186b53d086164dd402faf112d1148e4f7512b0e477341a9ef4645393c11395bd

Sharing

Copy URL Twitter E-mail

General

Target
MAYEL1313.zip
Size 19.4MB
Sample260710-pdqtrscw8w
SHA256 186b53d086164dd402faf112d1148e4f7512b0e477341a9ef4645393c11395bd
MD5 978d8de0a587d383fd60a1b04f3d3580
SHA1 9a9ba204bdb28a27092bf91b978c4b1d67491ea1
SHA512 111840e0d14369baf0bed468e727489b7af41888d0aad0323329ff48c568c323300de888c0ae11bf94edf2d46fad1d5b8a959132a4d20e907927a8b99c7b2cbb
SSDEEP 393216:hXgmgnsu+BLxUiPfyId9Ut7YtHCbFmYbfqS/gYQhs9T/xUn0dV0JgwLVs:RgmgsZLxUi5dStkhCBmYbfOYqs9T/xGM
TLSH
T136273342C366BCC6C696233824FCD91F981FAB95662B5E4F8F6D20F55C839D28B0631D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  python313/Crypto/Cipher/AES.py
- Size 9KB
- SHA256 24af7918b87ca1c3025348200ade01b17a2c8310237ac25d097d266cff577fd6
- MD5 97c2e30fe71322ff34b0bacf7b115dd4
- SHA1 e6558a8f6aff6c330ba40f7047a83061f5892f21
- SHA512 5929dbb9aefe62d76b760fcd10bae27401472d1ab063a0efa65d6ff7f37cc5c01660ab0551a6df52d015659163ccd4adfc4af591330bff3b9c63a46b338055b2
- SSDEEP 192:dmQHvdBTzgeSDztF9+hMkRI4H1Fit/zyc/Ki/yRAL:sedBTYt4Ot/L/K7AL
- TLSH
  T1C212B7339EC3ADD175B140822D75E019E326219F2D962B0235BDD45C6F76F30E3A918E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  python313/Crypto/Cipher/ARC2.py
- Size 7KB
- SHA256 cf808c3951f83d9e86799e02a564661d6c372216656dc5d40fd9e19b21d84a53
- MD5 274e46a9ae6d3e092b48a7d1ab3f0d6d
- SHA1 fb5a62548fb3876ff73319d3c92565b64cea3e69
- SHA512 d9850d167368ae4b901512d5b3111ef6858e643fcd4dca7ee2a263adbb621d3d9729d124a9a9570eb250d63034734663b16770acc5b2d4f1ceefb3e47eacd8b3
- SSDEEP 192:dHQHv8gflA2jSkmRFmynD/t4AKdRYotKI:te8g9A82jnD/t4hjYotKI
- TLSH
  T1F2E1A567598399D2257040622E79E04DE722916F3DA28B8135FD941C6FBBF30E37628E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  python313/Crypto/Cipher/ARC4.py
- Size 5KB
- SHA256 717b865cc7a4417aeaf0efa70b60ef7c42cbfdae4433bd704eab9ddf75c50486
- MD5 0ef036a0343812f8bd2cd7cc80b2ba95
- SHA1 b443e26a222338477a44bf29fd5aca2942271b86
- SHA512 aa5e7f0bf9c5199b5e76441decb0cc5a0899edbe7517f6a6646d14205e727fcf35ea935a921ec90502b7783d28cdcc5bf648f8fa2a06ffdefe302171332c6d3f
- SSDEEP 48:dHIB0jcQHMsvI/S3oCFG+PdiIPskHzgirvO/ZEgR2lYvHipJjHeLEyEMWnP7a7jv:doFQHvo7dIUoeGgR2uvi/jqEyExPNOuG
- TLSH
  T13EB1C887BD97D9C237718086297DE84ED78552072529671234ACE0586FF0731F2FD688
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  python313/Crypto/Cipher/Blowfish.py
- Size 5KB
- SHA256 9e71714f41ad4fc6499b83ff0199d1ff75d73d551a740cffdc077d13ad930edf
- MD5 c34b138e93044278085c0172b171945a
- SHA1 058cca453b61ad12f6007a84e1626371ea2e5855
- SHA512 39ca5d7161933f6ab86d14877e8e089d3bd11561494079b99c7b56209b074fae50d31a8ba25760c3309e36bbb216a818ed49084e9479f0b47fefc4f55bf2ec51
- SSDEEP 96:doFQHvofgiwZAEuVDYsgiiJsJWkGI9gmJt4qeA//RFWotKj:deQHvogySniiSYkGIOmJt4A/RYotKj
- TLSH
  T146C1B5635D83DCC2257050762D7CE049E722A16F3DE29A4136BED05C6FB1F31E27A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  python313/Crypto/Cipher/CAST.py
- Size 6KB
- SHA256 2e59e547baf132e8553fc76e9ae2151b48c0610483e54130b0b6262a03f95903
- MD5 1166b892369e19b4220bbc069d9ccabc
- SHA1 f8fffefad392a8d7f79cd644b4d21d771d7458ef
- SHA512 b99aa9b0f448b24bcf56deb0bb30b948c1fbae91692a78a291ae30a1935e4c74204a24925573e3e60777b5033cf748fd7c0d4bee3e79bcf3d8d5fbbb19e195ce
- SSDEEP 192:d2QHvVgdaKSnrF4xkOUBRkUtmz5t4AyRYotKw:UeVgd8n549aW75t4rYotKw
- TLSH
  T1FFD1A5625D93DCC326B050A23D78E05DE722A16F2DE25E4135BDE01C6F75F30E2BA289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  python313/Crypto/Cipher/ChaCha20.py
- Size 10KB
- SHA256 ddf406689b55741bc914e9acd426f4a42918f37983367711f5bb4e148a282934
- MD5 bcef8a2f679f6c77e073e576e7313f90
- SHA1 e01f20ee9bfbe1a4770c092d54d3506a1a1db69f
- SHA512 d23bec4867b33a58289faf97add75b054acfef0056019b8e653333da469903f7aa365043d02b9bf82771fbda9e1f83973be3f83af2e513a70d3afef221fb59c2
- SSDEEP 192:9qrskrs9t3q/IcwYjUlRGziNzvPppkzBjfgEQ3UjwzgLMZKPOYbCCtrBUpt:0rskrs9VqxwDlCihP8xfgPF6PPOqBUt
- TLSH
  T13232C7938E52CCD253B3850A6C3AE90AE71962272E445F033CBDD8147FF677595AC8E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  python313/Crypto/Cipher/ChaCha20_Poly1305.py
- Size 11KB
- SHA256 51a6580a63c4487bcd0df401999a5c4497416cf251e2e935c950dc2a59422271
- MD5 fb82fba68f1745f08771ca59a1a1db89
- SHA1 2d84988aa839ab296667a08e947146aa08f34d31
- SHA512 34ef9dee60458fd7ff62a92e1fde86a08d3b92cf0f84daff849d9288f49bd1a1df032c52be188b8eab7b1e1bdcbc5257ef8ac42396e7d64ffffdedacad61f2aa
- SSDEEP 192:0qrskrs9t3q/IIJOqi/JHxbkg9XRV8psd6agIbjKVFtt:zrskrs9VqVi/j7XRViWPKVHt
- TLSH
  T10B3297A5EE47DDA34277C48AAE68E50AEF4750132A180B137C7C94541FB0B74E2F8DE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  python313/Crypto/Cipher/DES.py
- Size 5KB
- SHA256 bae52d7a7d2cd509d466156dc2878d7e4194bb304a8cb555f353ec00108c9186
- MD5 1b182d8cd016edc5f53015a433be05d5
- SHA1 531c8db19cda7edee5b45b83d0c309f4ea65c1d5
- SHA512 3d08af59aa18156e5086e061bbddd3e7e321a5eb98b1efe4cce56d7ca668cdfd167ecef8f42a66fb6450797f21a6a21841fe24a606b0f1f959375ca6f4279227
- SSDEEP 96:dOFQHvotgiwHCXjG6DH5K0kmIbU6Ct4qeAYZRFWotK0:dcQHv2gUqC5K0kmIct4NZRYotK0
- TLSH
  T1CCC1B6666DC3D9D325B440623E78E059E722A12F3DE25E5135BDD01C6FB2F30E27A189
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  python313/Crypto/Cipher/DES3.py
- Size 6KB
- SHA256 70d9b525599d85146924ef8dbdf0980c42a03f4fbb2d01a2cadbf7ed2d43cd93
- MD5 44204a7cbbf99e82eb31b7f746b43ab3
- SHA1 4589336cf1a1d1e74daaa10e87c898dd804db7f8
- SHA512 1d0403f3bcdf6ae8a7a7d2fe339112b7be604ea1d103388547760ff73cbbc7df5106cf6d702a6134cc4c51a836feb3ed42ac0bfde90a46e67f684ecca3ddf4f6
- SSDEEP 192:dKQHvCgthz1GPoiRxwKIUK9t4A1zRYotKa:YeCgHAhRn9K9t42NYotKa
- TLSH
  T1F5E1A5636EC7EDD3257440A22D68E059E722E12F3DE15A5135ADD01CAF71B32E3B618C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  python313/Crypto/Cipher/PKCS1_OAEP.py
- Size 8KB
- SHA256 d924170c92be9e1324dedc5b731f92513cdf759a251148df8ecf1a0e6011d77c
- MD5 1451b65f3e7ec1b91c1d496eaaa705d0
- SHA1 d695cb12cee4e321748ca8e4debbc82945628769
- SHA512 5d002279e789e867e643f97b91c65c45da561171d0cfcf6ec3a3cbb35bbd3b44923ec5249d89e788d637cf8f7d9617808c2cee806775e49fb5e9d14b3b6a1bed
- SSDEEP 96:dEFQHvo7wHQeYz8L34mghqko9uN8I3y5xU3a5tLfZCMKesDBkFBIMd3T20kqk9ku:d6QHv13GFA4IywxoXKUF9ku
- TLSH
  T17C02B79A8D07DD9E52F38806AD76E10BDB23418B76E9571A30DCDA444F7833C51E2ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  python313/Crypto/Cipher/PKCS1_v1_5.py
- Size 7KB
- SHA256 8bbd80adf2035ded54365eb2076468d32e6bf9a5007c19557afeae19932a685f
- MD5 33552ee7c36c1e8b6ac76aaa51b18ea2
- SHA1 4b0476c73efca6264d64deed3b2ec21f67b2fd82
- SHA512 6afe6599b48464ce0aeb8f29225a85efe722c558e9f1f8ee30fd2efb201fcc663f8e42355452d19ae905fddb6a13c30e4fdbc57d17f94bdc118ebaac90538a47
- SSDEEP 96:dtFQHvov1zDH7zA3ZutH8MKD8LzmodYavD+U8FbPNapwDQVs3a:drQHvp42ME8H/d8RNuwk6a
- TLSH
  T1CEE1B4479D87CED912F24456EDB2F10AFB06A24B3A68271738ACD5484F74328D1A5ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  python313/Crypto/Cipher/Salsa20.py
- Size 6KB
- SHA256 80a7769de32a81b8fb8cbe362066ff80711d630c0beb39235246e4fd53e11870
- MD5 35b1a807346df9fad49a2396e0e7c64e
- SHA1 9a46cf85539233672c3ed0d06e4f1ee5b53bfb27
- SHA512 df42f3a86a75fa52b2005a493b3e48cbdc0972cd81811c70308cb80d7006ce88fd6e9aa3393d2c687855030ef17a2031f4c8d5371888944fe8f8f2ac439c45c4
- SSDEEP 96:GFQHvo7H4sIR05Jox+lgRXv8NBgQ9Qb3B0NpLPpnhtV8:UQHvMKDRXUNBgHGjRhtV8
- TLSH
  T1E7D196479E76D8E27BB2E81A282DE50AD316B3131C585F22BDBCD4585FB5334A4FC094
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  python313/Crypto/Cipher/_ARC4.pyd
- Size 10KB
- SHA256 f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1
- MD5 eff0f16d6e853ea2cbc7b3bcab5e0591
- SHA1 d9e9947afa2871a4814b9eeedab7209f9f32c9a8
- SHA512 ceaaea7c60c66e4cab3b21d237ae753e94cbef397c3a9bb40c636421dc6b66cf92355d213fd14cd8d55ef06618ae3504ee229a8c6afe866f0e94d7c46ae9bd2f
- SSDEEP 96:ajZuck7BNymq3UtFfZAn401wlKsQ9AfJkSRsP64Cz6+q2c5n1kBRcX6goyOazh:okNNyatvAn40q9WE6R2YORcqgola
- TLSH
  T13222288CFA564CEEEA6540B58A270B4FB075B711575273CF03B0917A0E637C6363A702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  python313/Crypto/Cipher/_EKSBlowfish.py
- Size 5KB
- SHA256 26b7450998b5e04410a77486c695457c58dcbc8db24f50cc685651d223f3be8e
- MD5 a5f07807c63a0a82cfe7f644d72c9f9d
- SHA1 4f44ed26fd9770a9b8ed279c9e75ffeb2c84b756
- SHA512 535fdcfdddf7d64d097b0b51f64ebd14d453895b167e379d105e15f8f9681100b324a02004a3dd059b599ef88c01b81e0ad5546e90f1251ea2172ba5df6d9252
- SSDEEP 96:MHDqrYJALrYJHdt3EHGuITiwnHav1ZaVDYyOKgiaiJrJtk3I99m2Ht3HRF29:0qrskrs9t3q/ITHSVNi1bk3ITm6tXRY9
- TLSH
  T1D2B1B8030D42CBC22776554A3D3EB888E32532273B619A1339BD925C6F37739E55A298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  python313/Crypto/Cipher/_Salsa20.pyd
- Size 13KB
- SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
- MD5 17c99edf022309bc2c54a732fb8fbf26
- SHA1 57a8cbcbf0caed90b8ce9adc8f9188561f4a5e2b
- SHA512 f8dc12948abc33487f136b92efe755b7234ea8ea65b40dbfabe6bdcf8214c1dcf3509d1ecf5f21741e5300456b03983739c9f400ef8352fcac9f3edf90c37f92
- SSDEEP 192:SBeCWznuR5zIzpshfrQ0ZFqdpofnLjcqg542:SBOCMpqVDqUge2
- TLSH
  T159521792F32701EAE42B9175CD734A4BAABCBA00635167DB1320C1178C62BE1323E796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  python313/Crypto/Cipher/__init__.py
- Size 3KB
- SHA256 d473aba5b1d98b834c34bb3b734e2495055bcddb0d5660f058f73cd759db633f
- MD5 fff51e2acf3bcb78be4e068b64bdd0b7
- SHA1 2dd282164ac902387c85d320c9a6ffa58c69286a
- SHA512 c8cffb117ea8bc0bb2bd3c8044ca990b869fb5b990deade8ec0bd93f918266154157313e784fce55d7f891295f9c17c130c3ab82efd278da5dab1f4c805e39eb
- TLSH
  T10271C9019EA4FCD68974FCC91E7CF219C6E52803AE212593B48CE2A9DFB016186F90D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32