baca3b37ed7c7fa7f2bbeee0033dabc7f11341fe2c1e7d44bc0616b79435681d

Sharing

Copy URL Twitter E-mail

General

Target
baca3b37ed7c7fa7f2bbeee0033dabc7f11341fe2c1e7d44bc0616b79435681d
Size 9.9MB
Sample260709-phg3esbt4y
SHA256 baca3b37ed7c7fa7f2bbeee0033dabc7f11341fe2c1e7d44bc0616b79435681d
MD5 8491bf7d9fc608859031947064846a8d
SHA1 b97c349290e55f8afce435cfc261831e53fef742
SHA512 ddaf44d4be97003c9e6f4f0db9f267f3a8490d903e137bd6b8f5095b8522bbbe9c0f7cb0c90afdca5ea5e95c39461f266922ec6f6b938b22bb5b95ae36a6138e
SSDEEP 196608:pJkZ8ucJXE9fMFVxHaLpA9AoDahjRvgWGuy0Ef64nsask+heDy1EpNkOcGn1bLk:Te8uciGtMLoDIjRvgn/yS8iy1dOz1Hk
TLSH
T1D8A633CD609A8328A706A27170BEE65D229F5842B8DCF0AC74533DAF5C821D714BDDCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/任务管理器.lnk
- Size 1KB
- SHA256 81d4bf5be47cfc36267eaece1605c02d5def0439b51e85ea8d82200f2baa8f2b
- MD5 e4fd91f4fcbe756fdbfeb1780dbbdfee
- SHA1 59bb13eab43ef08e8b0520e1e4d78235d9a02a90
- SHA512 8e0972b1683d0d47c210c6a1df9e04c13e72ac0d54931d4d747f9ed7d799ab411e0dec56ec42797cab79a41da015a5dcb7569f0a8caeb3f4d719364ee494ef76
- TLSH
  T16C21140616890A16C37B8DB710E7A342D322F4A3AD878E6D42C013982C70176FC7AE6F
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/区域.lnk
- Size 146B
- SHA256 f07530878cd2998fd04021681b599d08e11f37f38394d2285a111b32dda4c8ca
- MD5 3ab14d8cbb00eae74057ef9e22479258
- SHA1 f64426e604b2d43152ad625cbb8303bccd7d84a7
- SHA512 fa5a17ae8a9f8af42abf6bbc8d5716b852541145fcb5eac45096c502c295f5b1ca9df6edf9b37d1d1a8f63dc57c5b7b2a25ea3952cc39573dda7291831046416
- TLSH
  T1CDC012940B069980C0030270811203ED632845519F890B030B511129EA714009497018
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/命令提示符.lnk
- Size 1KB
- SHA256 c77b1a948cbfca16d5c00ab990713ee61debb4978665df5ea66eaab6b2349f05
- MD5 5a5ba862217c90e181e9cb82d338fe0d
- SHA1 984ed1350a622d150b1fbbe2f88220670c96f18e
- SHA512 5a69f6d5fee50ae1f6c49ad6159f10d3eb1c6123f6884ee64023e920b5371e414833ea2fef457311bfeada0c8baf96015f35f966005c1af48840b8afd5f5d6fd
- TLSH
  T18921D006668A0766C3B68E7600FBA302A715F953ED436F2D42C413996C60224FC3ADBE
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/控制面板.lnk
- Size 104B
- SHA256 5ef38b47d3a9cde3e11302051406acec1b935b6fbb0ea877b8c4bb990ef9d9bb
- MD5 430d8acbfc5097b0d76c9dd7ee78995c
- SHA1 3e4c7c2918ef0b89e8d4e8bbf41cf0c15273fd05
- SHA512 e88f0448ea1c038461761c4f70b02a07c79c5ec119249f23124d3e8bc60103de97be0ab9ee5b49fbaa392f297cfb2c83e54c8c3c646afc0405024306100f0602
- TLSH
  T19AB0024112110C61E49C0971C01D6744631854505E1455959E41196B9C21114B50E054
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/系统信息.lnk
- Size 1KB
- SHA256 bab67049d4aa55e1ad5cb91fad37a6951e48620e01b643c5a80b6059d11219b9
- MD5 b55a76653013b8662adab609eb428777
- SHA1 bc2708a255d0b89874f80cd4f65e320114e0f039
- SHA512 f355bc6e022b3cfc3082418984e027f2f8e3ef06bd783ae4c560050003ef92614709c5367b25cc48b6cb0f4e6036c4f845d82366da0e8058116fe6e5c5de0ea8
- TLSH
  T1F321141626C50A66C377CA7700EBE3429725B8939D579E5C4DC813C568B0121FCB9EBF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/系统规格.lnk
- Size 453B
- SHA256 3a291d33a64b2ddd7dc29da34b34f9d4d2c07cb97de62bd3844861e28a8b0b50
- MD5 9ba5e28c585068fa3e5bb6e1d32d4255
- SHA1 d387e161f84dcfd4b9e5f82e8cc4dd285e7835cf
- SHA512 49ad5836c3bb1adae2938c9f305b696a94f3f33930822966ef2e70d406bef3cfa453aabe9ef7ea81d676622356472f411a0e9b60ab5a9824693806eeccaaa4c6
- TLSH
  T169F0D874654512B3C15D53B1CED3D163F374D192F1880E23925207BEA5E100698CB4B9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware spyware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/计算机管理.lnk
- Size 882B
- SHA256 6632bfaf1818d66b9227e0821c4513108f19587f737ada16ea27e981916cc895
- MD5 02c48a1179a8afefd42ea507e4889f6d
- SHA1 19aab2230b72184074813645569b296f2fdd78b4
- SHA512 8d26ac8e72c04d15e6e3fb4350fa2b111de3ffd96bf8dc8b3f45e5ae02ae521a3e2eeccb9716b4070b4a282df1123f91a1acc4374b25ad34d69a0351ce3bfcc7
- TLSH
  T15B119E09564D1E69D37A853710CB2703D729FC8AAD85AE190184125A9C60151FDABEBF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  减速器Designer v2.9.2 便携版/exe/Systemtool/证书.lnk
- Size 877B
- SHA256 5ed4a8035b722b65abb9c748752507e4599e6a34935d4773ff09eaf7dde926b1
- MD5 bf828c37e8a0014dc227c73db2d60bc8
- SHA1 183de6671900cbbf68f79efeba94c2f86ac307a1
- SHA512 8de0548ebe53fd052c1371f991cf65dc8c8be61866b8ef1ad3ea2a00416cea09d6f3f87887cc37525443d32a5205182d6e924c6a24f8e26fc95dfe0f83a109ff
- TLSH
  T17111C01623410959C6BF4D3F42D7EB07E728E942A9469D2A0186119ACC10222FD1DD6F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  减速器Designer v2.9.2 便携版/exe/geek/geek.exe
- Size 6.7MB
- SHA256 d96df1051e62aa40baefd51235be45f8038745582a5d3428b63123fd2ced60db
- MD5 ef78997488e6121971404a3f25686fee
- SHA1 53a260990106e5271cb525f87be008e299beaa85
- SHA512 8a021950ae41a76659cacdba57d4a090b839dc9a39866b1ca3b6efc533d2542cdb40dbf5004c58d1793329a60126052d7372b0b3d4e9165cfa48938f0e77e573
- SSDEEP 98304:jo2mCHer41qIJVUR0LRn2ufOFL//bHAKYmg77UQ1mfa/ews4VOp9mD:U4wIY0LRnHfq37g7oQcfa/ewsWOpsD
- TLSH
  T1BA668D5172E840E4E5B7817589969A5BDFB5B8221B3242CF328C5B5F1F336D24E3B322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery spyware stealer
behavioral17 behavioral18
- Target
  减速器Designer v2.9.2 便携版/减速器Designer v2.9.2.exe
- Size 5.1MB
- SHA256 3fa88f7cce62899c6dc870712f70265aea7e05c147fd97ddcc61d60f843b1a00
- MD5 c2b6b2d4f8a75fdcaa365a74fb054160
- SHA1 8df926b1bd9ca57d76622ac0cc3d372f3bcdb424
- SHA512 09fedeeb258e79b7b204fb9e39f9833969a84e068d277054e9ccf89100a1b4e18e36c83ac68ebfa7a8a56b7171c8e5e5b6c2bbb93636bc2d7a10c81c37178f18
- SSDEEP 98304:w9Qh94lBLnbfMovKvR+740Pd1aJvQXUnCvED4IKKdut2gDsbE+CCamaUDdbmjOHK:w9Qh94lBLnbfMovKvR+740Pd1aJvQXU4
- TLSH
  T1E1469EA6F3C2DB51CB57413A843DBEF29391AC98C6C4021722A37E1A38B6FB5585357C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  减速器Designer v2.9.2 便携版/减速器Designer说明书.chm
- Size 5.1MB
- SHA256 a071ba1d9a413d6ffc413a16aaa2d2317679d38a946bf46c16de65d7ccb0e482
- MD5 7acf7846d3d90d89d37b25186a3b619a
- SHA1 844131228cff0a2d83be3a49a03f5876f24cf75a
- SHA512 24866e3d269e2c4c870e9a11cf5583a92ecab75e936d8e084418b03eed5d0f4235ca0f50150e8c68cb1fcb5fd6a3020c3f11fccddd14942217726e67a01a828c
- SSDEEP 98304:p1/B1kc2V46KW8EjvpVcWzUC93eILIkfjQI1Nj9u0q4IT1HLc9bs+mITHA95R/ff:fjkcqKW8wjcWzUwIIVYoIT1c9bs1ITql
- TLSH
  T1C146338EA5D5936CF755B8322095DAE901D12CC3ACC8B6B67412ADF788C21D314FEEC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22