c80daec0fb85cef35abfe47489e1ac08208f6954c92a059a56867066506f9a76

Sharing

Copy URL Twitter E-mail

General

Target
Fing.exe
Size 14.7MB
Sample260716-akcs6acv2v
SHA256 c80daec0fb85cef35abfe47489e1ac08208f6954c92a059a56867066506f9a76
MD5 45725161af22c2418638632a47b91534
SHA1 63683f807066ad5ae61e8a00f668fbe1c1b06bb5
SHA512 23fb9dbcbcbd9433073d01149064a1d99c45a54777132b0a4f8f6ee27013bc225146daaaa6e826d64043980a96241a2b5bf4d33d3eb5d0551400bd6d1eec39cd
SSDEEP 196608:eluldGZ6HOH3h76EUMQrqyrpxTxbk7TieKxvBKMz0tjc+6TdAuKpxNBS4n+HcTFX:egHgh76EkjxTNoiVjzZYxrS4n9oivh
TLSH
T176F633B63DD07AA2E12E667DAFF0A32A2BD170465D40E327771B9E5C05287B064D438F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Fing.exe
- Size 14.7MB
- SHA256 c80daec0fb85cef35abfe47489e1ac08208f6954c92a059a56867066506f9a76
- MD5 45725161af22c2418638632a47b91534
- SHA1 63683f807066ad5ae61e8a00f668fbe1c1b06bb5
- SHA512 23fb9dbcbcbd9433073d01149064a1d99c45a54777132b0a4f8f6ee27013bc225146daaaa6e826d64043980a96241a2b5bf4d33d3eb5d0551400bd6d1eec39cd
- SSDEEP 196608:eluldGZ6HOH3h76EUMQrqyrpxTxbk7TieKxvBKMz0tjc+6TdAuKpxNBS4n+HcTFX:egHgh76EkjxTNoiVjzZYxrS4n9oivh
- TLSH
  T176F633B63DD07AA2E12E667DAFF0A32A2BD170465D40E327771B9E5C05287B064D438F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 45KB
- SHA256 877e7c0a51fd9179fecae5994e703ed84939611cc82024d7e0620ebf2becc8ea
- MD5 83e68c1fcd0f25154fea6633a7d56af4
- SHA1 68fbbb289b83b238d77d389ec2bbd4db70084c5e
- SHA512 c1455c7b45c7f20f5b1651d5bd334f734af3990f3416b1470074aee465978ff0cad4585d72cd004592ae28169d264d8be9c0242a7419827f2e756ca20954c9f6
- SSDEEP 768:I/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVGW5YiDZr5ALYB:awODZzTrAV5Oevq4DtXHVGs7Dp
- TLSH
  T118237D59FDC07D26DACF08312448853E9A7FC8081A40C9D7E3615EA2D6E6733AED526F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Fing.exe
- Size 22.6MB
- SHA256 6660b2606611fe486f3791aff1c95399170646e84e7994918707a0c6c938989f
- MD5 18643ec486668dc74becbda6c8acde18
- SHA1 d334079c85581d254ad752c5246e485352afa4ce
- SHA512 4599a267f24b41f327b08aef80b7824fc734ddb590d73f9015570503c47067f0efe879197025a0f4bd0b7783ad2edc19e23e6e5dfbdebe8a5b6128df198d9726
- SSDEEP 196608:4+9ghTcOAHZvy6o4TYWpmPsKoyFGZGY+a3g0Jn3uKZ0Sc:bghTcpZvlYVPsCFGZGY+ax3uy0Sc
- TLSH
  T11D3707207B5BA96DD09AC4B0834B4A725A7130DB1B35B9FF44C492392F6DBF42F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence trojan
- Adds Run key to start application
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral15 behavioral16
- Target
  extraResources/boost_chrono-vc90-mt-1_58.dll
- Size 33KB
- SHA256 2572a212a1b5bfb37b8b4c7d9b18b01630de4529e42946ea9dda962a33459266
- MD5 aa692c81691d6ca6fd7b68ff64a25800
- SHA1 15559906659e9f1f2661344fa7c772869b207a32
- SHA512 0dfb42b9a4febb73096dd8e331efa1fcd8d50b02d7d0f51f9b6b71ffb89c4504cce31021109a912c96ce90632f231d3529b1617ad0dd637ff3b626fac3fcaeff
- SSDEEP 384:sVJufiFs89TVS9RUJU34EB5hqWEhw7ld/EOtWYxQYwVC8KLUA54mc2VrHQIYiosO:aJufHAVwq8hqWXEOtze215YiDt5AL04
- TLSH
  T1B5F23B51CB2981B1D60E1D357881903A0A7A9C916FC141E3F3DE83990BB67C27FBF665
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  extraResources/boost_date_time-vc90-mt-1_58.dll
- Size 52KB
- SHA256 733bdb2488c26e5f7d536fac59be5ba48eedb7b4fb71d97db49346b1e9975141
- MD5 26da50370729c7f7a52d6542be3923a7
- SHA1 71968282f69d844a8d6d1238b3f37c5b660d7b18
- SHA512 f66c8925cb4e7e85b7a51450ffd8c2c715866a5e9c8552ffbb02adbeb8811289aa7f0719d5156b74472db9834e890c4ea961bffc3e6da255d862165fb74838dc
- SSDEEP 768:ATRBr951W/Ss7sBLjmlY+9WzRC66ttiAOuIBaOyFkV9Wp85YiDt5ALb:AB51W/T7sBLjraERutiAdyaOyK6G7De
- TLSH
  T18E333B11D70EC0B1DA8F727464C58B1E6AB5A8816FE152E3EB4ED38B0F723C99933195
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  extraResources/boost_filesystem-vc90-mt-1_58.dll
- Size 107KB
- SHA256 d2eb71a16fc0dfe1faa6169af4108fe90945bcd9749d99851c1c55721a43a323
- MD5 993492d15337d558ac3a5d6432298d95
- SHA1 4a89991bdb31fc2c3c6a5edbc9488cfef96de534
- SHA512 161171d3d768fefe33e47d510e04c16e3401ec4a8c0f46d7219626f3716d041ec4eb168f3a2a9d321751e07b6c02f53a600b071d37643d9ab50199b1dcd584b2
- SSDEEP 1536:yZDtgeI22g1k00/vAHGcXx0uM6AonQC1aGQTQViXgKOyonSHr/PHaQb8185v0QoP:eDINHA5aulAonQC1FQTQmOy/NLM
- TLSH
  T1AAB31B12F75AC0F6CD8A32B424848A6512797CC08F850BF397AF9F594D523C5BFB61A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  extraResources/boost_iostreams-vc90-mt-1_58.dll
- Size 48KB
- SHA256 e0ca08fd9af5a941f8b89ab1baf76dade9157b23c79c6550449c3b24590c52d1
- MD5 1e36706a2dd25a6329677b9bad324ad4
- SHA1 27ec446c2a55ebdf4c59d61c748bd9f11d0d43aa
- SHA512 4a01fe1645ca948419c2716e78c650363a69bd3e93248e84bc5572ea1f92a947564ec166fa494b2c13268f95235ac4128c77d166a7a41b20ed2bc6232c212253
- SSDEEP 768:+muYRe/bMAueOLlDtqkKSKfaOX+OttHDKA/5YiDnD5ALa:+muYM/bMAueOLlDtQS0afOtZB7DP
- TLSH
  T1E4234A22DF81C1B0CE8EA7342999CB4F157566D0DBC063E3E39D966D09713C1AEB3284
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  extraResources/boost_locale-vc90-mt-1_58.dll
- Size 364KB
- SHA256 45d9a3e274de563b94d98f51dc2d88dcdcf3eeb1d675e9a428b82da180dfc495
- MD5 6f8065ef01e2f3fa7e2fe4c4bc7f9189
- SHA1 773c91fad9021cb75bfc15b65aeba9b0585117b7
- SHA512 2aadab22e0292b10451270e10cf7da6672f870cc6c2f3e3ea357e0907e5db49945b584b3ecf27d47df5671dbf54ce888bc49fd23c10c8938b728d86ed07b0839
- SSDEEP 6144:wy8gdCWHHPnTPLB1qzGL34qUt9RvP6OI+g4gUwAnlwGhuKYOykza:wG8S1qCL34qUvRvPtI+g4gKnlwGhS
- TLSH
  T18C845D91EF0F81B2CE8F11742825576E52BD79500B90CBF3E74A9A5B0E233F96937254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  extraResources/boost_program_options-vc90-mt-1_58.dll
- Size 335KB
- SHA256 ee3c5b8f07388dca3b167eed6b4172a0ef834bcfbb5eda7033f51c0e4ec5028f
- MD5 e3a7b44badd9ea6ca5f6a555480a55df
- SHA1 4e8c3dad042bd8684ec2aa8bc6c61fd5c2befa1c
- SHA512 3bbc91cb2e008cff971b07882c30814715cb65e07ebcd919f65d616fb5d5feedd3bf6e4530ec5d1649c288eede9389a88323d0bacabd4464bd1a5aac7e947d9c
- SSDEEP 3072:PafTjiIGCbi4Mp7d57LZevMCWzy3NRWjmhlxBjOyB5XbVGfjdWmZ:yfT2IVbihLDD1mhXBjOyBR5AJ
- TLSH
  T12374D811EB1FC2F7C5CB37F0648A89196334DD80BB1897E3919EE66B4EA12CC8577590
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  extraResources/boost_regex-vc90-mt-1_58.dll
- Size 712KB
- SHA256 631900be4ad89841545f4bd7961871c29d4ef421927b79ca9db315c1f20f292d
- MD5 004d16ad88d753ae8287f2aa6c3ec6c9
- SHA1 4ef66603fcd69e9557377632394d76cb84e9233e
- SHA512 5306d285f72cad5c708fb8647c11c89e3d216eed6150151b905742239027a30bae3bf48dbf9f5a2aa4023364f1810c63b8982a9dc972fa73f73aa65ef2cfe257
- SSDEEP 12288:8gR5mt76tAbSaR9lpurfWRkcmvWEXKNPu5CA+bzJji30XQV2bDFfaJWMBszyaJ+1:rmV6abSaR9lpurGmnb+XJji30AVeYWMn
- TLSH
  T1BDF41962E54785F3C8C673F0D8C466592A795E82EF59E7F3F34CA12A1A922CC11372D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  extraResources/boost_system-vc90-mt-1_58.dll
- Size 24KB
- SHA256 4b04901b0b3e5a151e16bbbeeac80247fb934eadaf9fed9675976eb139e53e32
- MD5 fc48efff3bfc5c15c4d904960a3841de
- SHA1 8538af00d30590233cab543ce177f24095bdec7a
- SHA512 c9307c1474a06f84717f2257601a401060ecc3dceef5920795d9f732e48cb6745eff9dd6453bbcfbe956680e52765e9245b2735a39336505fcf8e08d4d6a0462
- SSDEEP 384:7iboYj2uqTwCrfV927EaOyihpI6dHQIYiosYyuq3xy8RbmL4nNyZe:mbohuqfrfV927EaOyE95YiDma5ALe
- TLSH
  T1FBB24A124E00C832DA5B9A3235C5C136EE7D28821BC1E1D3BB54971ECFA6BD17DBA16D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Manipulates Digital Signatures

Drops file in System32 directory

Adds Run key to start application

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32