6aabc16d7023a6d6bbe9b950591d1f128c1c543c1c8fffc3a337997353c9d980

Sharing

Copy URL Twitter E-mail

General

Target
azahar-windows-msys2-2125.1.3.zip
Size 55.6MB
Sample260716-ns6cbsfx91
SHA256 6aabc16d7023a6d6bbe9b950591d1f128c1c543c1c8fffc3a337997353c9d980
MD5 6509bb146f3de13075c9ad0ab271d329
SHA1 558cf993b04d5c74228988141e1be6c99f8c0038
SHA512 df82f76a717f4f047aae454cdc8ccfb0e49a167d7836b52a8887a1424f3356b68ed6a15debd46b87c28dddd031bd36bf86f6ff31ac7c28e6a462384e342f41b9
SSDEEP 1572864:R58R9J+UC5Ixw6tzrcu0e85v2vKeNRhMzY8RYN5CQ:Rc98UOI1rWesyKEhWwj
TLSH
T138D7339CE57D5FC33537B93CC8725AC1F98895766D0A8A1FB90B03CA85C768D40B9A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  azahar-windows-msys2-2125.1.3\Qt6Concurrent.dll
- Size 31KB
- SHA256 d3e06a5012c780d0bbfc6fad848ac444c5c921af082f1f4af84bb5ded5d74ff2
- MD5 a0739a05aa973f787f73dcd59a437ce6
- SHA1 60e724e91d203aea0be9e10993127866b3a7338e
- SHA512 1e1a1d1aecf05e9ef20adaf63ce61e13d88d896077ecc8d982e4eb0ed331f5cfce1a95aad7a9f4896148e92ef96dbef3cce9648043a23a45dde139c7b7993765
- SSDEEP 384:Dl3Io4u2uFVlp++Uxl/Cna7tcfq1UB3PtDGcFy7Y:J3Iozs+UWnYtB1UjD7M
- TLSH
  T1C5E2E9A11F5D499FD8C2EBB5C4E702BA35B7F9011B2B86DF0580963C1E6BBE44631B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  azahar-windows-msys2-2125.1.3\Qt6Core.dll
- Size 7.4MB
- SHA256 e570e239af6abdea1e930dfb3c0d568c1ae3f87c34a4b02fd213284219050b34
- MD5 1a20685496d844497fabfb94f24d09d7
- SHA1 3de58f39611d6c52e349b5770c896562a6e005fd
- SHA512 ba9d045f9900e83c059f3a731b562b636dec3ce42e9238da60bb6f08dcad03b6cc40a603764f5f66b00815462e3800c4f6a31d0017b82ed7de97e8b91002da02
- SSDEEP 98304:92vaQD+nXtWLRX8FNF2uMcZdVKFdu9CwJsv6tb09WIsiWvGlNWP0EKXgXCFlW7/:9kGxyuM+KFdu9CwJsv6to9
- TLSH
  T1C4764B42B28691A9F46DD334DAC72322F9327C828B3669EB47849B356D67BD4173F301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  azahar-windows-msys2-2125.1.3\Qt6Gui.dll
- Size 10.4MB
- SHA256 af7db34e128100d485a1bc49f28a4704186a40552bf3ee8d0fe7863e9c7e392a
- MD5 2f060b0fb92670c5a962e3884a20db85
- SHA1 8938c7a2a1084365a0a9647e25e3262f6495789b
- SHA512 f859504dff9fbb38a772ff9671700109407c72f1946511d58cc71ec030543c6bbc997633e45a949720fbb0ed2edf0c4430029473f507fb8c4439d8e6efa76a61
- SSDEEP 196608:XPv1+wasi5GUXf7KfMBVSYtkpCycEv60/4h:XPt+wasi5GUXf7KfMBVSYtkpCyjvQ
- TLSH
  T1F8B65B42B64295ADE41AD6349AC76323F9317C454B76A9EB43808B393FB3BD0273E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  azahar-windows-msys2-2125.1.3\Qt6Multimedia.dll
- Size 1.9MB
- SHA256 69518a967178a4676009adf2095a979358a79b8697d4f0ee3cb740786d49f6b3
- MD5 96ee72f232c7db5c10a05f3796124e4f
- SHA1 d39e1455a2cc72d39720e63e28e780544c7ddabd
- SHA512 48f7164b7a4501aa613bc0e90c3193db3e076a173877569144f20041f19595ab7b8ea3042c071521f7da4ab5cc66a98d960ced2195a650b54cd592534cd48ae9
- SSDEEP 24576:01+6P9HHa7tlHLq5hz9CQzqv2/bu/D1OZ9+iN6G+fl1RyUj0d:0o6hY+5V/bu/Do3N6nRyUj0d
- TLSH
  T168956B52B6419A9FDC9AE379E8C74322BA30B8514B3399DB5380867B6F67BC1173D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  azahar-windows-msys2-2125.1.3\Qt6Network.dll
- Size 2.3MB
- SHA256 900ff1b0cd76d698321e40f27da96c618275493588bfd76148067a227f26548b
- MD5 90421c7e353160555fc672db3e456c01
- SHA1 39d211789369b0148628288e89ea4779804c3dab
- SHA512 6cba6712d27ebd41d398f5a1f4a069ad2c2350b89462b812d9aebdd8a2dd10bf03e873e0bc7ccd45f86b0d758dbce03260007a8989abf01590ea074cd8d10f9e
- SSDEEP 24576:2ujxoGjyNlIQgmsu5lZaobxC45iR43ZuR2SE1CqZd/W/aZq47S5qxk6bjb:Hjxbj+lH575mECTkZukS6ZdOYFxksjb
- TLSH
  T120B54A42B64195AEE85DD634DA876327F83578418B3AE5FB8780877A3E97BE0133D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  azahar-windows-msys2-2125.1.3\Qt6Widgets.dll
- Size 8.2MB
- SHA256 d3a62cfeb078b83cbb0e02d7ac68e572eb341be904fcee46ec901b4853c8fb38
- MD5 80af5899eacd1e69169b9032669c5dbf
- SHA1 ea56aae61e7dc17497a65523f7640c981fd147b3
- SHA512 80b181f6c9f748b67fe8e0855294423a5257b60fccdb195ad4118a5ebc2f2e4ced4c6f245444fe191d9b82dfa042893fb2f533cc84046da24902cc86f98982b0
- SSDEEP 98304:RP/X3bcKBKUUg1bslOlmgokr+9/ufei0oypiZCXHTyo3fBB7c1fL:JARUUmYcG8ZCXz9vBBm
- TLSH
  T1F8863A42B24295ADD85ADA38CEC75323F93178858B37A9EF468047393EA77E0173E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  azahar-windows-msys2-2125.1.3\avcodec-62.dll
- Size 17.6MB
- SHA256 f86d23a1e3eaf90070a9649f471e6ebf6d65047258bf6228ce5f32923e091f45
- MD5 09f6a2bf9ccde2b54e37d3b339723684
- SHA1 2a220d5cac6782a9d30090c88a367d10e5c07cb8
- SHA512 4e7fc7cf08c73dbe0036e6259ea9cba55babac922bae310a259d24d414fb35d1a2bf3cdc40acccc5fdc72ef0792fee2008de45dc9d235d3df35d3c4b21ef2f4b
- SSDEEP 393216:bppsY/tug+twiVmRoyvBHgdUuuGZ6MwAX2Ql:VKBup46Mj
- TLSH
  T1A007AE4FF19350E8C50BC57082ABAB33FA3434AD85157CB727A496347EB6BC06A59F48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  azahar-windows-msys2-2125.1.3\avformat-62.dll
- Size 2.7MB
- SHA256 75e63a657617b461a934d94df4e53381e9c30a7bf9683cc921bc4062286649ab
- MD5 617debb990cc2f6b824533a2fa4d4bbc
- SHA1 8efc21d584fbbd3d55ae22a6acd1a12d65944763
- SHA512 c1778504b6506f6fd02ca718872a3e04dc56c55d6d182dc742412ee272dfbd4a4ddcdd0b8bc98c37ad35d4a93e55ec70cd724c80d940a913c2fc56a77ba7dcad
- SSDEEP 49152:3h/K1RYSP37PcZWEmmtWG8yuZf6WJ28XAJ6nKmgTARQ:w1V4J8bzRKmgTARQ
- TLSH
  T1BAD56A03E18215EDC55AC275478B6722BA35B4490B32BEFF1664C7392F65FE0672EB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  azahar-windows-msys2-2125.1.3\avutil-60.dll
- Size 1.1MB
- SHA256 96b18a7b0a6ba3914c68ba2f203a5b45ac7817233a3868ebd3b3429843f04ded
- MD5 9e08793b90635f47a741af5c583102a7
- SHA1 6815017fd5c7cbe205b372ec843700bbf237fcd1
- SHA512 32d5d859d7b1df0d72f3f14af6907c6212f1b3768f5741d439a876173ac3e584f737fa0fe87b1422d884c8a425f01919fa9f7e70e2b656ca75091e1ac5e4faca
- SSDEEP 24576:Xs//rRNRXBih9a8OtJk/Xm61N/LBMMy657WnFz:Xs5XUh9a8O7om8pL7570Fz
- TLSH
  T1B8457D02E5C2556EC447C270869B2A06F2767046DB66BDAF22918A343F34BD07D6FF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  azahar-windows-msys2-2125.1.3\azahar-room.exe
- Size 3.7MB
- SHA256 f9de0dd7fb587fcde661e7a1c9583bc4813a822fa3ae24eceaa13e93c3d69724
- MD5 e77821517ee268421e0a3fe84febdd10
- SHA1 12b4a182694a1fcd565ea2ca5ee958e1481751fb
- SHA512 4f7dbcabfb33307da8bd59c8654c58c0dc401e2f149350c097f5aefd2c5bb72dcd3f2ad6d902d3351dc871f671c0681e2a255a87cd3cec021271f68bf1bb1271
- SSDEEP 49152:qt0C9J4zpsrVCR8Pp1Jdo3+ay/XZC8ip2lXIsX+cZllJEdHa4OJ3DVwf975pbx7R:qX9Jyy1zo3WXZz9SHaCf975XiO
- TLSH
  T134065C47E28580DDC45AC17443076222FA70BC995731BEDF1694A7312F7AAE46F3EB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  azahar-windows-msys2-2125.1.3\azahar.exe
- Size 34.3MB
- SHA256 86e255cff8da9438c6abc6f3c90a004092427831b47aa11400a1739c1cfaa120
- MD5 66ab7c8eaa9f03ba53ad9b71b7ee7af1
- SHA1 d8b1c2edf30abc21220b5f2f3bec15d7265d1b38
- SHA512 ec8c950a2a50d8917c73b9ef512ecf94cb1916ea52dcff5d42ee8566b4bb30408cd354e9b1b333d81df902fc3c2a6be399451a413c5507886433870bfdf31c26
- SSDEEP 393216:qVxE8uXq7sgA4B/9hg/dlEHFwoxjlQrM:q/uAsgAmg/LErlQr
- TLSH
  T180878E47F28295CDE81EC1B5C6476325FE327CAA4B207ADB199067602F78BD06F3DA14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  azahar-windows-msys2-2125.1.3\libb2-1.dll
- Size 44KB
- SHA256 7fd416e76828a2b99efca3d6c3eeab22b1cd2c51df74d813699cc68dd670277f
- MD5 d40e19a18ca24168cc6baa179f806b94
- SHA1 438dbe02c84159829b4bedcc5ad223d479469311
- SHA512 5b998f2376e8d835da5354693cf4104a39adc6fbcfc010ea16d49e440fcc35a4cb7f0f37dcc6022695fb7dc9e0fd94ba17fbb2c3f61784082a1749573ee1008d
- SSDEEP 768:6JxIcq7eZ0LM7PdqLVAGVEjc/4GdDtH7/14dcgb:Yycq7eR7PdUKLF4T1Acgb
- TLSH
  T14F13F942B2C26A5EC419D2B8D78B7BB7F436F0558B32A1D747849D700E61FD02B7BA09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  azahar-windows-msys2-2125.1.3\libbrotlicommon.dll
- Size 141KB
- SHA256 2c21a9ea0c965904b58c37237fd4e33a4cf90c5b6320b0f7e17f3d5304bba985
- MD5 a7976c4bdc2f0fc6f4edc4090e963433
- SHA1 9ffc2bdb29891ddd2b25dacd76cbdd0444e9fb42
- SHA512 969a416cfe94b454679bd97f2aedcee73784a748e5a670028bbc39baa0f63124a18277ec75656df8aea97334857b681d1a5781ebe0e4caf8d48eb55a0911981a
- SSDEEP 3072:uc4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBdBgup:P4AhdNorGvHdbi09GJ7Bgu
- TLSH
  T1D8E36A61B305073BC61B627AE4966BB9F33581B4936305D3A4A9026D24C3DE4873F7EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  azahar-windows-msys2-2125.1.3\libbrotlidec.dll
- Size 60KB
- SHA256 53be248c41da8fc7ffc9223b9b7825a0a6e825910769cec9faf88e3cbb791183
- MD5 877c8e3bdc5217539fc6b261655e3546
- SHA1 8f992b9a0be6bbd50ad2af622c1355f76bb3f5fb
- SHA512 eec4fc8e05bbd78a9021fa386b4f3e881e87e8ce8e4f1de4412a0baf0b511c1b03ead80f286b6650efd8b13559a542b6ae9d898d18e44438643603c1bb08d228
- SSDEEP 768:zwh7gkSiK7i8d7D3thHMe6GX+TN+xtvzFGSUS9MSgH4jT4yazQxARbYs3YF/vsrP:kh1K7Zd74en1ZGG9M8Qu/vsHnG9SXDp
- TLSH
  T125534C0276862D5EDC42C23893A36737B57ABC415727D5E362A0F5312E237F06AB935C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  azahar-windows-msys2-2125.1.3\libbz2-1.dll
- Size 96KB
- SHA256 22289ed41efbe633f798047de836b31170336e5e40e7e7b586c915bdbda7fcd9
- MD5 b843434a8eae82adea4f9eaa2fbffe47
- SHA1 b34aaa305cfc1a4936a88592b5689b0c978ffaa4
- SHA512 9f7c152c3b7ef52c0b3131d865960f8529bfe43776bfcf00c668fc41258e4ba4fcecb09888a99f77634534b42202d57e71806b808d9efe9ca6125712b8db7570
- SSDEEP 1536:XbxAQ+Ny/Nl+cBvnbHGFQAa0NkQZm4BZkd38pR/yjr/wRFULiQW8TbOJ:LOQd+cBvnNA1FZk2U1TbA
- TLSH
  T175A32926F0D25AEEC856963491AB473BF9387498070165F3EA60E7301F71FE05E38B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  azahar-windows-msys2-2125.1.3\libc++.dll
- Size 1.6MB
- SHA256 8a9deaac6d2f4d2de468a544d1f35cd0dd4bcde03cda3cfb76fb9674749828d4
- MD5 9b98f030712242522b2f1c4b1d05c38d
- SHA1 4e06684207ace6683e7a64d35531d291adb9cfc2
- SHA512 5177b795f5a221e66ea4db5b8a19f41035d64f0a7d4eed668cab0fbe0af21f2f2d269855254802d8569be27a23e2651c25bacf91b945e48b0eae009a13215a73
- SSDEEP 24576:pnw5KpILY6ROpzvpd+M8xpshSMXl2huR7lWSLuYz/aLZ7QlOBXDR6pPugRwhb:pnOmpzvpdYMaRbDRsG
- TLSH
  T131755B1383E2C95AC8DEBB7892C7272BF334BD1017F659DB5A5483241EA23D6963DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32