5c7f2cdddddba88d804493eb31854e7c4516c41f57f5363215408812ef12be96

Sharing

Copy URL Twitter E-mail

General

Target
example_csharp.rar
Size 48KB
Sample260709-gzdsbsds4m
SHA256 5c7f2cdddddba88d804493eb31854e7c4516c41f57f5363215408812ef12be96
MD5 1c31d46226a69e9fc606044c6fd2256b
SHA1 9f0bc5d19d9b1b12555055df4357c4d5a161bbe8
SHA512 f618f4eb7f1d02911cf93263e4bdf729fe76ce609d06fa10d80029b3dc07a69d1e76691005e27605f020c781f49ef6969931b14084aa986eb223d82c2c568778
SSDEEP 1536:Uexf4t/KQut0tgHPqbNYexf4N/KQu43dRma:7mt/3BgHKNnmN/3t3Sa
TLSH
T1F723D1415F566A27B07A8412689EECC050707701BCD6DDE43FDA0B67494B0AFBF2AB1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  example_csharp/Form1.Designer.cs
- Size 11KB
- SHA256 f51669d862bac6560dd6bf5fb0ddbfb4eaa95471c965067416e70f1e39c1d33c
- MD5 9cac09507808faadeb372220bdfce896
- SHA1 cd7fd85b94a78c7c13647bb4e7c71314fe81bb32
- SHA512 49128a9a7dc1d017ba90987abed7de8bd1f7c5018026b91b7881d518dcf7098052bbad1e84a31d0505dd958a40eb35f4503df22231bf4df30e19140adcea12d0
- SSDEEP 192:xvw0q7q+Ray599eTHHrMqMnlbn9pVo1JJkhRCaidlA644tfl+ghZOwYdrb8Bkl5y:xvw0YZay599eTHHGbn9pVo1JJkhRCaif
- TLSH
  T19732567953AF8494D3E7A04C4F9BD6C00EB6223F791EDD2A389E4591CF5A0684374EB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  example_csharp/Form1.cs
- Size 4KB
- SHA256 4590d78e7d71f866962c0ce0b58a0f18ad0d01c1675ad00056f216e14bfc4710
- MD5 0d1275eef6c02a2699a5d09211c1f994
- SHA1 d0a7407d4e3ae0a973c894383e303aa13f8eed9d
- SHA512 d15131785bbdf1d172087052e18a22fa90568d72e9f10238769ae822d8751acb8e8316dc55d0bf9591d4cdfd51913c5181b777535b4c357085ba2dd5cb982bea
- SSDEEP 96:CjudKGndnc5vnCQwSn1QmE7sCcSQD6COazum7hqGLBAMqj:l1ndnonPhn1Nesg5gVLBAr
- TLSH
  T13AA1117456B24C563603C07DCEE6090A3EA33027225DADB27FAF39518FDC25DAA74678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  example_csharp/Form1.resx
- Size 5KB
- SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
- MD5 4eb5913a0e5aa842250f7419538fa230
- SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
- SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
- TLSH
  T149C11245B1C1DD260FB3482DE6523988FBA8923F02356C50B4DCA61F5F72985A6B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  example_csharp/Properties/Resources.Designer.cs
- Size 2KB
- SHA256 67a1e107b6eb5e17fcd9907b23a939d56a4bf34cf48d35f915e1a53bd3e4eb5b
- MD5 0f66d0b33c5b0ac8456ee3358f856ba2
- SHA1 310bd588d5020a392eed3c084da689386d6b2cf2
- SHA512 d6a2d59b3467ff9ca1fa6f4ce15600cd41f9634b68bdbf74468cc64c1e4dfee0721980aa242a4ddca82ac289dc9418885ad20ff8ae4477ac17a7d5860ff5aa22
- TLSH
  T10B51C9BB1F98C1734834C58BAB01F842DB566113DA6DD574F89F02650FBB28053AEDAE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  example_csharp/Properties/Resources.resx
- Size 5KB
- SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
- MD5 0cd8c971317d19bbed44757809bcb92b
- SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
- SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
- TLSH
  T17FC11245B1C09D220BF3482DE6527988F7A8923B0235AC54B4DCA61F5F73C85A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  example_csharp/Vahalla.cs
- Size 6KB
- SHA256 d355470b35eae86f9fac446566a4b0269a4f330da2fc92e0fae2fa12fa350d20
- MD5 e174b94cf4d07374ac5ea9d4bca28ca4
- SHA1 8115321045903763afee97386a46b491909ea2f3
- SHA512 68834779a86e5e947b150f517d152b4a79ebe294002269e8ac0a651585779d7a06461b4c748346b47f24e1ec4cbb058909852c6ab2cda4553660db122140bc4c
- SSDEEP 192:ta0BaCozFJhihCmoBaJuBaJG7mBaRpTyej4tBiI3CqMQzgIi62YM1zCXlFL:ta0GfecIn
- TLSH
  T1B7E19C0418D75635052760BEA7ABD9903973591323EFD829FFAD03406F4292AF970EAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  example_csharp/bin/Debug/example_csharp.exe
- Size 19KB
- SHA256 ca899b7e89a71730d9ec5aae47abe85f0081b6bc8f58dc0f467053e36b01cb71
- MD5 995e2b8260194e0d1fe8564abe60f737
- SHA1 f03b68b5d5fa729623ce43e195c1b1b12ca5f45f
- SHA512 2333887f2ad5ea17c0e7848827e0f493671ce0c03e74b0f30e48cbbe860460855111a8f04fe67acf804426c46a2b1b92a09055904c89ddf014d412d1fbd796b8
- SSDEEP 384:HxqEcofjSsdoPHlBgSFg04gcMYW6smJNazoxWIGxjmNxjef18d:HxqEcofjvdT9XMss1zLyDjK8
- TLSH
  T1F0920B4577E85B32ECBE4BB6847291500BB67623987BFF4C1DCB50D92423BC88551B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  example_csharp/obj/Debug/example_csharp.exe
- Size 19KB
- SHA256 ca899b7e89a71730d9ec5aae47abe85f0081b6bc8f58dc0f467053e36b01cb71
- MD5 995e2b8260194e0d1fe8564abe60f737
- SHA1 f03b68b5d5fa729623ce43e195c1b1b12ca5f45f
- SHA512 2333887f2ad5ea17c0e7848827e0f493671ce0c03e74b0f30e48cbbe860460855111a8f04fe67acf804426c46a2b1b92a09055904c89ddf014d412d1fbd796b8
- SSDEEP 384:HxqEcofjSsdoPHlBgSFg04gcMYW6smJNazoxWIGxjmNxjef18d:HxqEcofjvdT9XMss1zLyDjK8
- TLSH
  T1F0920B4577E85B32ECBE4BB6847291500BB67623987BFF4C1DCB50D92423BC88551B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16