3afbbc77978fdd42cc0b668fb1f2d0209d59c88d9f361fb55d81e79263b30974

Sharing

Copy URL Twitter E-mail

General

Target
BetterZip5.4.2TNT.dmg
Size 24.3MB
Sample260709-j68mdsez3m
SHA256 3afbbc77978fdd42cc0b668fb1f2d0209d59c88d9f361fb55d81e79263b30974
MD5 88adf28256a5ce0438fdded8cfd289bc
SHA1 abf8d812a27a668e3de777d0254fadd489137d22
SHA512 06ad0f6195cf834d5addefc463bd78cc62f572f313e3084a30c46280435f87ea5082bb032c8fb9cdffa20eda17731a5a1c2789330726c662e885e921700b38db
SSDEEP 786432:GtjnWZocW7ugFlRBkjyMNhn86NZaI1JwJKKPXIh:WjnpxugF/OjlNh8yFaJKKvIh
TLSH
T1244733B09263D9DAC79EDE7207125A84FCC6DADF43D06347D48136F0B39AAA79834E14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BetterZip5.4.2TNT.dmg
- Size 24.3MB
- SHA256 3afbbc77978fdd42cc0b668fb1f2d0209d59c88d9f361fb55d81e79263b30974
- MD5 88adf28256a5ce0438fdded8cfd289bc
- SHA1 abf8d812a27a668e3de777d0254fadd489137d22
- SHA512 06ad0f6195cf834d5addefc463bd78cc62f572f313e3084a30c46280435f87ea5082bb032c8fb9cdffa20eda17731a5a1c2789330726c662e885e921700b38db
- SSDEEP 786432:GtjnWZocW7ugFlRBkjyMNhn86NZaI1JwJKKPXIh:WjnpxugF/OjlNh8yFaJKKvIh
- TLSH
  T1244733B09263D9DAC79EDE7207125A84FCC6DADF43D06347D48136F0B39AAA79834E14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Library/QuickLook/BetterZipQL.qlgenerator/Contents/Resources/betterzipql.js
- Size 4KB
- SHA256 c7f34206a4cb99a5cbcaf7966c9a8e7f9e92833d05572928229fb00bbe84f4d5
- MD5 d440141f5bc099f8b4f2c05733e652dc
- SHA1 2a472de5b20bedd45c817bf1d28c28d93efb3281
- SHA512 0be57a2a31fe251086a70455739c116a00a651736fbbe1af3cb6c126a90f5625639feb5b5ab96ce0327f242077411448ad382eaed5a8f2220db40a5e87384b69
- SSDEEP 96:LJCTG6zMjRM2dZgcrr56lkYCmGLTPl8idOimnJcSHKJdk:LQTGa0Me6HMTPl8idOiacyIu
- TLSH
  T129A1856CA964162A243B123DE56DD00E387F2834264789F17D6CC5B81CD0D3F4DBBEA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2 behavioral3
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Library/QuickLook/BetterZipQL.qlgenerator/Contents/Resources/config.js
- Size 391B
- SHA256 07cf3969d77d3362667e7a6ea73369433ea7027fff456fc682d73d380ae66ecd
- MD5 4098b8bf352484a74613dd7325d8c477
- SHA1 840ea0a9c468f5a2671fef56663d3b4a0bf69174
- SHA512 ae1d5fdd5e670cd26833183c59a50e656a3a4bd404628882c8e32a29baf3c5d8458337f74ed40c57d530b70ecf79b2bed10f535d40fb0ab5e9a3541bb4ee1854
- TLSH
  T147E061667349277520570131D34F20E14C1A514023528DD9F97D51094B89C6D82F78A5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4 behavioral5
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Library/QuickLook/BetterZipQL.qlgenerator/Contents/Resources/effects.js
- Size 161KB
- SHA256 0c0a9907e6c8bf984c019ee999dd510b7eb8429aa79acffccb566b6d33c4ef75
- MD5 622773f3967c5672f00eb3c38a0a199e
- SHA1 e762ce74483f484f5aa0a952d9dc810b1b200d22
- SHA512 198c148cbe9a0a7c667178633885358ef412dd0ce8391dfcac549844ed1ad5a4e4d38a5ca510b6b9d918f01c1d6f7bdd2abaae603a20c4724f4e9288d4081cf2
- SSDEEP 3072:w/5082TxAFA7MCcMn29Q+eVxmC11xAez/F4gO4f9wiJB:y086xAFxG4uB
- TLSH
  T14DF33E4C7DE77029425BF12E6A9F454CF23940071409ED50B8AC86E46FB1E3866FAFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6 behavioral7
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Library/QuickLook/BetterZipQL.qlgenerator/Contents/Resources/index.html
- Size 7KB
- SHA256 942f68f204e7c3ebe3140f91ab67769be1113755b028afb885b94bb9f90dbfb0
- MD5 4744b856550736d85d4980697b01c4f5
- SHA1 eff0aa2673b7010412d10ce16c5d51a0508bd055
- SHA512 d9e0b12235a7f7bb50028eaeb7bdd98df3f29f6c5cf5ef675bb898af7a640ca06d8dd2045cf0f3f63648dbd732e73cc6c5a0c18f4cb4d7c0d15f6b6150091ecc
- SSDEEP 192:FIhiDF8F7DOmTJTL58UxcUhTyp3GG7Dz1:ihiDF8F7vTJ3rcGfG7Dz1
- TLSH
  T14AF1C806C7DC5C35E11D207DD9A4A602359F0FB2CB068E6578770C3FE9C49A085ABAE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral8 behavioral9
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Library/QuickLook/BetterZipQL.qlgenerator/Contents/Resources/index_encrypted.html
- Size 6KB
- SHA256 52555a0de2f4347b7597bd3e5bb529e31a26ac3f10d7029ff46df852a9407556
- MD5 1d28de8d9d61faf0f60cbcfa6d54e98e
- SHA1 140be9b2e0d92d26cd360071fbbb6eaa761e1cb9
- SHA512 e32741fb70aef72b81a047406b0efd0fa65f0d88c48ed6305a20c97864c503c1ba95dc53cb0e2786d262213e8b524e7c13c7b0b3122ed485b6a0ba0196b31da2
- SSDEEP 96:FdO+1uI94/BTX31xhgIACEttSKKwPEpaG7SU+hS4UkFJCNgVUmlt:Fdd1uI94VLaCUxMpaGG7DTt
- TLSH
  T1E8D19306DBAC9C24D12960A98AE4A743255F0FB78B064E57B4771C3EE1C85904A3FBEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral11
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/MacOS/BetterZip
- Size 4.3MB
- SHA256 0b143e1570bdc4b8dee27e6ad655bef0a3d208a985ecda80c9cee623d8ff023d
- MD5 12f5e967411e020b9073c3713f6e0f48
- SHA1 7eee7b38da1ea7a02963e9e6655947df4e0aafda
- SHA512 64973766f2b0a1610eb3bfad003bf175dcdfd3c99d2846e6fe43b4634349885a948b50e5568598a1b077422c1b717237624b30d28c00a0b844718a7472ceb495
- SSDEEP 49152:/mcB7HxwGUfroHNZJGUB79sLLsvv+aqFLvSolgzSLN8+vv+0tXL:/mQq0JGUB72kqFLtaeLNptXL
- TLSH
  T163267E23E3080D16C399723C4A7D07199244FBE15E70B3E76D86A40A3ED6DE51FB9BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/PlugIns/Compress with BetterZip.appex/Contents/MacOS/Compress with BetterZip
- Size 136KB
- SHA256 f9cf9c01804a0ad1b5de885fac1e537fecd65b77ddf902572680b86eb83bdf59
- MD5 c2f470dd484cd4af2f86898d342382f3
- SHA1 362d51724798b7dcbea1b5e4ffa5f289ecb61b5c
- SHA512 c0027f1e2abca21588fceaaca7306d6fe4ae7ad6bf648ebeb2ce4ca9201df585cea1df99cb771de51a565c301509d11b9d514b547da0c629fae1c71d68e56ff4
- SSDEEP 768:vzE2BDI29z8zvIab8oEX/Kf2b5Df1SUNVZ88z8fZUab8:LPNtNavIK0vK+b1f7rCagUK
- TLSH
  T1D1D33B172B0C2817DD89553847CF6743A67AF7995FF1433B0091E0811FA2BFA3A19A9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/PlugIns/FinderSyncExtension.appex/Contents/MacOS/FinderSyncExtension
- Size 377KB
- SHA256 f59de81cf401556ea3bda3b81e212aebe5620f9ef17d01d1d74d10c825eed2ce
- MD5 958d619aebf950e0eec65c35a6d94b97
- SHA1 6ba0496692fe60ab70efbff14e83bd2660ebe361
- SHA512 c021da6e4f830b87ec2fc59c73602c4e1b9610928ce439f023c2990b3db7245a433482f3c6ae44cd28432fe431debc4ce98a35fdd9dedd0097db73ab6bb0a4fb
- SSDEEP 6144:3XCAejdCpGWg3YYRHuvXtb53ja7CZzT0osdnbN8gB:EbtoRPmuFT
- TLSH
  T13A845C2BF70C1A05C35C717D8A5D43068326FFE058B0A3FB1F5990491FBAAE52F5A689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/PlugIns/FinderSyncExtension.appex/Contents/Resources/FinderTemplate.pdf
- Size 4KB
- SHA256 c3cb538ef25376976bf3da4c96b07a1393006bdde0598d4fa3a24ac7bb7b7eb2
- MD5 587fe856bf6f111b8f5d874bc4a227a8
- SHA1 263f804c1b12322101e809d2550cde4cb40b99ec
- SHA512 7b9846cb7b45cc021ee33ddad7b64c03987d1c88edb7ddc474b947f2233fbe17e0e6e466ebe60285a36dbf8fce163c2a76a35429f7658af00e3df5cbb891a514
- SSDEEP 96:o7i6Dpnlw6MC1mfxQGFRS5VXbT/yeTkHPdSLT:o5pnmaomgRSfbTdSPAT
- TLSH
  T184A13C6EE8246C0DD842D8D1947FFE8C4A9C31275AC93481443C0B6ED48B948EA47BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/PlugIns/Quick Look Extension.appex/Contents/MacOS/Quick Look Extension
- Size 1.9MB
- SHA256 5a1c03b43c5f4f8cf7fac71d99885de1a3f37a695e67bdf98b5bc9f027ea6a0c
- MD5 4fb8a070a25413c48fc3ab14f60d107f
- SHA1 5cf58ba4e41b0c60e7cb8b16a588421dd6ce16b7
- SHA512 19e235aaae7f2a05f6d81598c986502eb16bfdf3475adfe34a56ec7a0ac13c3084d0148912da43e35cec35138d9348280a15993c5a0766d4b9b735ccfde1fb9a
- SSDEEP 24576:w4HhziaMXbayRMM981BvkB3k097Fm9TLqFLVEoCtoK2tQeMDeDXGavKEqhL:dqWB1BvkB00CnqFLVzrm9EqhL
- TLSH
  T16E958D27E70F1A1AC3CA723C56AE0325A315FAA06E70A3D72C90D0275FEA9955F31771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/AddTemplate.pdf
- Size 6KB
- SHA256 44e8a4c1d4f938193429d5408e6774c170dc903071bd1f88fbaca900c1f163b4
- MD5 5b1ec7a085794dc48f4fb9d7fd67793d
- SHA1 b116259c1b9769058f314bcb7d76fc57c1413203
- SHA512 6f50e958ca6eac4b456f3eaac0bc13010c2462216f830f9c84aa591dc3f51de0adeb2dbfa458eb249bed43b1855114219b6ca521933e51a939aea48875c91efc
- SSDEEP 96:/xSE6XZ08E9PpQjX3uaIjoH6MC1mfxQGFRS5VXbT/yeTm+Ms1sjiSIzgk5dtvS:cbO8OBs3uroHaomgRSfbTd/1s9Izl5S
- TLSH
  T18ED13C86F864481DF842C097E82FB9ED99FC315763CA78830138171DB44E958E996BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/CleanTemplate.pdf
- Size 4KB
- SHA256 539000b09429431f1963197ae7d475de1119c7d511c1254ffbd07e0a3778e1e1
- MD5 1dba0230ae327a8ecd87b74d5ca9ad81
- SHA1 81378b4daa0b0630f6e071d062c0bcf663567d4c
- SHA512 1abac0ebee2600021f19678c9a7cae8fae673e133b7e852b7e2dafe9900d8fecb6b5c7e99d4466e1052cf41d623b53458113ff978cbd5467443addbeca1cb865
- SSDEEP 96:24Sag6Kk6MC1mfxQGFRS5VXbT/yeTS433YDva+:2Og3kaomgRSfbTd1R+
- TLSH
  T102911B89E4AD581DFC43C892943BBE8D89FC312757D93881142C171DA50F998A9877F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/CommentOverlayTemplate.pdf
- Size 3KB
- SHA256 9066a1be1dca0c789a9dfb20a73ef59b768341af81e1d0d85eaa05dba0a62ec9
- MD5 b88926eb37ea358ffcc234bf9f93368c
- SHA1 936f4672dc127a744c3f44109218f41e37f35032
- SHA512 9ecb87946d343f4866ede8e1e4d7f4c79876b0b58767bae07fd8061458a316bd99bad44a3397c930d7f6428e954dc7ae62a761c7d9938ec40466080ae74d63f0
- TLSH
  T1CC811B5AF8295C0DEC03D495893BFF4C4DEC302756DA3482152C1B2DA44B948B987AB7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral22 behavioral23
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/DeleteTemplate.pdf
- Size 4KB
- SHA256 9a20969f1d75e54ee07fefae7fd4f1c72a065594090745432d25495a4cbcb5b0
- MD5 4da12eb8fb05f09fecbe7fa2942cf945
- SHA1 cb20d4bf0d0518bd1790bdcd2950a39d486ffd05
- SHA512 a720ea0e41ab8907e423cae445b85c63d93e1f0120227487abdd73d285ae4765127e6a0580cdda85346984ef879c5c001b26a47eb14eb1fad7ce69a3979da5c0
- SSDEEP 96:Qwpc/w0Sv6MC1mfxQGFRS5VXbT/yeTkfbOLY:gHAaomgRSfbTdgaY
- TLSH
  T1FD811A96B8695C0DEC03D5A1987FFF9C59EC301B8BC96481143C171EA90B918B687BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral24 behavioral25
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/DirectModeTemplate.pdf
- Size 6KB
- SHA256 dbf19b69fab26a110ae9fe8177c721b1e18413898a1ffcb5aeb47b96b91ea131
- MD5 4afbaefe036fa01846f27b075d68e5eb
- SHA1 9285f635a2387338372155b4b644e534f0fd3ad3
- SHA512 ce43b3842828588b17fe11ccb618997a50bdba04ab6cdced3bee1713c3dfb53d28bc8f37e980458d69de797ce1ecd549c1f0466d5bbac7f112ee6740773e371a
- SSDEEP 96:HzvSeEB8E2J6MC1mfxQGFRS5VXbT/yeTJY+Ms1sjiSIzgEcIFRgT:H5K8vJaomgRSfbTd71s9Iz3dgT
- TLSH
  T1D4D13CD6F425584DE803D183B83BFB9C9AEC301B97CDA841513C131D644BA98F9A6AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral26 behavioral27
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/ExtractTemplate.pdf
- Size 6KB
- SHA256 74784fc5b57428cafb748b336525063c211ba149240e7678347799be4e0b2186
- MD5 9c88275b01792f5f740740ebf304530b
- SHA1 18d275c9dd642c8386e497ce5a81198b4e9cc2d8
- SHA512 ba0bc4d9a3ef19fc1de036d733dd63064a0cde678785bd31af94c70ff66ab2f6fb21560094bf62cb235c6b6737e98cb87a1b0ae76adeec019690f40147244a9a
- SSDEEP 192:WOeg80JmmE6nqq1s9Iz3aomgRSfbTdM9+n:WZz3ykqz3wlM9+n
- TLSH
  T17FD13C96E474580DEC03C496E42FBD9C9DBC302757CAB8C1167C170EA54AA98FA46AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral28 behavioral29
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/FilterArchivesTemplate.pdf
- Size 6KB
- SHA256 a9c090fa7f65063c5daa3b256ae0352413f6c491c9b0cf5d4218e44a8187cec9
- MD5 f3e27f7294856f82de5f1ace05fe6520
- SHA1 33f205e26b464d5e49bbfef3c3c2917c3c22ef28
- SHA512 1fa32e7ebed8a6d2daa012d7721c1f87635e9acbda059aba4c856bee1b4e961289aa86f9fc601d02adb94535e12bb25b100c8098f15e2a09fbc76735d53c5ec5
- SSDEEP 96:gRcI08EDWP6qKAUgif/+Ms1sjiSIzgY6MC1mfxQGFRS5VXbT/yeTVIS/sagr:f8VP6IUS1s9IzHaomgRSfbTdpIfagr
- TLSH
  T12ED13CD6F465480DFC03C497943FBEED9ABC701647CEA8830068071E685BA48F593AF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  BetterZip 5.4.2/BetterZip.app/Contents/Resources/FilterPartsTemplate.pdf
- Size 6KB
- SHA256 f42b97aae6298665579d3a3c4829ace7cf4afbe1c87a98d634fea93432c9a6f0
- MD5 b2b876ee54051577eb5d110d5c5a8205
- SHA1 6d69b6c4fd5d354c0189b933963f008fd68afef5
- SHA512 bf7fe27a8290aac1e9ea8c04823f7f6dd42be3824589e6f24755e778b6a2b80056b868d98c161b2b78ef9353d48713a308fb868ef872f0c43fa21edbc83d8e90
- SSDEEP 192:o4tIeW+87U3p8vJPaomgRSfbTdhX1s9IzYS:pOw3+vZwlhaqzYS
- TLSH
  T1B4E15C96E4604C6DEC42C493D43FBEDD9A7C301787C968C20539071DB80ED88B99A7F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32