d511304cc84c5e32288b4de3030f623dfcbb5ca2de2e10202eb518a8f32bf831

Sharing

Copy URL Twitter E-mail

General

Target
ai_5.0.3_DML.zip
Size 52.4MB
Sample260715-qzf25agy2w
SHA256 d511304cc84c5e32288b4de3030f623dfcbb5ca2de2e10202eb518a8f32bf831
MD5 447bd9c6d0d43ea80348280428e854eb
SHA1 d1c278943c3eb1962746d6015d07ff4228494f24
SHA512 0ada9eccfc02857ee77ef85ee95ead2a676bfd97624bbb64c4e06f591393a4b96651d37b4126eb7be88875c3f7131905a6920fd960e35c75e2527136b267731a
SSDEEP 1572864:QYFqYYK/EqxfAaZ73gz4Jec+qPtxXp30vwmvqSYBvvz:QOq/XqCYE46ErMwUqdJ7
TLSH
T10FC73345F701FCC5D92D63364B099F49F88A910E9A0316417AB908BF7D3ABDE323E646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ai_5.0.3_DML.zip
- Size 52.4MB
- SHA256 d511304cc84c5e32288b4de3030f623dfcbb5ca2de2e10202eb518a8f32bf831
- MD5 447bd9c6d0d43ea80348280428e854eb
- SHA1 d1c278943c3eb1962746d6015d07ff4228494f24
- SHA512 0ada9eccfc02857ee77ef85ee95ead2a676bfd97624bbb64c4e06f591393a4b96651d37b4126eb7be88875c3f7131905a6920fd960e35c75e2527136b267731a
- SSDEEP 1572864:QYFqYYK/EqxfAaZ73gz4Jec+qPtxXp30vwmvqSYBvvz:QOq/XqCYE46ErMwUqdJ7
- TLSH
  T10FC73345F701FCC5D92D63364B099F49F88A910E9A0316417AB908BF7D3ABDE323E646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2
- Target
  ai_5.0.3_DML/DirectML.dll
- Size 17.7MB
- SHA256 9c9e6d822561c6c41b90e6994b3e8857cf1d66dbfb1e0c4c799c7c89b4e92da1
- MD5 abc458767c27ab4691e8910714d47ed6
- SHA1 a9cdf72540b949520045ef11d7b44879e2181c79
- SHA512 97af8aef5fbd25e87012351d93129e8a0a64a96569c4f8f458d5389f1ffc49239f6a14d9bc99f8b0a41e915ef12ee1fd781e391fae67f9774c08311b49005131
- SSDEEP 196608:/AZfeTLx3Ohq0Ytzn7OBdzIkRnyrQAH5+sM3TKC:K80hMtz7oZIkByrQo5QTH
- TLSH
  T18A17D01A6F6415A6C17BD23D9A534A43E3B6748A43706AE706F80D311F97BE05B3F382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ai_5.0.3_DML/ai.exe
- Size 1.7MB
- SHA256 0f647e15ff4068ceba8d20062a4f854bc92a0768a2a7710c22f33de954fcba29
- MD5 94908b370eceddbe4d4e7501015edd69
- SHA1 f654902f9476a6df89042cb9f35274b7dd8e0c59
- SHA512 060d5cdbdb3e199180df2bfadd7f7d3b97822fc00b54dd8ba9ad098e77d2eb10d271dd6b56d5e0697a194ab6699daf419d37b0dfadafc9e5f0c42dfffac8c2fd
- SSDEEP 24576:ZPOIDagnWSO/liUlgI++JWAFRBG6WNZN6IH1eI0g6nOubM9LyiWn4iHcj+6PEj:cQ8S3Ulgl+JWGBYN//10g1rWnx6PE
- TLSH
  T1FC858D16F2B800FCD0BBD1B8CA56690BEB71740A033056EB17E04A991F67AE55E7FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Drops desktop.ini file(s)
behavioral5 behavioral6
- Target
  ai_5.0.3_DML/ghub_mouse.dll
- Size 91KB
- SHA256 87e760209f90e4ef1fb64320432e0eeaa17aba214c7d57b3c6bc400ef0f9d2df
- MD5 4b96b5fe6b6d453f88c1bdd640507057
- SHA1 06c276e59cf048da5333a7364c1a86b374f98908
- SHA512 e8b1b7a2a6c5e482615dab2e16128635fa655782725440163b23b2ccb6bcbebe48bd864e34567830d38f862bfbe6967c63ce0aa4720cc6bd666b4d26391fc726
- SSDEEP 1536:ZI//x6UsVfCkBSiSbSbEha/p/wJBVKsWtxld09dlaQLsZ:ZI//xK8kBDSmQM/p4nV+lMcQYZ
- TLSH
  T1BD93385BB6E500BBE4368638C8630E29D772F8151625DF6F0764025E6F273909E3AFB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ai_5.0.3_DML/models/sunxds_0.8.0.onnx
- Size 9.9MB
- SHA256 aed89280d4866a764be18400ffbfc2c8d3fb21b75d1d0ff34fc80e7c1853c4dc
- MD5 848874d55a22636229bb3c5244cc224d
- SHA1 9703c1f8b607804dd25c6de4f594b4bbfdc38f8f
- SHA512 bcbb20617a87f4cd19f10b1b5892ae2c31f94f24e3e370d86565736c822b1c1bd99178598eb69a7c118700e3029b2606f1ce8af81fc6abb32abc1d19f15bbfca
- SSDEEP 196608:6Ksby6H60kI+ikhCT4cqY72fqB20s8atqYh1tPs4gKtJvRvTD+t8EP9GEp4PTgtd:6Kx6HJmik4AfqgBtjh1lwKtJJ2iEwW4g
- TLSH
  T1C2A633E376FA1FDAD44F0DB377661C8853C1907D2A730A803F6DDD988B1C9902A4B999
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  ai_5.0.3_DML/models/sunxds_0.8.0.pt
- Size 5.2MB
- SHA256 de8a0cf0d3911751c65193b7b487f830fd3c6cbb53866e23bf8b8be7c33b4baf
- MD5 570506bfb0bbb7cf9068121f9c10f602
- SHA1 6e4e16762b323af30237eb4682db37d3d123b6d8
- SHA512 1d39cb5b7787c65f9939ea6a3ff9d52d1cf664fc34b925403bc284d7b014a1f8f69262d1e2df4c2c0dc1535a5e8c85f58dea291c1e94a5d8644b582122632165
- SSDEEP 98304:lMlUvcoq3t+iSl1+0GZnHRL36IZVAhxIXM7HsA7LhQp3/KHZcaGhcWCPB:lM8ny+iSl1+0GhRXVQuXM7MAJQIcwJ
- TLSH
  T1B946124AF18E7D8EC837927CC6EE4DF0116698E6D202DE4215442A6C2CF2593EF56BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  best/.data/serialization_id
- Size 40B
- SHA256 fad020a3c5ce15fdc891dac4360eb41220ec2ee43bf4bf2957ec6179bc6c4125
- MD5 7e3132278cb26d0f817acf678008fcd1
- SHA1 e1119c1a9bcaf84d7f37095e990ed8247a3e94f3
- SHA512 40f1088c7e1d14be60e12b5b650e776b179c9cb09b3dd3f634f19896f38d7a16e07400e786e7255209834da1e45773e8831a9ed095a62fdf41e55b625db8ef8b
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  best/.format_version
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16
- Target
  best/.storage_alignment
- Size 2B
- SHA256 a68b412c4282555f15546cf6e1fc42893b7e07f271557ceb021821098dd66c1b
- MD5 ea5d2f1c4608232e07d3aa3d998e5135
- SHA1 c66c65175fecc3103b3b587be9b5b230889c8628
- SHA512 e559aefac6fe1b006d3497abee2649ceb71fcceea73fd223782338ab29c08e5b887836b806349d5ace9030c69ca91850b01c468825d02359a5faee7261de415e
- MD5 SHA1 SHA512
Score

3^/10
behavioral17 behavioral18
- Target
  best/byteorder
- Size 6B
- SHA256 180ca01b95f0dfdd36fbb600e51cf6e46c8ef468de56b017847886fefaf7b6f9
- MD5 aae6635e044ac56046b2893a529b5114
- SHA1 4502229742dda5345d35a1c216dfadb1a96b3c68
- SHA512 fdf15fe5cbcdcbc23d690a659855d564addea079e45456d66ebb5574bdf65902a4aa7cc184a3a606d5e5948d1da7b37e872c793074eddffc2974bf63cbb09ebc
- MD5 SHA1 SHA512
Score

1^/10
behavioral19 behavioral20
- Target
  best/data.pkl
- Size 184KB
- SHA256 e0c427ef35e163937776268288e9cb73dd340d4dbe186b6c82ce41d2632e3b24
- MD5 0622ddd24b1f51876e0edda75d7c247e
- SHA1 33c986e2fc74b6417746b3abe7669bd637ff46f5
- SHA512 0fa8d22367d375ed8d6d00906c9f00dcbb60b01c30d019cecb2b854b0d5107bceae3970ce10848ca72c100da1daae4140d74b624e83b9ebddda1c282b0d978bd
- SSDEEP 3072:0Cac/HQZe/H937GkDoq+NE6xoCDrqxjIjmteh:Vac4Z6L8fNH3KdIgW
- TLSH
  T14904931CF88C7D1A99BA9690D95D1FE8142303D123036F12169D6BBC3DE11B7EE87B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  best/data/0
- Size 864B
- SHA256 1f8b8be5c1b7496a9eb600e9416988ad4d12b1766587aa1e514813f61bc5bdad
- MD5 996cd78c9133f7f3748fe6694c9118b5
- SHA1 bd34263c53e4419fde440d27c9cbdec7b000b7d7
- SHA512 413112945ce817c5a9f0f2483efeb23e82cd2966ec9acb3092bf156e781d6ca679930a2b9fcc2ab4c4baca70435617ab7219dc580b5cdb0416f741b1ab46e7cb
- TLSH
  T1F311DA1716CE1B95297D50F310444CDD01013C3657D8C8BF9237D48415751C1F737099
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  best/data/1
- Size 32B
- SHA256 d39f5f8e6beaf38fbad460a47957d987e83cc7788c9b441bbfea07c62a38784e
- MD5 a5a340dedabc3785e804d8cc6cb455bb
- SHA1 3ad4e1358090ea525197aafad98c384f94bb59ff
- SHA512 c971ee36737b869562e7368482d8d71baa8df6b42e9b2a0f93f6c4c2fd761b032641aef85adadd30aeea6e0eacc420c087e221d79492c37765c85eb5289d1de6
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  best/data/10
- Size 64B
- SHA256 2951aebda28e9ec4469fb3c787401fab1d5c4f7e8882e9f3455c9633941c0801
- MD5 6aa05af811e577897551ee856373fa57
- SHA1 b321570c0b038844bde4b85704c307beb4e6ce50
- SHA512 2833be9100cef7089d282e87d8de5c683b85ab1649ac3c19c3248ce21c0d9cd28c4353057cf500151cda9a7b1ba941434c83e3aa304d633208453389085c7bfa
- TLSH
  T1C4A022883C33000A82F0088E8A800003C33808038C028822200A08283028E832020830
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  best/data/100
- Size 128B
- SHA256 d2e1ebad0cd2512a6cf66eb292adddc7e7d4fe1cd8f49596755b076b14ae9899
- MD5 9ffa1ca8448c9cf6c8ac7990337bda0f
- SHA1 c8ac119fc0290c4bceed8bd4475064f67b4d0236
- SHA512 d2c0d27bf8c6394fb2c99294d967d97e523d6870631b7fa89a9b75bac54981decdfac92e4422b792ca8b8b3cc9095738fb54d3f53159e495e0e53f1d27ff820c
- TLSH
  T125B02B315F640425D4E1904050330112B070F400202CC7D51190205C6E0CC3014F0F0B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  best/data/101
- Size 8B
- SHA256 7c9fa136d4413fa6173637e883b6998d32e1d675f88cddff9dcbcf331820f4b8
- MD5 33cdeccccebe80329f1fdbee7f5874cb
- SHA1 3da89ee273be13437e7ecf760f3fbd4dc0e8d1fe
- SHA512 991294f43425a5b80f8a5907ca7cdbb611401282585a58bb415077005428e3b4c0f661fc07ba5c45f627bd8bdcb172389ce2fda461c029b837abc70f0abbea20
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Adds Run key to start application

Checks installed software on the system

Checks system information in the registry

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32