393059c772b8f17490fb8f5c98f331fba02894d7b89c116d2a260bb4f5b4688b

Sharing

Copy URL Twitter E-mail

General

Target
StellaWare v1.7.zip
Size 46.7MB
Sample260716-2sjefsaz5s
SHA256 393059c772b8f17490fb8f5c98f331fba02894d7b89c116d2a260bb4f5b4688b
MD5 22955f59f0e9a8db69d3c169169e56be
SHA1 94add0b6539cf0ac881f1a4a91faa1c341f52e38
SHA512 f771585e3155eb179d1a1778d6b5554677299de84a3a0b6d50a205bfb051de813c0eca695bff873904a353eb31ab66bceecc7e28e9fecf95a1fe39e632d3da53
SSDEEP 786432:tF6cK6gbNAOdqShqIsKP5thtOUF6cK6g7NPOWhvhq34O0lsl0:WcK6gBqIqIsKP4cK6Cbq3YGC
TLSH
T147B733A1B727E0EAF25BBD7DDFB34691961D6100BC1F2456220273B788223E6CF5950E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware

Malware Config

Targets

- Target
  StellaWare v1.7.zip
- Size 46.7MB
- SHA256 393059c772b8f17490fb8f5c98f331fba02894d7b89c116d2a260bb4f5b4688b
- MD5 22955f59f0e9a8db69d3c169169e56be
- SHA1 94add0b6539cf0ac881f1a4a91faa1c341f52e38
- SHA512 f771585e3155eb179d1a1778d6b5554677299de84a3a0b6d50a205bfb051de813c0eca695bff873904a353eb31ab66bceecc7e28e9fecf95a1fe39e632d3da53
- SSDEEP 786432:tF6cK6gbNAOdqShqIsKP5thtOUF6cK6g7NPOWhvhq34O0lsl0:WcK6gBqIqIsKP4cK6Cbq3YGC
- TLSH
  T147B733A1B727E0EAF25BBD7DDFB34691961D6100BC1F2456220273B788223E6CF5950E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  README.md
- Size 4KB
- SHA256 57eda7a58d43e7c305e115c8e11b27fb747371042054f9b3adfce8ab82889865
- MD5 0f48009f425db531fbc7a7600f15d8df
- SHA1 8117624d10a0dcd48369ce3657c3a26a09e7e93b
- SHA512 b30eacd253b105f9ee82e664a71e1b481b34aa823a814078f53ba2ff4543dda8a1457f99e16f852eecaaaa84278a1307a6fbf40be08e7741fdf70bad758dcf68
- SSDEEP 96:5z+UnY35itBaVtWuoLAtRTwntLaO1SX3KTOzACZpT:U/B/osgtG4NOz9
- TLSH
  T10A91A62FB7CA3379202381C7E11F66D28767E25A9247407BD8FE405C6666364C23B4E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  StellaWare.exe
- Size 681KB
- SHA256 93dd267eb8ba0e91893ca84e92cc3f7acf422885aacc8bea1777d728227c6788
- MD5 157b2f97477f040aec7ee2e1d537a360
- SHA1 026dbf42d97168a3e22df75431cec1754818fece
- SHA512 9ba314f0b875e68a8dfc5ec9949226375c2713427d86b56ff8ef2c3b364d2f484565934b646386b05a036126c33c0eae35b7f9ddd421d52bb7ca6e49a4d76439
- SSDEEP 12288:lypj0gse5k3eNszpo4dzWs2Ekh4KcglRAHKUgiNn58eene:l7gsey3mszBWjh4Kco6HKUgiNn587ne
- TLSH
  T166E4AE56F2E506F8D0BAD179D686E51BF672384807205ACB23F40AA52FB37E04B7B711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  assets\assets\deathnote\L.png
- Size 195KB
- SHA256 f7a6a701395a641aaa49fd985f1c3cf42a36c9c39cc018fbc152082716f4e236
- MD5 23e8e22a95ea830e4509a9c36d34ca7d
- SHA1 5e2a07514ea700cac30c8f9dd97f6f58df8245f0
- SHA512 6489320be21733ab7cb0ad823a80b0d622172719f0c6c77436ad326e95be595f4798e32e1402d5ad8787729408858062aef70bdcd6202b36bed7a270acfe02af
- SSDEEP 3072:mDg4c8yRjeStOhwVwfSUCk7eMQVW7qhUjWIfHePtga9u4UCULD:mDg78EyStOe2SUCkihJIfvqu4FUX
- TLSH
  T19B142253AB4D33353D05897C4D216E27A02B2FDCFEA271247A89B47DC58A5B21EC4D8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  assets\assets\deathnote\kira.png
- Size 336KB
- SHA256 a9b1493562cfce251c24491c2ddf6e3b5fba4093e2e11cc55d7612e7d8f5e311
- MD5 fccaaa9b5e78d0fa689e978533121748
- SHA1 af4771bed13f14377b597584c770216dc4d5b38e
- SHA512 51975cb7bd0713cda3c13a485c802b9ec870762a55890241a8c6ac4d7527a4b6b9692b98c4f590d17953c6476c8ca3b2f119ecebf6854e04b311e58cfbd8ac68
- SSDEEP 6144:YsAN7cJ90BYEbLnh68sV9zHAFB4E7+T+D7Rcc4+4tAz8xv4Vum3aZheu4XMI8hZ6:PAN7cxEbLh+9zgFGTYc88RBmqZ4tXMIz
- TLSH
  T13074234BAD70BC234FA261B2D72CDD1CD1A12442505BFA50BF777198DD9A2A9CE1CCAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  assets\assets\fonts\62593142a696a55ccb710bf1_Ginto Nord Regular.ttf
- Size 229KB
- SHA256 71a11dcffb3558529d82e7c275996e00ac61899c22e2d3717f314a1a315b9fbb
- MD5 d123ccf2194f0e31ce8188b1e17f713a
- SHA1 046704dc610dfd1fc7e3a4fbfa245fc0bc4871e0
- SHA512 284fd6f8bf4fcc54e5108f415a7874fd597cfbad269c352811efa4c182717a59a836171e93efc9e7eea4e067357011faeb0fdf0d6c5a068a39fdd44533efff6c
- SSDEEP 6144:0RKfOQ2oZVQPQnzSvevYgqPsJIJKZUNDfZnoqXbf+d7UOw0:IKfOQ2oZVQPQnFF2JD1fZYy0
- TLSH
  T11F345D457160CB41EF675D3098A4F532F2E6BDBEDBA38743F03729B418860D11E6369A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  assets\assets\fonts\625933f807781e4a4303f1cb_Ginto Nord Black.ttf
- Size 243KB
- SHA256 29f879f8c25e19444352c6b8aaebde44cdca78ed921ae24bbffadc63d55ae4ba
- MD5 caeba66c703fc462388408058ac91fda
- SHA1 b5f21e0ae9d297f9b26123abbe7ab6306fd67185
- SHA512 a0c31d5e63dc02357ac4e56ee5e6c10b7061e500341f50a2f1169a5764d9ff47806a6279a5c627aaccf3a80db51cb2e457c4742dbad1e26168cdfbdf8fbb5433
- SSDEEP 6144:SGEDUjbkNjapVEW6iy90FNfuq/U/rWcuKSd6wDSIe8:C+bkNjaFNfuq/UzzSa8
- TLSH
  T16F346D03B212E202EA534934D5A5E763E3D8FCA65FA3CB4B714BA7B86C930E11D631D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  assets\assets\fonts\6284e0f599173e62453ac15f_Ginto Regular.ttf
- Size 224KB
- SHA256 e1b8d3a78823aa94c69715020fa72aa780bce2420db0c73d5a2e895c02c6e083
- MD5 9572d1927d46d80b8e8be24d3ec63b9c
- SHA1 002972394295b1fa77e6d0f76061f0b1913336c8
- SHA512 38d332391a58ea7dfe4b7e412f3ab91f2f6086954fba981d22086cac57decb9f7d58db8c0d30d8cff81641464392217f3ba2bdfa3a7a26d0774b117afe3615b7
- SSDEEP 6144:hQhf1bvB6lyZRf0hP892vnu6a+LkC93H3wsGrpVEZLCO7DS9XFuFGNUEUb1NpHDL:6hf1zB6lyZR8hP892vnu6a+LkC93H3wQ
- TLSH
  T1CE245D413150D601EB6B9A70A461FDB2F2E6BD6ECBB38E43F4373AB854460D12D93359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  assets\assets\fonts\628637495e0b73615e1e27b6_Ginto Medium.ttf
- Size 233KB
- SHA256 71ad443891284774547f283aa2b622c2bff5d7980532d081eff1293af6a3b94c
- MD5 ede83583115319c5ad929edfbae5b1b0
- SHA1 43095d86e231338da5842aba5b3ddc2f158cf283
- SHA512 e9e14c1ffee34d64ba7d88f675159296af87ae4d64ebfc501c7979653403df678d8a5a27119bf06a1994bdc75e326ee1cadeb54074d97bbaa34deb448a1cc424
- SSDEEP 6144:IIS7v+fwbvha8K2u6u+aoL1CR3g3KsvruV9tLPq7iASLXdCFHNWYUMRNUHko0iXp:I7v+fw7ha8K2u6u+aoL1CR3g3KsvruVH
- TLSH
  T130346C067211D602D6274E3198A6D632E3E8FDA75F638757B42B77FC2C820E01E63796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  assets\assets\fonts\6286374983556efc2e78b45c_Ginto Bold.ttf
- Size 224KB
- SHA256 9a4d98517bf98b4c29ea49dbc1ce1a9229e5c8e0595e524d2e116fcbc7dcd3f2
- MD5 ff994b568d4efbbef94a501b45877ec5
- SHA1 7d3c4666aa24cd9c95e510c22cacf508a65de1dc
- SHA512 43c800be0011d4f00bf4350d1ae2cf319dcef34cdfd714dbd72fda490e4794d19e29fe7df68d69f632a83a39333dfcbe66a5fe97d08a8a9d1fdb88f5e2090802
- SSDEEP 6144:zViE2L8uxidlOV7UMTpP7FjHHuQ9cMZGRYcgbCN3AY485TqE4wMUHNKB1QvI6oPd:zV8L8cidlOV7UMTpP7FjHHuQ9cMZGRYz
- TLSH
  T18A248D06B2409A06E6674D309CE9EB71E3F4FE669FA38747F01F5AB86C920903D53785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  assets\assets\fonts\Discord Fonts\62593142a696a55ccb710bf1_Ginto Nord Regular.ttf
- Size 229KB
- SHA256 71a11dcffb3558529d82e7c275996e00ac61899c22e2d3717f314a1a315b9fbb
- MD5 d123ccf2194f0e31ce8188b1e17f713a
- SHA1 046704dc610dfd1fc7e3a4fbfa245fc0bc4871e0
- SHA512 284fd6f8bf4fcc54e5108f415a7874fd597cfbad269c352811efa4c182717a59a836171e93efc9e7eea4e067357011faeb0fdf0d6c5a068a39fdd44533efff6c
- SSDEEP 6144:0RKfOQ2oZVQPQnzSvevYgqPsJIJKZUNDfZnoqXbf+d7UOw0:IKfOQ2oZVQPQnFF2JD1fZYy0
- TLSH
  T11F345D457160CB41EF675D3098A4F532F2E6BDBEDBA38743F03729B418860D11E6369A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  assets\assets\fonts\Discord Fonts\625933f807781e4a4303f1cb_Ginto Nord Black.ttf
- Size 243KB
- SHA256 29f879f8c25e19444352c6b8aaebde44cdca78ed921ae24bbffadc63d55ae4ba
- MD5 caeba66c703fc462388408058ac91fda
- SHA1 b5f21e0ae9d297f9b26123abbe7ab6306fd67185
- SHA512 a0c31d5e63dc02357ac4e56ee5e6c10b7061e500341f50a2f1169a5764d9ff47806a6279a5c627aaccf3a80db51cb2e457c4742dbad1e26168cdfbdf8fbb5433
- SSDEEP 6144:SGEDUjbkNjapVEW6iy90FNfuq/U/rWcuKSd6wDSIe8:C+bkNjaFNfuq/UzzSa8
- TLSH
  T16F346D03B212E202EA534934D5A5E763E3D8FCA65FA3CB4B714BA7B86C930E11D631D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  assets\assets\fonts\Discord Fonts\6284e0f599173e62453ac15f_Ginto Regular.ttf
- Size 224KB
- SHA256 e1b8d3a78823aa94c69715020fa72aa780bce2420db0c73d5a2e895c02c6e083
- MD5 9572d1927d46d80b8e8be24d3ec63b9c
- SHA1 002972394295b1fa77e6d0f76061f0b1913336c8
- SHA512 38d332391a58ea7dfe4b7e412f3ab91f2f6086954fba981d22086cac57decb9f7d58db8c0d30d8cff81641464392217f3ba2bdfa3a7a26d0774b117afe3615b7
- SSDEEP 6144:hQhf1bvB6lyZRf0hP892vnu6a+LkC93H3wsGrpVEZLCO7DS9XFuFGNUEUb1NpHDL:6hf1zB6lyZR8hP892vnu6a+LkC93H3wQ
- TLSH
  T1CE245D413150D601EB6B9A70A461FDB2F2E6BD6ECBB38E43F4373AB854460D12D93359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25 behavioral26
- Target
  assets\assets\fonts\Discord Fonts\628637495e0b73615e1e27b6_Ginto Medium.ttf
- Size 233KB
- SHA256 71ad443891284774547f283aa2b622c2bff5d7980532d081eff1293af6a3b94c
- MD5 ede83583115319c5ad929edfbae5b1b0
- SHA1 43095d86e231338da5842aba5b3ddc2f158cf283
- SHA512 e9e14c1ffee34d64ba7d88f675159296af87ae4d64ebfc501c7979653403df678d8a5a27119bf06a1994bdc75e326ee1cadeb54074d97bbaa34deb448a1cc424
- SSDEEP 6144:IIS7v+fwbvha8K2u6u+aoL1CR3g3KsvruV9tLPq7iASLXdCFHNWYUMRNUHko0iXp:I7v+fw7ha8K2u6u+aoL1CR3g3KsvruVH
- TLSH
  T130346C067211D602D6274E3198A6D632E3E8FDA75F638757B42B77FC2C820E01E63796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  assets\assets\fonts\Discord Fonts\6286374983556efc2e78b45c_Ginto Bold.ttf
- Size 224KB
- SHA256 9a4d98517bf98b4c29ea49dbc1ce1a9229e5c8e0595e524d2e116fcbc7dcd3f2
- MD5 ff994b568d4efbbef94a501b45877ec5
- SHA1 7d3c4666aa24cd9c95e510c22cacf508a65de1dc
- SHA512 43c800be0011d4f00bf4350d1ae2cf319dcef34cdfd714dbd72fda490e4794d19e29fe7df68d69f632a83a39333dfcbe66a5fe97d08a8a9d1fdb88f5e2090802
- SSDEEP 6144:zViE2L8uxidlOV7UMTpP7FjHHuQ9cMZGRYcgbCN3AY485TqE4wMUHNKB1QvI6oPd:zV8L8cidlOV7UMTpP7FjHHuQ9cMZGRYz
- TLSH
  T18A248D06B2409A06E6674D309CE9EB71E3F4FE669FA38747F01F5AB86C920903D53785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral29 behavioral30
- Target
  assets\assets\fonts\README.txt
- Size 225B
- SHA256 1a9f9ddf610f9d8291439da8096e80f792d6d492c4b3735341b5e0a1288a8408
- MD5 ef0cf0fda00b87119c0c0da315997752
- SHA1 5cc931bc37a990784821d3b1681ab060387af942
- SHA512 e6b1defdd9187757d2e3980c4ced8176e54986c039d4c0e7cb4a22800c8cc36a1ad86db172d32d619a6f02356616add93671d031290cc3c778dc3256abfb6a63
- TLSH
  T133D0A79B6F0F9105401072DCB11CF2272D39622EC4B4D09B9CAD01A820CA955ACF9752
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32