a83f4d0056f8008633e1531c5f85abe683920445a085db486222f673dc90544a

Sharing

Copy URL Twitter E-mail

General

Target
_a83f4d0056f8008633e1531c5f85abe683920445a085db486222f673dc90544a.zip
Size 6.7MB
Sample260709-smfxpsdw2z
SHA256 a83f4d0056f8008633e1531c5f85abe683920445a085db486222f673dc90544a
MD5 97e34e3f7409bbf5f89c035c78b0d259
SHA1 f78b1088603b73253d713c681bcdf2018938c2ba
SHA512 3f04397db77eb91d1bdd8fea466c5cf5711ca16ecc7e47736f4c7b6999075617ad2f4431ca8dd123f7a6d07507bc963b8632ad8242b12072506a8fb190382de9
SSDEEP 196608:TQHn0eKjIUptC5nLIftUxwf3sBguS/uAdfrrx/8LiM:TQEjIsmnLIf+6IAdD1y
TLSH
T1B86633C489B8348FED1BBFBC169427614700BF8F2A8D603154B37A3294DB2D96175E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  AccessibleMarshal.dll
- Size 228KB
- SHA256 c7278b6299bb8857fcfc4fd4aa5f458a1b109f9b76af9e5bf439dca1b7d94f35
- MD5 8187b258cd7e804baadd72bc90879c5e
- SHA1 304afa1711cc19218f8b2c483688d287395db591
- SHA512 619416610e8d1cb3e22147569f70e02084509499c5068c162ab9a18cb83f0a132a64c56a345c773b14a59aa2c554b5d5b4b20ddd66f9c713255aa92ede515413
- SSDEEP 3072:cAIyI9jJQTRz0niJtsAICGzoRdThjqD2t6ldLO1xHxOqlbOehxQwNgnFPcRy13:nIyTTRbIGThjqD2aNWQL0
- TLSH
  T185347C4B76A158BCD106D039930B9A7BB772B88A4730FDBF12E496302F56E512F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  firefoxupdate.dll
- Size 229KB
- SHA256 40a03d714c66d3c75c43d568e9c69ef2d4fd295215762c16bf82bf463926f1b2
- MD5 f7c7c01e0c304dcf982dce6250928fac
- SHA1 bf1b1618490acbcad6bc36988406d8c420cc7e6f
- SHA512 781cffb2520e578232cfde876c7f8dcf4c83ed4c41a4129ab1e0688a4f3f46c685c44dfa8e6d9e73f97816c3595ef83ac43cb81c8df026d0337834a43da215e2
- SSDEEP 3072:5xceGQYLn3ZnYUTqYtHZNOCGzoRXjAqSGtrn9NxHxOqlbOehj/g5Oswkpjej15s:56eG1RlO4jAqSGN9R/IOGg7
- TLSH
  T1EC348E4B72A558BCE106D078935B957BB672B88A4630FDBF12F496302F1BE511F2CB09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  freebl3.dll
- Size 228KB
- SHA256 427bf7ec965852cd0d363dd71ed0be126202f6ea23a67b65828d8d2c4d85d904
- MD5 a2a624b1cbff872257f31c53129719aa
- SHA1 20df2951be3bdb2ba1107d11b34c289cba282f79
- SHA512 44ede580ecec423d0153435179c4ece9f1260da2c91a342f6e5464e9bffcbd481d15ce1b15a36163990a1ca671d2a9fc5f402522baff892c2708a08700603d7f
- SSDEEP 3072:79XfQgvdSpp23C/tTTggCGzoRS7kqu2gN/8/pq5xHxOqlbOehqDwR7GT4N3sV:hXfWpUgZ7kqu2pMsD4
- TLSH
  T193347E4B76A559BCD116C038A347D67BB672B8864230FDBF17E0A6302E17E512F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  gkcodecs.dll
- Size 228KB
- SHA256 34ac1646df21e93b6ef9e2a8f2356351f1bdd1fce7c9c3cd811205aedae392f2
- MD5 114dbe3006bf1884415db648742b043d
- SHA1 45267dbc57f5992e5be394ca1834996ca8617e78
- SHA512 69bfc3747fce8c9321cb79756571dfedfc2683a8f310f12173e6bf7b933c419e89bfbf31e6ce68e1d1bbc9e7076761d639bb88f80eefea55bc77d83ac5cdc670
- SSDEEP 3072:t0cUSQ1fmnd4UXkwtdwZQCGzoRm/p7q22387sfqwxHxOqlbOehiwwAlnF/MclMb:dUSPdGQl/p7q22Py/wzl
- TLSH
  T1D5347D4B72A559BCE106D038935BD67BBB72B8864230FDBF12E496302E17E511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  lgpllibs.dll
- Size 228KB
- SHA256 b4279f2b43ba9e6fe5971cbed6a2b35963a83b8bc10a466ac74115ab9b0e8537
- MD5 4de4fdaf75174c0b0e6693ccc4e9f5cb
- SHA1 985e733727afab1c415dbffc145f43a4d9b7a3c2
- SHA512 d70d43e8d69cd5b1410166d1652b5579950c5b2d394af263dfd971c09e8a6a4a1606d8f7dad16154ec441b501c6c9078a2b3dde06dfb89d0ac6e977fbddc5307
- SSDEEP 3072:7AfZQe/c4XLlZXNft8F9/CGzoRkEBqW2RlMAeqSxHxOqlbOehiOwYOyHp4q3U9rM:sfZ4SLy/PEBqW21PZOdVnCr
- TLSH
  T170347D4B76A5597CD14AD038930BD67BBA72B88A4230FDBF12F496302E16F511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  libEGL.dll
- Size 1.4MB
- SHA256 74df4d73ae2e06d23d48e6b483214743e0dbc521fb190e96f278ecdd45938ed2
- MD5 ca05c7fd09191ff23c2c1583a0b21258
- SHA1 c912f64c29404c1b7b8b188fba163ff01fb5509f
- SHA512 4ed829d5adae7f4197cde3b2c46098c4f45796f4d88b641431217d00cd82d61f07515b74750e2292ea4fc70c1298171a65e52529dba892d8aa587f1949e012ad
- SSDEEP 24576:OX5ei5ZpA9ZPCh1LIZ5VtURYfC58dGm2VIH06iy9FMmx:c5eSZmPCnUZ5VMseIU6isLx
- TLSH
  T18D658E43E6A181B8C05DE078D3579A3BFA71BC8DC93476BB1BE08B212E15F90971DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  libGLESv2.dll
- Size 1.6MB
- SHA256 212ffc04072e2ef3ec7a97f347286522ddf0e89f4384b10e8b124d818177ccb2
- MD5 eb1c94c3fa2d18ef1ca9eb49ab11f712
- SHA1 d1076f85ba4c54b9e93bbb464d3aec8249033062
- SHA512 ad0bfa5f3cdff38db5a4f3f39e399b14f5fd814857b6e19a9bf48eb513b193d29da24546bbf717385908b6bf01dfb375b4ce2df0fd73f693a0ae0c1f855ee248
- SSDEEP 24576:RkEJz5XO3XcAp6THoXfOGs+fT+PaiYgXYdGmoVIH06iy9FMI/:2I5+8Ap8qfOGs+lgYAIU6isX
- TLSH
  T121758E07E6A580F8C099E0B893579A3FFB717C8EC934766B17E08B112E65F90970DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  mozavcodec.dll
- Size 287KB
- SHA256 723d0104e7bcf2280e8367b1c487788756be62797f8593374a2697a49b93804b
- MD5 619a9f3384e25be230ad918b9533e015
- SHA1 c805c1257793ab36e15dac663d9a8c26e4af8da4
- SHA512 20d83e7ab78cf8e9ee324a0f0d020b304b70695ed26bc784288ee3368e7715d582620d07e6e05f15ff150a61971bf36521ed6bfe147554daf0f2fb1d1fdf0058
- SSDEEP 3072:q7yDF96npzgJoUwFDB8ddpvUdakHSGzoRZXzqhTRE+i/0xHxOqlbOehqdSGtmeOh:+yDF9GlDYsHeXzqhT6/jdSSO9mrmcFa
- TLSH
  T14B549E47B6A150BCD146D078931F957BBA32B88A4631BDBF13E4AA303E26F516F1CB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  mozavutil.dll
- Size 231KB
- SHA256 88986a9d6bd2ba03aff27229ef8b5f6fffa48cd3631e7c9707e0579cfab50b55
- MD5 3d351c37cc1582e7c4a10acbc4fd38ca
- SHA1 e8060ec3c11bba5872b5cc1c3af3011cbbee16e1
- SHA512 8f5359355f413ad04df64856cb98ef33f5c23b1926f308dd3d0a4306f991693d8488b8318ec69c0b9df1cec72b5134659d7d5667a9a244934b03fcc974b94e17
- SSDEEP 3072:rEFog/CBTvJ8Cbn5EuBUSGzoRweRq4FPUZR1xHxOqlbOehvmAeKQ2Kt:rEF4GKfBUHeRq4FWRVm
- TLSH
  T141347C4B72A559FCD146D038930B967BA772B88A0231FDBF12E49A302F57E511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  mozglue.dll
- Size 558KB
- SHA256 5aa834962a21a5cee5fb9ce6895cc5050f8c26b3e4ed3501e5746b1b41877a6b
- MD5 3c1f1a2b6147667417fc28ea02647945
- SHA1 9f42544b213fdb9d3b4eeeebe8467a2fb3885db9
- SHA512 ff4904a135ebdf7d976201cf9c26bf92286fbc09a4e1765363ba34316a4c9d2f85681d0b63aef9f7c1141a06b413cd15cdf4a2438f05e6f679d7c929209a7f0f
- SSDEEP 12288:6BY7ZkCf1KPrE4HX2/tdl3rhYnCYGBVFizv0oV:GBCf1KP/GdWnCY4VFizv0
- TLSH
  T1D6C45C07F2A290B8D05AD0788357A67BFB32B88AC531B9BF27D46B313E55B506B0D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10
- Suspicious use of NtCreateUserProcessOtherParentProcess
behavioral19 behavioral20
- Target
  mozinference.dll
- Size 244KB
- SHA256 bfc8f703123bf506f0cd739216d61a4479f43d561a4c4b9e428a43d6541fb863
- MD5 b87e67a05d59ee24c083b44fbb0ad63a
- SHA1 d7fe1421ec24aa672b0d198994b2cb72a8bc3481
- SHA512 259ffe0d0e5ee5473f08a6d01f7d66aae110caf8b0d35e3b03cacd2af4769f74a33f8bcef03fd18fe0c0e1d44bebb0366affb944c2332c644cfb1971c992a0a5
- SSDEEP 3072:OdrHBsSgTdHoPNa9O9Luo8SGzoRi7Fq9m2KGvzWxHxOqlbOehD+wEbsTyz6XhU:OdrH9qoi86o8x7Fq9mSzE+kTc
- TLSH
  T161348D4BB2A554BCE145D038931BE67BF772B88A4631BDBF12E096302F16E512F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  mozwer.dll
- Size 229KB
- SHA256 fea0643a707b21e14bdc45362c7f1932ced1e9779c7a7aed48b5f5ec61f685c1
- MD5 395780b63348fc28b528f73de4169083
- SHA1 013b3d2b1aa1892c6ebdcd8ff2a4720812ecd777
- SHA512 f21f393cd7addffc25b7485eebbdb44543e3a8fd52ade2c5b77e752268e2acf1848c5fef75341118a51b885a294f8cc712715fde5249dddce895bac37371f5c3
- SSDEEP 3072:IpQwP7aBkgS6FS7ltvKBCGzoR05pqj2t2ku75xHxOqlbOehB8w3GpMNycLgzLvx:yQw1gSiBz5pqj2XWP8DIi
- TLSH
  T12E347D4B76A558BCD106D038D31BD5BBBA72B88A4321FDBF12E496303E26E511F1CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  notificationserver.dll
- Size 242KB
- SHA256 31004f608531494fef4bb9bc63cf96168ec1216bfed57bdcd212fc4bfcdff46c
- MD5 af228ef136934a64b0d2d143ffdd668e
- SHA1 806fc625c7df4404c4936f0947533a0a0de96a47
- SHA512 78298f015fbeb7c000b28ba4181c474a0d648933129f6e950e1de34b3b7cb59b97573310102ff57666d2587e58239da32ce0c6de6fa50a12b408383dd162bc2c
- SSDEEP 3072:xHzICPEgR5YCk6kWIgoVeFTtkeSXpCGzoRTH8qiULrwVsxHxOqlbOehc2PH+fNJL:xTpPE36mgexpkH8qiUAV92/qNJ
- TLSH
  T1C1348D0776A154BCE116D038931BD57BBB76B88A5230BDBF12F4D6302E16E512F2CB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  nss3.dll
- Size 233KB
- SHA256 d0475ef220a9c393035661efb09feca0a6c72664821e6b58533cc8b8aca7561d
- MD5 74d4db8409a6ad5dbbc8ad21bb1a5bbf
- SHA1 c0e74c8c8e95aa970a4df6405ef50e6f221c8030
- SHA512 100f056554d9847ef1b3198771e77b6c5a076db5e925e520218b050a4efec76f786d4bbf843ec5c441baa8ae36f14304c114960d586d2793efac6c7dd13711e9
- SSDEEP 3072:HpkRJUMNuytDhnvHdKT+tveHCGzoRgCTqP2h5wP63dxHxOqlbOeh0vw/K26bTh4U:JkRnNThfKHnCTqP2wWmv7
- TLSH
  T18C349E4B72A559BCE106D038935BD57BB732B88A4230FDBF12E496342E1BE511F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  plugin-container.exe
- Size 141KB
- SHA256 653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
- MD5 6935302137f3152317eb6a3b4a74f8c5
- SHA1 494e7a194ab5e7c6934c0154f6a2e48a001d199b
- SHA512 b2c987911aba4f77df7844a6612034fd8516ab7671527c918be013179a61c28082a9ecac69625c66e5a7611535dc180f3792302ce75760d4a3d2610dce1da138
- SSDEEP 3072:Xkxq4w6505dcKCB7xjLrWqQo6SY5bBL/zp2Z2x7tg:Xg9wzXCB7xjXWQ6SYhNLpy2lS
- TLSH
  T1FDE35A13FA5950FAD549C974DA824612DFB2B8860B30A7DF23944DA12FA5BE4BF3D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10
- Suspicious use of NtCreateUserProcessOtherParentProcess
behavioral31
- Target
  softokn3.dll
- Size 238KB
- SHA256 5472a0a2055806678f943ceece992dab252bb12891736acaa4698c039fff4b2d
- MD5 200814405a662ef26d30ed3da89b0411
- SHA1 b37a346b769f3b9cde48a2ab4b21f45aab9fb400
- SHA512 c669e502279614b06968741cbf35de089275bcd056ae07ff55db6c6e5c548b4594c2318fc722ac6980aa08d0be3c52c009eac5904d33f12faa7e2a7ce8cd4a59
- SSDEEP 3072:0u3XUjrj42R0RXF7um/tYqIMCGzoRcitbqN2+6q78vxHxOqlbOehhVwf8vZqVANP:PXUvRa0jM/itbqN2OYRVD0
- TLSH
  T164349D0772A558BCE506C038935B957BB772B88B4630FDBF16E49A302F16E512F2CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtCreateUserProcessOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32