KB
- SHA256 4dc56eca36300cd70205b112a13f2e6ad30b59fe446c097883565dd0119feb48
- MD5 ba4b1d2c3b095710c279cf4208905e99
- SHA1 9765ee7e81765c086569f8d8264ed69694862c52
- SHA512 a785b72e9867bcb156ceb547a97d544b89dd85925835145ef8406f862c089f14cd82511dd66bc2ea8eb003100f06734e163ec58fa73e554e72181616ea4fde56
- SSDEEP 3072:xjVyIeElPh2NGivUyjL7qaZswmYyw8ZmVtP3Yc1gFDB12P1BPYf:9nu7C5GtPLi2P1
- TLSH
  T1D1146B26A3E80F93E79F97BCF6A4D525CB76B446888BF74CAD8C65E500533809C0CA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  lib/Avalonia.Markup.Xaml.dll
- Size 82KB
- SHA256 e390efdbdf6a135d9ebeb5f711bd1e13a5d905c389849a52ddecb68ea8718539
- MD5 92c26b105bb3fbabc02d5292ab416b64
- SHA1 e411c3da447d501f4cb6024e541d06be269245a0
- SHA512 759be836c935072035c452539cf3c46ea2ae2fe00c323beda09fea347e88b665e4461d9f5e539ca10523c72d6213e2c30b96595c98c3c94445e2ece6c8beeb4f
- SSDEEP 1536:s0mNnJYZeVt/DS1fTfzD5rax56bNmHQCAwHYsAgXT:sJMmEfBYMmH/FHY6T
- TLSH
  T19E835A3167A98722DAEE4E36F07871000336F6563BF2E79B8A44B5DD9663B200D90777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  lib/Avalonia.Markup.dll
- Size 63KB
- SHA256 072fea2f4d0e920e9cbbe9a6ad89bf766fb7ee38137367c1dd21cd8ff0eb7d0e
- MD5 031251543d2199404591fe9f84dc5a1c
- SHA1 52551ecea0dcffd71a574af5fe8bb166c9f1b68b
- SHA512 8ac1568643277bfd2edeabf1f49ddd0bfd1ed853c952cf980bd71f729c5cf66c915a12b3ce184d03bd9668a2914b45b905ff909d24a96529f301dcb12258edeb
- SSDEEP 768:tYPZols9E05c78/OkkkFP40T8ruLxfhvA9S+x9p5gWI9BJXqhANVqmCf/5APzYZ4:tYOlsBnqp5kTCfhSzYGcs
- TLSH
  T112532A6577E88313E6DE4732B0B876200635B6D77BF2EB974B2075CA2817B614E50B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  lib/Avalonia.Metal.dll
- Size 13KB
- SHA256 f882c51253423bd3bd8eefd3876982ce50f9992bf59dafa615a05be6060b5229
- MD5 8bd5a9a6671bf137bd01b69302f1a160
- SHA1 cdb7798666b2aefa45b463dfdd70dfabe895daaf
- SHA512 d50ae1d797e3c306eb197c5c0dcd5007fa82c2a05de48710f718ee3307e66b1468ce9ab3e38b89df533a87dadc8271b781acd898185feb0ad2c03df3e5585ee5
- SSDEEP 192:LIQtl9U2PS9NtqzAgY6DMZPG9g0wJaL+xP:UQtHHYZld
- TLSH
  T10852A6D093042173ECD28E72B9EEF896617BB682AEE28B556630734AC8177340F56F15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  lib/Avalonia.MicroCom.dll
- Size 15KB
- SHA256 32388aa3fae037b9fae67bc310eaf692abef713502f2f1d4683739852c01ca90
- MD5 c1b0cfcfdf23e3a475c6fca30251f545
- SHA1 da5bfc9f42b9f12aea1d3ffd712080db40834f02
- SHA512 c0a4e927d937e788f47f01c4a8369654a1c66024c35d6919c01f1880cc150014ec595ad9584813cda0bf64df12f88d81162a7726daa2202659abc9744010563a
- SSDEEP 192:nR711jrFzkwcjAgY6DMZPGBFbuD9MNlxF:R3jZ4wCYZBe
- TLSH
  T15062A7D593041173ECD28E3275EFF892653BB682FDE2875562307346C816B240F62E26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Downloads MZ/PE file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32