cf9b8b7e8aa2d49af451cdc55ccd4fc63a7c49ea553d6f65b7130768da8a1a54

Sharing

Copy URL Twitter E-mail

General

Target
OblivionPath Setup 3.8.3245.exe
Size 132.1MB
Sample260711-jr73baes2m
SHA256 cf9b8b7e8aa2d49af451cdc55ccd4fc63a7c49ea553d6f65b7130768da8a1a54
MD5 fd604adc1d9db7288894a33e86770300
SHA1 b3a17e714521908505fcea8bc9bbe9513f0177c9
SHA512 65a7ef12ff2fe1de106e9184057af011d406afb65e7853ebf4f43cf0e2f95612b1597d8577015d8b3c609733488c8fa55069758e29f94d249848e4ded65d6b9d
SSDEEP 3145728:UlylAchgnNiTz6tlCVekFbKigXTe3NnZvPAYGKpVNP:Xk6utk4+b0T2mYtp/P
TLSH
T1BD683325B2D6C6E4E420F1309374AFA0B7D967CFBA0537CA45A8201F7FB214D6906E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  OblivionPath Setup 3.8.3245.exe
- Size 132.1MB
- SHA256 cf9b8b7e8aa2d49af451cdc55ccd4fc63a7c49ea553d6f65b7130768da8a1a54
- MD5 fd604adc1d9db7288894a33e86770300
- SHA1 b3a17e714521908505fcea8bc9bbe9513f0177c9
- SHA512 65a7ef12ff2fe1de106e9184057af011d406afb65e7853ebf4f43cf0e2f95612b1597d8577015d8b3c609733488c8fa55069758e29f94d249848e4ded65d6b9d
- SSDEEP 3145728:UlylAchgnNiTz6tlCVekFbKigXTe3NnZvPAYGKpVNP:Xk6utk4+b0T2mYtp/P
- TLSH
  T1BD683325B2D6C6E4E420F1309374AFA0B7D967CFBA0537CA45A8201F7FB214D6906E6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  resources/java/jre/bin/management.dll
- Size 29KB
- SHA256 03d51451386a6c286a76a4dca238f2e7a47c533472ca0a791265bfcafed8331a
- MD5 d184967a1cc178b7ea81fe255fa2d610
- SHA1 d18640ff9321cc4b4c9088267bc70246851b4012
- SHA512 ed24da6b82d7d34b443b23991ba6e0fa841774c4c119e2e59f6b932d1fc8e833e9e201a7557fa268b020778ad326b1a5350e6b1ed446392bed01f9a635708f1c
- SSDEEP 384:HJPQgjLZjeZfsz2Vjc0hcEWsuOUUNyEIYi2mL4/y8RFvIIvZIasX:pP1ZEKScEWUYYiDLk5kIv7
- TLSH
  T1D4D24A12A65C6445E1DFB57570A006369BB3B5C21FC1938706B4C23D4BBBFE23A7817A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  resources/java/jre/bin/management_ext.dll
- Size 35KB
- SHA256 43bc3a629fc0e383c072ec79a0eb24dfaa3fca32327c81ecae7786a61e343d0a
- MD5 f28cd8799e3c7ebeb7f0ad96b407e319
- SHA1 c46cc68d66f1663abc2d5f146c66b8a456b05e7e
- SHA512 99654cfad4bad56a6edfd2bbddfdbe9e7c2524455faf6c8fdffb6410858cd81017a7634dff3b2cb38663356dbe40bad4a135770258115494c50e88c670091839
- SSDEEP 768:PCdJfDYjyjsZrWqQcz0Mr5VvEQEYiDLk5kIv:e9DYWmWQztrfcQE7VIv
- TLSH
  T1F7F27D6B92984483F84BD57450A01A23D6B3786222E2D3CF57A0C62F1FA37537B2D75E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  resources/java/jre/bin/mlib_image.dll
- Size 509KB
- SHA256 f5ea88cfff3ebc5436a515fe90f72ed1c0f010f5aad80830ecf94e6d9cd0e61c
- MD5 81b02b90264449b78496fe4647e2c3a3
- SHA1 531737afc98d806bf2b3c3a8b83e4e508b4fe1cc
- SHA512 4c0b21dfaab7225f8368d7ab53abe87187e37af28841e0c46523600aae62c2903d33896c5a0088062da10218bfeb5d1f9d56937e71c9795713f573cfd448d6d8
- SSDEEP 12288:mDAlGD08UowoIikrYzXDh0iRteccD8d7nGgwL7hkxW:mDAlGD0qwoFc+XDh0iRoxD8d7nGgwHhp
- TLSH
  T1ACB47C43F5EA17CCC06AF43146BD7297F961341906145A239BA3CE687B26F11AEFB306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  resources/java/jre/bin/msvcp140.dll
- Size 561KB
- SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
- MD5 72f3d84384e888bf0d38852eb863026b
- SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
- SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
- SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
- TLSH
  T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  resources/java/jre/bin/net.dll
- Size 58KB
- SHA256 5024678aeec581fe91498da4613495b3abcc006359ea135d2e42a4106d3bceea
- MD5 d47b9fa26d0f6a8a37c6c5b8b5e24ce0
- SHA1 d3156c4df0987bf45204a12fbd2e1e4797c7b21c
- SHA512 0d4f5fb8b1f12c0f08464197378f3d8051ae7e8f3511ba2bde9eaac36550d9053d22e417889e9d00a8f17e6c864caf23c2430ded20a914007d725dc118d2012c
- SSDEEP 1536:hrBn2zLBxyvTtPnhv5awOYwT2eGIUmXHvJ7VIvD:fnUevxl5arpfGIUmXvJ+v
- TLSH
  T1FB436C0597E454C0E86BC67886A75E16DBB2B470321083DF1379C56EAFE73B23B29780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  resources/java/jre/bin/nio.dll
- Size 78KB
- SHA256 addafe684203d39c4436aa80fe72d7ceae4d9c197e3579c3b4afd66e2b14bc09
- MD5 95e499fd2df25ca82cf05edf5257cf73
- SHA1 546561cc68857f5e09a3e3b6111edfaaa4e2328d
- SHA512 5fef7b2cdb0c84f6522d5b492793cce3a2b6c44b206f2ff53b0ddceb55e0e49ccf9b763ce4b0992af7d2375934c34c23308695a917eef8d453f58e0519a9203b
- SSDEEP 1536:vuKDrKVqEiWtCnNXHlJ4Ozuwc0EPaRHpiys6np7VIvE:vuKDuVqaMN3lJhXmSRHpi1qp+vE
- TLSH
  T1607329A643A4849FE86AB138825A4747E373FC114510A35F5368CB659F5F2B33E3E782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  resources/java/jre/bin/prefs.dll
- Size 25KB
- SHA256 9c9eb1c256795bd5195f9e6562a1d8bc8b70ec2f9254d1be6c99308946656ab2
- MD5 ac9c7be7ba58dfaf9a8f0c636b87d137
- SHA1 a5f7fc67d91c371e18f394cdc939e986ba6a1726
- SHA512 2cddcf8f757c42f40f286aa74f56889bc0a037b702f6b5be6aa44182612c335513da6f074477158a46c49713ed81736061af971404e74a2049066ae3b042ae24
- SSDEEP 384:FRl5PEBA0l5W+ClYJ9YJ1lcS3L+NyEIYi2mL4/y8RFvIIvZ91j:PnPEBLl5omPYJsS3LzYiDLk5kIv
- TLSH
  T1E7C27D57C6A40886E977493098F64F1BE9B7B95517A193CF0360C01D1FA37C23A6CBEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/java/jre/bin/rmi.dll
- Size 20KB
- SHA256 b338aaf077f0202faef92a7b053be9c1b7ecd0fdb80f46401dcbd561f579572a
- MD5 b4040c31f94266c95023ab504a4209e8
- SHA1 d7bdc860a5e1df7ca39fbdd4c7194aba0b24f4a2
- SHA512 b42830b0f00c2208ee343d3cd8edabcc75ba38024dcc35a3a6499c3dc67ca4198bb29b6da16339236e182756fae630315375336c3812707ba9c5fc2250b5dd98
- SSDEEP 384:w/jEBS7dz/NyEIYi2mL4/y8RFvIIvZTXL:gEB890YiDLk5kIvt
- TLSH
  T10B928E57D9900C48ED578A30E1E55B1BF9B6B7511BA193CB3324C02A0F923837BA87ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/java/jre/bin/rmiregistry.exe
- Size 24KB
- SHA256 79e597d6cfa30e1d8ddf95bbd072704de2ca6fff42f3a7f8f546fc335f87ca3c
- MD5 ba78d81ca0085fce5285b48adfea7d5e
- SHA1 f29040c5c1647f7a53ba13b50705e14af19ebaab
- SHA512 e6d9d2c1ea64abffa9975131528d57663e9bc635f9c24a7bc5d31ad61bc5f013c3e55c3ee7e175c8c2391056c32917ff47a3392832ee3af0ff1360cc0df77fd8
- SSDEEP 384:b47wdxCCyFqr5APNyEIYi2mL4/y8RFvIIvZ6n7N:b480Fqr5nYiDLk5kIvix
- TLSH
  T1DBB28E17CF844C86EE5B86B0A4E5622BF9B2B6956ED1C3CB6364C4290F413813F992DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/java/jre/bin/server/jvm.dll
- Size 13.3MB
- SHA256 8dc3b8569cef73567252b37fd49627f86e12deaab9a605fa3701c32c237d3d18
- MD5 57c7e521106bb4d8a5261a152f66bb7f
- SHA1 69b6f72c9478a9cbdc597fc2891e7cd53d063271
- SHA512 b1613019e683ab20b69a6fc70802a8259a5d78a594f48f6e85d320097c24a2e9cb428ae573c7986a85e0725a9023b93c64d3fdbf2d39a3e16f6fb11446954068
- SSDEEP 393216:rWPzNUDoum7j+9OA8BlKDOh7ym4pRDadvpTULWnme16aDViclJG7hQlX+CTNrYGe:Z
- TLSH
  T1B2E66C1B67784095C02BC1798AAB9D0FC7F2B8944731A7CB61A016AD7F63FE1593E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/java/jre/bin/splashscreen.dll
- Size 213KB
- SHA256 48c38d25dcfbc4d7a58273d94df7f92cd516b8697bbe5d492f6203c6e2d235eb
- MD5 ceb82a5a81678cc417d61b00865a6626
- SHA1 a7b440473b0be7fe258f7e368ba56e77b22d86f3
- SHA512 23895fd1e8cce8bb6aba7dd8c21304b1241f5870cd224c8b2b135257db860170376a8306337303e7193ae196af5c27b2d834816420e81307fec42e7dab4ff8f7
- SSDEEP 6144:efiXpobw8iltQpUKLKQ7h05/xG8Pptfr:CcKzAxGU
- TLSH
  T110249D46B67018B5ECFB8178C6EB811ED7B2706A1790C78F579483666F27B203B0D3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  resources/java/jre/bin/syslookup.dll
- Size 28KB
- SHA256 9c6ce8c66daa3d4987dec55a05ec2331df0990e5664cc97ead3d9f5011294364
- MD5 81ae81715fe39da835c25084930d14d1
- SHA1 796ae217e7ebfa6fb262bf8117f02ab9069798a9
- SHA512 9a1de9330f85e30b4d679c868518e56a3845817af7041bca1e0e5f92433829a95af6766bd358a32a0b2649fed16b9f7c0ad0b3e13843fea00094e42feea34067
- SSDEEP 384:98ABInf0o4nPoMy7U8CATB+NyEIYi2mL4/y8RFvIIvZqST0eG:9DWso4nAMcNTBYiDLk5kIvRT
- TLSH
  T1A4D209C7AD8424C4D87FC074A497252EE9B2B1EA039097CB77A6881D0B503F57B7CBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/java/jre/bin/ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH
  T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/java/jre/bin/vcruntime140.dll
- Size 117KB
- SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
- MD5 caf9edded91c1f6c0022b278c16679aa
- SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
- SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
- SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
- TLSH
  T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/java/jre/bin/vcruntime140_1.dll
- Size 48KB
- SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
- MD5 2bd576cbc5cb712935eb1b10e4d312f5
- SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
- SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
- SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
- TLSH
  T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/java/jre/bin/verify.dll
- Size 53KB
- SHA256 a68ff08c4366f7357c3f88805e12d741d07afe4ad6974c10e811adbe875795aa
- MD5 891e92779dde89241a182ef436327fd2
- SHA1 dae13f57e7a8b4315dd8481d1aa86de14e740317
- SHA512 ab4316e20cf078261a6949c3836cbd3fa2ef91b5f1bce8439db167c5c902b0394d8bf241a4c0dd54d5dfdb8f326931f33bd570929a471e64a11a4d823c96d3be
- SSDEEP 768:qHCLyeM3rBXI38xzmjNSbYpviCCu+pXr5KZ6We2XtPe2D18jYiDLk5kIv:qCU7O38d3bIRCu+Z5QDXJe2B8j7VIv
- TLSH
  T126335A5792640476E483C634C663AEEBDBF1F4451B0083CB525087DD7F97BA0AB246AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/java/jre/bin/zip.dll
- Size 87KB
- SHA256 684484a561eb95244b51b33c64cd3da8c8b631e62c16c19f4ad65fa859860181
- MD5 b2115eca5d4eebb5e2a9c2b39bdbd7dd
- SHA1 5b01d27c10ffdf3de05b2bb85ed2f1a302a8db20
- SHA512 47fcd3e62867cafb9790239c21e8657c27b2f6d0ba301d1b3b110ea8783431e0180bd4fc3cfb311d9a3579d5766b2060d4acc3a7432ddaa035f62d5fa84b250d
- SSDEEP 1536:UK3PfYq1vEEnjnqCRHH3ATfKWVIOQIOhWB9P7VIvj:UK3PfYqBEEjnqCOfdGhWB9P+v
- TLSH
  T1CF939D9589A04291DAFB91B0C9F64A3EC3BAB0511790578B635C879A2F537613F0C3FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  resources/java/jre/lib/jrt-fs.jar
- Size 107KB
- SHA256 c182853a89adbb6dbeb78c3b19a189883a9b05ea142dd716bf97677322c71696
- MD5 5173a3814c0adf7d9009af7db4c0b9ee
- SHA1 89987dd52c0e8c21be9783245ace6ce5949fe961
- SHA512 5a8982a6840153e42be7a0f72ef82f926f9a8785ee314d7bf2df6dc5b5f3fdd51f757b99584d28e2dfa8cae21e850c53886e896d9c2a4e56580f20cdac9b3f92
- SSDEEP 3072:cp8AmRYqIlNEtUnwTfbRH6uAOHUhB23bTjRp:I6YN0tUqc4Uy3bXRp
- TLSH
  T15CB3E037BED2C961F0239670D0C5D22F383514E691EEC51B85B4844A8AF3FE54B69BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 7d2774eab7cf7daea6e112092a45862a651689e863fa8c22dbf55c777718d70b
- MD5 5d9289f1519938eb0d3b1d49c54c84df
- SHA1 ced8c87eea5c829bd7f30bd6d7f1e2cd426a38f7
- SHA512 02526c9e5e7ccf8d5fadd25c1c3a3c06e38a27d88de1cb006beaea38cf4211aad2333e0cb2ae209f74d210ac04c71e364cade4c5fefa8e262ea62db88bfe54a1
- SSDEEP 49152:E6BvHeYF2zy7vim+3KbXSUbiAqpaIv0Kow1Cjbh6hgl+1P2FFCbmbjn6u9UdczQg:/mYF2zkjpcDMZUdAQs
- TLSH
  T1A6463903B2858099F05DD1B9474BA623F232F8801B76B6DF52A41F192E77FE06B39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  vulkan-1.dll
- Size 938KB
- SHA256 9772ec778911124af85619663f6a78eb0596860a6c27e3e03e9eb0a31cea1cf8
- MD5 6610fee2c6b693a8c360440d0a4d9948
- SHA1 de8d3dc3782e04780ba2456a5215f951aa9d03fd
- SHA512 6b4862681a32c2c89a5653b3aa96ef23e1c5220d459ede855059487cc36fa7ebe6b2dbd0290292305ff259b9f3305aab583cdf87aa67abbcc11ed3d7f7d79dfa
- SSDEEP 24576:RawxZ1onv5SpQN9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:cSSApM90IDWb36Z5W1DYsHq6g3P0zAkw
- TLSH
  T18E155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $R0/Uninstall OblivionPath.exe
- Size 136KB
- SHA256 d32f8d800b68a9f9dfeda1fa29e6112565ef3a7d15ad8bb3098b58df8affbf79
- MD5 e068079e7276c64df9f566aa28fc3088
- SHA1 f7defc308c9db28064b0a0524daa358e758707ab
- SHA512 1ecfce82b9b43da660335917aacffbbcdfb36ed703357885c580e7bae1c59700324618ce28983c38221c1e086423ee28543aab6f4011f2a4e09d77ead6ea484e
- SSDEEP 3072:on77v00hEoDEtauQceARzdr/GaH2tvhOEA1RJCir86SrSrv6Ia34:o740IAmRpTGs2t0EyL+yaI
- TLSH
  T115D3E0017790C827DAFB0F714AB693AB1EB5F92128284F1377C02B5F78A6691ED1D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral28
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads local data of messenger clients

Reads user/profile data of web browsers

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32