885dbd1d79e91c16f9f712597d3e78a5ad55b0a8e83e6b927637a5424da4bc3f

Sharing

Copy URL Twitter E-mail

General

Target
2tQzXLC.zip
Size 119KB
Sample260715-chjvsshv9p
SHA256 885dbd1d79e91c16f9f712597d3e78a5ad55b0a8e83e6b927637a5424da4bc3f
MD5 990386d3fb2bd6f4d22e6988fca0f917
SHA1 f20eed72f8db78b4c0de326d3a34abc2a858fe2d
SHA512 6564a28534137ee126ee503af8cdbe4e98456abedc7a6ab325bc989a7156475758ddf4510e6037fc5d1acb83716b92b0854079ae45d6161dbee0ad64cbe87f49
SSDEEP 3072:n6G4sWyvOibl6LSJSAnFRkZCzTkOZxoAZu8oReBLGVEG:v4YOih6LSFFR4c1rZyeBLGmG
TLSH
T19AC3E16ECF504E70F3F423FE65A75D02D32EA8259915FF6629A35B15ACC30892D1B28C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SpotX-main/.github/Pic/Shields/SpotX_Channel.svg
- Size 2KB
- SHA256 a1f7c5df280814721dce27a68d8c3d9b032e109a0ced0365655d58717167a482
- MD5 d165957c98e25d944c144491c5f7c2a4
- SHA1 c265767368236668088164d4914ed47575828979
- SHA512 10aa72b6a83fc85496723c3e66482b018fd0bee88f82a3b2094e5e79a586ea115687f8bbed948cfc4f17da73aa3e37f489a00e1e1f416463a974112c969fb537
- TLSH
  T1AB4173B2E34C6577C6285A2DE3ACB09E222F36C6C4408255F2943B4ED4B15D31D9938C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1
- Target
  SpotX-main/.github/Pic/Shields/SpotX_Community.svg
- Size 2KB
- SHA256 51c014095797f962abe81304bcb6a645f64fa394a6b17da94728a3697b9d12d2
- MD5 018c9b2454d194418260c5654dfdbb24
- SHA1 dc7cab9a8af509218d333349399e20230345670d
- SHA512 0d38f9c744be644edc894b64d712ffa64a7f85a35834465b7c5742dd1b7a774ad0044afcb767674341a5237fe69c9dfcbf054e4b1985d64de9970eae15861b31
- TLSH
  T104416373938C6577C6285A2DE3AC609E225F77CAC841C149F2983A4ED4715D32C5938D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  SpotX-main/.github/Pic/Shields/SpotX_for_Mac&Linux.svg
- Size 3KB
- SHA256 c2116c0931648bd195b2f43c66d4d8216065fa7708a5f39e287bf2dadaab11cb
- MD5 102b1884743b92d1654606657836dfc1
- SHA1 82572ca14adcb5f275549810d3c184ba89d88fae
- SHA512 7610729050f876397239ade273f01584c1c07436a76b9663cfbfd99da8aa77aa82c9caa9f0f557f3949fe0ccb13ebbd56db654bba40ffb28fdd9a0a268bcfd23
- TLSH
  T1D0812E63520860B9996C2E9FE763668D523EF1D698D7078DBC5C2F08DC2CB663C0A75C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3
- Target
  SpotX-main/.github/Pic/Shields/faq.svg
- Size 1KB
- SHA256 4201854cb9908626f1dec81f8627b1019027095aa7ca97365f4e357e5a1b4664
- MD5 8a6cb2b44a9b6abfe2f0e44c8ac3b5e5
- SHA1 43a554264052228349757711699bc1f397f51547
- SHA512 2e9bea8b793099bb491bfc4afb93712fc5cd6412182148427281f74f6a38b8ec3f5d93bb47801be6dbfeceff9261b458cdcae4e877019323ddb775b8fac13d6c
- TLSH
  T119317564F154312FC728565AF3AC755F234DB6CB91568989F4842F9CB121D6B580C37C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  SpotX-main/Install_New_theme.bat
- Size 600B
- SHA256 a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008
- MD5 99638e3caf39bd8aac3010f291727fcd
- SHA1 f688f9f969ffaf78c62f17f8a8df44490b952514
- SHA512 638bdc5e83558daf1c3d14e1ef3669d578ce3bc0df7c4643441e00d1d334397d409bb1329f07d559f0b7de21cfee406abfde24f7bc4d3129f2cf52e53612e84f
- TLSH
  T1BEF002B3D14E1B694C4B04F570066BD8418FA282D795C0AF12F74A849CC63DC8694340
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  SpotX-main/Install_Old_theme.bat
- Size 666B
- SHA256 f645c0e9c9dd665bca8b85a1ab509ae436e539bbb0904246f25e8cb672bf2194
- MD5 0b77a7604290d02b4ad8ca31d024f791
- SHA1 2dab50d577d540aeb82e4cf253797ae82c51da71
- SHA512 a93c5ad5094dddbdbaa582c0115690e4c4970805f52ff98604cce8cb97137f7da2192af9bd5a46481a0a3d05d7658b4e8cadf97d636bd9c1c98f713edd74b539
- TLSH
  T1230123B3D14E1F694D4B44F5600A6BC8418F6283D75A80AE23F74BC46DCA3DC8A98305
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  SpotX-main/Uninstall.bat
- Size 940B
- SHA256 98fe8b9857375588722d2d2a325af6c998e8ad93f87ec84c2a409c21979d0210
- MD5 b74fc1987d231ff335f8a82dab4c040f
- SHA1 d6e0cb07fa605352377ac38aa3d7bebe25f2d13f
- SHA512 75cc13c7efe2f126bc8dea5765b997c480a5d565ffc2b7f626bdcdbf0eaf7f2d62e30b7d3e6107db935bf3a16494f04176419f10e986de8f0c181e431aba8a19
- TLSH
  T1421154183907DD25D2300F949A8B68C1EB1FB782DF6436C07BCB84926BE5714B2E9884
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7
- Target
  SpotX-main/js-helper/sectionBlock.js
- Size 3KB
- SHA256 f578be6b637d861bc7a248e0a2db109052afa2b2c4e20ece57e23e870fe9ea3f
- MD5 a5cde3d5c228884e1e33d30c8af5a1b8
- SHA1 bc834a293fb36cb34c3618c831b641f61775562c
- SHA512 7f2c4a41c6aa864a619dacbb7179284f82326b1c934da0c4dd33ebd81f0d109de1331a98158a792f4a3d692a95127265a818ebf276ee84f266efaf7c57f3e286
- TLSH
  T17F615DC8ECFF7682119E77321B57B6622C34466314A02B327FBC14542FD9264B6B764A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  SpotX-main/run.ps1
- Size 60KB
- SHA256 56a6bedc5ddb79aa308798b242a626f44238a87314de232b559f37bf17831bf9
- MD5 55711fccc5908b765a1e59a0a0327113
- SHA1 8e899d0093ea088373e9089a3414014dde7d6b5c
- SHA512 8d3833ff3d092962e12b66644a0a8c2aa5f0a1ce7bf7b8a16ee3e55920b1cdfdc960e1ae18b60939866e1f2395cc0062301a5fa6e163c18878c7b0857e629e78
- SSDEEP 768:TN/PJNfd8KRio+UIwwrFK5cxM4pPIZk13K9A6ZU1AjAYjS5Jg8TwNR7daxDDcD/:1PJNpHA3unFtWU7
- TLSH
  T1AA53C72A7496AD729183723E1CEE2404BB7E4457D50C1D40BE9F82CCAFD6368CED4A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion execution persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  SpotX-main/scripts/Install_Auto.bat
- Size 740B
- SHA256 43a0318d6069ca13bbe7d6a8fb28cf071229953ec21266cfe4940dd5af02699d
- MD5 a9a92cac1ecc3d9e1fa51908dd9113f3
- SHA1 e43c6c2b6a9891a191681804c1b51f55b8391266
- SHA512 dc1ebbe59f5591499cc64be46b9ec5778cf38d0c1ea4ea7896ba6612f7b7de48db753e4ba421407b66d4b20ab46f95da4c82d63b73d45918e559184c4c4c20a4
- TLSH
  T1900165E3918E3F6A4C1B45F5610B279C418FA2D2E7A584DA23F78EC06DCA3CC4688302
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution persistence privilege_escalation spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10
- Target
  SpotX-main/scripts/Install_Prem.bat
- Size 609B
- SHA256 dc1a411c116e88abf0f5c65ac6f3af71921d24f4446b99a7c07f06cb62e5a762
- MD5 8abb79c6baa7ab3cabe68dea37eb0cf5
- SHA1 3f5ce7534f424b9e82dbf46bc8fa40a564d78f6f
- SHA512 95853f0d253c9fbac130bd078a66b2dc0441f7e4ea2c44735eb819dee5b86954916b0b945f4b61e94c3d3b33ae9c2266704f0494ed9f75e3138f7493d9ce9d88
- TLSH
  T1CCF002B3D14E1B694C4B04F5700A6BD8418FA682E796C0AF12F74B849CC63DC8794340
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral11
- Target
  SpotX-main/scripts/installer-lang/bn.ps1
- Size 7KB
- SHA256 98b0e630490610acea1e91a6c3980735afd351e7d4765b24ea2a8965cf70dcf0
- MD5 7ff5b63c358646e7b271e18830f9477a
- SHA1 2b78acec263c3dea3599194c393832d331515807
- SHA512 8d61492a88d04fc4ce14513c4941d84907facc78d30b3c1582d6e23bf10a01344f99c83c4561806f717202e9025960620afa7c6af54a5cd5f16f21459714b664
- SSDEEP 192:zF0qcvu5uZxhqYkDzC+FRKV2wmUDE+j208g:zF0qcvu5uZxhqYkDzC+fTUDEI2m
- TLSH
  T144F19B149C6E51F1B8D6CDD54BA82B7091236D4787A1D309FC0FA5A83FACC7C8CA99B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  SpotX-main/scripts/installer-lang/cs.ps1
- Size 3KB
- SHA256 339c37f025cab7a38e4c8235712a8150b75e2dc27dd2f4ab8489aefaed100742
- MD5 72f10f452f0c8c3f1789cdac458b226a
- SHA1 f80be92d01ceb26a54c9193877147de0dc7d832e
- SHA512 a386ee9ca106b8f0ad1df8b7240a0ec4e4c2d164064496925a7fea554103f0086a9fc55c7de6bac8ac2ee30445317fabf442aeb63bb8179436ee132dc156efaf
- TLSH
  T10661B8098641DEB5DA6E8D484D323D4CF60E41ABDC0656A13A8F9ACD1FB278EDCF1225
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  SpotX-main/scripts/installer-lang/de.ps1
- Size 4KB
- SHA256 9fcc99f3865a44efa51505d997e5dc58a7a8d1edf8f66325e9b88b3b847d5943
- MD5 f7f1492ad0c41957df8b26b39103618c
- SHA1 d1436ed5bddffb2619eca33c9c4465735dfdcdf8
- SHA512 bea18483e99222ecec3dae098e6aef3bd5ca98c50c72073c6ca34b38e0bf0a576a7ab84af1737042ee9efbf8468b9a5d298984101ceab0798b7d87d1da13ba5a
- SSDEEP 48:2L9fPpuy/osNUTFSuZQA3SuGHr1+QGYeQt19P//V9vqARhZVwhU3bh85S694M6sL:2BQXgyZ1F3ONrvlTZVIU3O5zLHgAIC
- TLSH
  T1B1811D01C5529A309D768F680D326E59F25BA363DA112008325ED2FE0FB2327CDF926B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  SpotX-main/scripts/installer-lang/el.ps1
- Size 5KB
- SHA256 796e6527f14baaa39ddb4a4652a909fde0c73f8b918b4a726c8e4cc305b1badb
- MD5 b511c932a78e9d07a0e07d239cae2d30
- SHA1 edf2e644300fd12111a3a58f1daa88d655531f19
- SHA512 685d33faa7857b06b92619793df64ed5e1fca5905c5f6e47295ce3155d699a4169ad4dac6ee1056bf54bc0834faef7cba63ff3f5c062f3f8ca0aef8061439e8a
- SSDEEP 96:Ke/wgqAuW5UjxAEst+VKIENTI17tewxDVDnxrwSLqfavLsvk5xURgaq0:rw5AFUWt2Kxklt1beIRvovk5xURlb
- TLSH
  T117C16A9FE4646DA4801A9E464CB4787877467C1AEE18CAC8723DCBE47FFC161C861E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  SpotX-main/scripts/installer-lang/en.ps1
- Size 3KB
- SHA256 e5fa948b37b2589912b80f1732385d0e677e15e0bcade69adcef9c6547052c9c
- MD5 d67f569da5c55d82aa66ddaa91e62e72
- SHA1 0cc78b9c48e50dd313d727043cdbc2ee053768aa
- SHA512 64daad1bce7f3fe4fe3f9ef0d27bc30038c01d51f9f4e14c73cf09d459a5e1a28ac7aca54c5dfda246cd3143436c68752a68e9e69ffd525643e511d2360b2987
- TLSH
  T11861B00A8511CAF5B97A8F485C753D68B30A916BEB002241719F86DC2FF7254CDF639B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  SpotX-main/scripts/installer-lang/es.ps1
- Size 3KB
- SHA256 3caf44d54d5b6381c66ba3d2cb3a6779db575a4dd14a32fce9870b3c40ee4fd0
- MD5 0ce9e6a5b54994f0e51a4f1e8e5be71c
- SHA1 167cd189359fbdc0553520d1b0243bc8190fffcf
- SHA512 598a9e8124affc8fc9a66921083cadf9b757dde9abc833644a15e1a0ad72a176484b367b5517383fbab8bc06c1c7e28be677641e42567e8c237c20bcf1a445f1
- TLSH
  T1C871F911CA549BF5B67A5C481D71AC0BE2495187F800D112B61F86EE1FF16C8CEB26A2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  SpotX-main/scripts/installer-lang/fa.ps1
- Size 4KB
- SHA256 8f71946477d255d5e6667802ba689140ded7a1e711baf5e4d272a3ea7b2d2852
- MD5 3a1c90a2b892d683f221a19c9e225928
- SHA1 3cf8dc0af292a61ec258b3e0f0aa78b84f7ed991
- SHA512 7d5ce669b64f863c56cd8f2157befc5e0b1508a8f9cebf5bf16030e43497184a7e1e2f2c52156ce2b6a42a0eac76eba1043480be3f2b5641ed067a51646701bd
- SSDEEP 96:QWgIVtIRIXerkOP7sdLfbrb55UA7nTKe2JUrpq2ZecdX7U:dbqJ7oPn7rLvLU
- TLSH
  T10BA18C41979C46739B678A5214B22E3CC6675E23E100EA40B4FC06E94F76623D9DEB3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  SpotX-main/scripts/installer-lang/fi.ps1
- Size 3KB
- SHA256 c2b569c863120b49ca146db0e2ee0ad320a47d324749682e3c4b2e33f5050e6b
- MD5 fa49d546feba873879fbe0653709a68c
- SHA1 22841cde66fd3a45272bd16c64584d282e3ad077
- SHA512 5811ee854eb7bc2869b374b45abe5a3f7a97c41c8314ac634f5b5f1bc541fd38fbf16db731261cdf5f1c177cf4622dee05419de8a754c5cc794f770e21721705
- TLSH
  T16781DF158291CBF2967F5F494D796C29B25AE193ED100500720EA3DC5FF2A98DDF02AB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  SpotX-main/scripts/installer-lang/fil.ps1
- Size 4KB
- SHA256 655137cd527ad0da1493f2c78f0daf405784b0a007b769a655adfd2acd15b10a
- MD5 5e13254de1f6267650c1ee3728d9db56
- SHA1 d23a9a9685d88409691ff7bfef1e4ead8d9b7cfd
- SHA512 15ff10616bf0faa37f2df86399dde498105190a7ea6540234c42a0a9731d3e3d9f4c7eb97ccda5d4a7ceced7f369cd92ac8555e8af2316658526acd9301f9e1f
- SSDEEP 96:GcIZzZTUYk3f4QJw5OR77E4syqwk08RQ8pH:i12YRQHR/7syhk08RQcH
- TLSH
  T150910022AB0086BDED6E8E680C35BC1DA546526BEB002448373F26DE5FF3585CDF1A53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  SpotX-main/scripts/installer-lang/fr.ps1
- Size 3KB
- SHA256 2ede0800a06315ed9ac20a1f01cb1cf9c917ae7b8f6db860d6a2c9daa1b3b2ac
- MD5 012d9c113f7fda78f18b5ed79dcb54b5
- SHA1 18a24d715517802b866fed0e7cceddd382bb0788
- SHA512 d12db4abf42185142849923932b9e98e4a9667353c7680a1deb675db94b3249f1f017efc6bd733fee11e61dbe2da6d3966b31f6235938198582ca7b3d6248f57
- TLSH
  T1BA814405D69097F5A99E0F199C317D2BF2152287E9009604358E97CD0FF2AA8CEF26A2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  SpotX-main/scripts/installer-lang/hi.ps1
- Size 7KB
- SHA256 268a39763f03a3fa8f75e4a2ad4fe794f4d3a16bd37a1797c249935da3293491
- MD5 0b53cecc40d2e36b0908cc3728950637
- SHA1 47d6c2a79dad252b9d8fa57605314e5f260cadae
- SHA512 f0b1efb234e84bcb953da3f166df374dbe31b66886c787c974a07683562111bcba4bc45333751cc005f9bd429721a5795cab081dcfdafdc9e7ca76845c6a0c47
- SSDEEP 96:CDW80Euih/Cyz0O0EIAReSb+/75VTOMjseZoKgA/RAdjz8FAdObvoaI05ra30j7W:kgdnzzrpW9C+AgwM9vwcGy4ajdm23P
- TLSH
  T132E1F20CDBB9F3B069AD7C8D3A580D378098657697E4025374CCF3EB9F50C7499A62A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  SpotX-main/scripts/installer-lang/hu.ps1
- Size 3KB
- SHA256 d28e117df86941f443f557b78090b0c9d3bc7fa9dc339638aa6b0654342c66bf
- MD5 638899f0fa62101ce88929e26acd1c53
- SHA1 b7de460504f4a9529cd1bdb07dbc40ce85532674
- SHA512 5e2dc92b09b3f8724a6966814ea3a589deae026af075831cc8fa5edb21333986c7805900107c245b908822a6e725d552918fc3eef3c3515b168d36ade8011e4b
- TLSH
  T18281EBA28711EEFA9D3F4E061C746C18A51E576BDD222522330EC5CE1FB1369CCF225A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23
- Target
  SpotX-main/scripts/installer-lang/id.ps1
- Size 3KB
- SHA256 17ab2682faa42298796afa3233e316be9c9e32fd960ff0a9da8ae80521d10ff0
- MD5 cdda1093f332cbe192ca790b36423423
- SHA1 e4082f681ad7f9530df6efd7cca3f824a3f2c298
- SHA512 34eeb82bfaf0d410f9cb85d22923bdef6fdccd16f005436f3fed7538d947038d6df95d5aaa6aec5036b46a07d1eaa7100406bb4b20ac496dd706611c3cec6911
- TLSH
  T1ED61DB128681E9349E7A4E885C752C68E60F5363DF0021583B0E5BFD0FB2657DEF126E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24
- Target
  SpotX-main/scripts/installer-lang/it.ps1
- Size 3KB
- SHA256 f371111c1bf88aac0842305ad39c80cf03696e720ec8f4dced7de97e935d71b6
- MD5 e1a1babac14c8ea928fd574b5cf10715
- SHA1 9fffa10514b391248ebeac4a7b492cc937d2f4f0
- SHA512 24c4f5d69978209b9a0bbc97776fc01cfa67281390f6f405e90e5d58d7e94dd03e49c2af59f7dc6aabf2af3e95ae7f6940151443a9bc722633551feb6874e9a5
- TLSH
  T199810E21D6A1C9B16E7B0B8C8C752C5AE69B7282FD001200364F46DD6FF6A44EDF03A7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25
- Target
  SpotX-main/scripts/installer-lang/ja.ps1
- Size 4KB
- SHA256 27b0dbc2eb6a53060806e70a0ba15753f410b1a8247bf8b8dd76998f3e4751fd
- MD5 2e237e1a55515cdb57eb51c2f80bd3df
- SHA1 8fe953ece698b0f8d4014b9324cc57dd36b3c7d4
- SHA512 976232f0d75ea8eca30941b5bb7afd509255503bc599b7fd9f2a09f4dfcaff39d066d9c9ff8f0540fa446b1a8b9fde49012fae8cc035f2ccab8c98371b3bc1be
- SSDEEP 96:YiERpO1aukpFKQCazcyclcd49s5MMxpgsjNDg:RErHsUh7MyxNs
- TLSH
  T14C91CA1CD3899CF6A97E4A710C783E8575065D9BED222228310DD0E97FB56DEC8A0B71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  SpotX-main/scripts/installer-lang/ka.ps1
- Size 6KB
- SHA256 b3e47a7cb9e10258180380bf210ca216681323981e206a7015cdc2c386632543
- MD5 97410d79a35453f6eee9acf28c9fb09a
- SHA1 e2bc8e870e3c6c5eff95c46f982e84ff710d0115
- SHA512 eebac2ad52234583e7176d4c5f2a2a0af8cfef4de85e3fb7f3d87742ebb2a157b7ad2ee7f468a59319f2eb2cd9f5f56d23dfbfb64226740004537d796ae057c5
- SSDEEP 192:er0dO7KpkW+xACMLRZ4eRuoX913hE9W2/PWxwNVhr2fsj1Cxr6/AE/7oclo:eYdnkCtK2BFuoMo
- TLSH
  T1AFD1C34161EA7770DC6E15190A31BF4AA79A8C8FE5C4403EB10DF5E63FA2B049DBD362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  SpotX-main/scripts/installer-lang/ko.ps1
- Size 4KB
- SHA256 e79f8c87e391aa4eb6543c1b665bc64fd53f890085c988d0e571e08c6f77c907
- MD5 262307dda1eadc64f625eea6fbe23a94
- SHA1 97dd82c6c9c1513db85a0ec5c9cb3ec8c1f12fef
- SHA512 50d2ba566f7596120289314b51d14f6beae9c3371cb3868750aca02c402e46230a8b2420b201a4afe183ac091abf4eb5cf397e4e66046be5e8acc9898edffec2
- SSDEEP 96:CDsFrXjsajvOzy0QVpLPhs4NQ+Ac0BEFWZU:fBfmzy0QTPWfFZU
- TLSH
  T14281DC62D48ACAF491BF0E485FB86C14C14A9627FF1201427A0D5ADC5FF16D6CCE4EBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  SpotX-main/scripts/installer-lang/lv.ps1
- Size 3KB
- SHA256 9f08f3c12d5d71272692d99e4b0e6918274653b4b13bf1c8fc9bbfd23967d3d1
- MD5 281723c401d3963d7b743f967724661e
- SHA1 d022b4b9592a85b2c0f6985ec5a37c14298a6eb7
- SHA512 8ca1f882dac1dcfbbb96352835adfb7dab4c5cd859207e643bab42a2a00d85f438a5a702ed87ac2657fda4bc4300f9617fea10d415f904e063631fea575d7b8d
- TLSH
  T1C8812121C501CEF65A3E8E445D766C2563CDAA4BFE000A00B24F83DD5FFA248D9F6A96
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29
- Target
  SpotX-main/scripts/installer-lang/pl.ps1
- Size 3KB
- SHA256 626cedb5e230788946070f67722080c078d1fc396fe80a6264421977ddb1cf62
- MD5 ad988b9b71cca587db53a6ed4f1cb865
- SHA1 4dbd82d46d91cfbacaeefa1d99d92be250ecc997
- SHA512 4a7815c707c026af80877c0aed16144dfbe4030bd073b166047f48ec42d567f9430e33e6f217c325c3492f482d75e4132ec6d6106fb1a1d72a403467af7b86a5
- TLSH
  T1B671F909C141CFE49EBE4E484DB23D68A94E949BED056690324E06CC5FB2B4CCDF23A7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30
- Target
  SpotX-main/scripts/installer-lang/pt.ps1
- Size 3KB
- SHA256 7a903596313dcc408a8a9a95181f02a21b29fc59d08857985b2e98a421696dda
- MD5 0a502b930c9cc54daddb6ede721b5ea6
- SHA1 d8729b56f2cb030c99dffcbda43d0aec2d7548f1
- SHA512 4a7421d1841f75d7cf5fe0f0c56beaec4babd54f4907838e0b026fec34be3ce6a8f57113db43be85a50f449c34f5072a77a6f3a17768491839fd2bfa918d5314
- TLSH
  T1FD81EE198A428BB59A7F4F4C1E366E5AA14A1213ED008502775FC7CD2FFA640CDF67A3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  SpotX-main/scripts/installer-lang/ro.ps1
- Size 3KB
- SHA256 9d6ff928d81242198b2d2deb49411a289ce3274aed262392376f975568bf88ee
- MD5 d8bfb1ed806f1998f38b9817630e8c3f
- SHA1 9d0c1173f4f75454e428fcc7918c2d5d3d79fea8
- SHA512 47ab611de21245f75f7467a17527e0b5ebdba58a64e587131209514d3968c19e0a801edd983c132cf45252978189bde47cbbe86525afba01e4ab5951c9deac5f
- TLSH
  T1F381FC059A01CAB1AE3F4D942E752C4AE74E216ADD102544738F8ACD1FF26DACCF1AD7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Badlisted process makes network request

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Badlisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26