40d16f68be15c27853dd37a8172d9cfe8516d07cfb0da484079f397155bd1e0c

Sharing

Copy URL Twitter E-mail

General

Target
CrossOver_26.2_Soft98.iR.dmg
Size 385.4MB
Sample260716-phay4scz8m
SHA256 40d16f68be15c27853dd37a8172d9cfe8516d07cfb0da484079f397155bd1e0c
MD5 b7aff8eb0dbd5661111a1a5402a98a03
SHA1 9000f0c905a2a17d56ed3435b2c4a471aad90f0b
SHA512 658129d38ec6aab8fb4d8a042f01db249ed0bf49e72ebc0f0039d80354116b261c0c763355edf6a71e0ed63dbc8ca2ce3f7242cb1a9b8cbb932e864e643a0337
SSDEEP 6291456:ytwxMVHOjjad64VGUbXC7wco7Id3AqVubBI8Z3vnbyPzHuy5cOdyJ8j696:56Hyj14wIXuwkVq//by7uy5cOljt
TLSH
T16E193371E1B4545EED6F98369620BC40CFA62EA39583000F65BF335A41F7BD2839DAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CrossOver_26.2_Soft98.iR.dmg
- Size 385.4MB
- SHA256 40d16f68be15c27853dd37a8172d9cfe8516d07cfb0da484079f397155bd1e0c
- MD5 b7aff8eb0dbd5661111a1a5402a98a03
- SHA1 9000f0c905a2a17d56ed3435b2c4a471aad90f0b
- SHA512 658129d38ec6aab8fb4d8a042f01db249ed0bf49e72ebc0f0039d80354116b261c0c763355edf6a71e0ed63dbc8ca2ce3f7242cb1a9b8cbb932e864e643a0337
- SSDEEP 6291456:ytwxMVHOjjad64VGUbXC7wco7Id3AqVubBI8Z3vnbyPzHuy5cOdyJ8j696:56Hyj14wIXuwkVq//by7uy5cOljt
- TLSH
  T16E193371E1B4545EED6F98369620BC40CFA62EA39583000F65BF335A41F7BD2839DAC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  CrossOver 26.2/.DS_Store
- Size 10KB
- SHA256 0fbd4f3e8ab358ef23f3f5517720ef41b7156a968df9a0d22caf3096769cae19
- MD5 8420baef87dec8f16e5406a47a88922b
- SHA1 20e22917053194474c911922b983d0b2d2668384
- SHA512 3557d3df2f93243967dbcf65c9858532f7a987622666febc6d55910356444d91b0a67e6ca33c3b76be2fd4cc3f1332528df35076494020fb5419d06506a4dc08
- SSDEEP 96:2gKyqZ+3TXike0k6p+ujdILknQi6p+ujdIi:lV739kkRk5
- TLSH
  T1B6221206FBC98C9EF52B1B7595D347203B28D150E7A68707736E75B82C1139A0F26FA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral2 behavioral3
- Target
  CrossOver 26.2/.VolumeIcon.icns
- Size 376KB
- SHA256 f0167881a1b0af33217816ca50d48345b2767bf60c9ca38826e2d8fecf9cce94
- MD5 61f79527e373ea03ca7728d05abcbd40
- SHA1 54497b3361d9cc88fdf5a84fa4319cdd89bf7cf4
- SHA512 68945ecd528a4f02949a244d5777c0eef92aca646a603a4ff509f755fb099c9ea151db78532f697d140315a62ab2e79b921b286115e2249a7bfe40cb8fd235c7
- SSDEEP 6144:lFXa4RoBgHi5NMjukHi1nMhae0QnPHRkeTcDjT+rF9bPDppHFsrf1AnNyP:lQBdMqkHi1nMMnLD0tPDPHyrf1IN
- TLSH
  T171841302739702A8D1CEAF7624761B40CB606EB9DF02123D58CAF439E77675C8C69BB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4 behavioral5
- Target
  CrossOver 26.2/.VolumeIcon.icns:com.apple.lastuseddate#PS
- Size 16B
- SHA256 f3f12c5e43f532a6660bfb707f2066ae993538025a6a4bc52a90e58a27a8134e
- MD5 19224b829285e4dea082fb89560695d2
- SHA1 a1660f0ea715319e9dd8c38689bbdca4fecfa57a
- SHA512 4c1fbb792f5d0c37cb18033f537df2ccdf0901cb6a840e371089897fd161a64eac061dd03cc270f5bb0002d16c177be67910bb18c91808c1259debe4212d935f
- MD5 SHA1 SHA512
Score

3^/10
behavioral6 behavioral7
- Target
  CrossOver 26.2/.VolumeIcon.icns:com.apple.macl
- Size 72B
- SHA256 bf87935551fe79b8d6161ff5f7132ff1899883f75b0fce5d64ffe9b4715a2c67
- MD5 06255dbc70d5aec1bc9d06fe14789a9d
- SHA1 985052dc8b9fd8c95535b1579402c20b23e1ca53
- SHA512 1107481fe3ffc792540fb854b9dad9aee56b86a242ede045e0d0e87ef51ee0c92201570fba90b753ce2776372977e5d7c3f552527d67446f33f59137debb3f96
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8 behavioral9
- Target
  CrossOver 26.2/.VolumeIcon.icns:com.apple.quarantine
- Size 22B
- SHA256 53a355bf83c012a82a6f727b1eefa96919791e3a4fb9b64f1cbeaa0bc4505f8c
- MD5 a200809dcff602f0873c924e4922e805
- SHA1 688116e29625cbbd2f60628ea97cb8ef3d5bd0b6
- SHA512 e4b652e52188568ecfbd294ce1b90b532129b3bd596cb15dc4d3f88738fc2aa454c99d1e43bc7c2bb9dba99899fb5b1bfb112a18a78a398d6d0c4cf1e0968bbf
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  CrossOver 26.2/.background/bg.png
- Size 86KB
- SHA256 9767cbc6f03421fb8abb858eae12fd63790f99e2344d907ef0986ea8330b439c
- MD5 ccccdbebe8a63d52a5634c575562a7ef
- SHA1 f22b7e39aa29a01e5784d08aae8557127f0bee75
- SHA512 df62a14b093774928a50d69008fc5cd9d52088660d77abd6a457fe24d0413db62e6cd7245d4edabc035d41a0dcaced0cc38a2512bc2e2820b353451de72229e1
- SSDEEP 1536:naqDHpS/84VwZCQDfNucLv3Kk8OP3B++9d78yrtCsZ5an0QhIiRs:nO84uCQpr8KNddVHoa
- TLSH
  T13A931267E764773FF8E26777DABC46FC5C5B2616BB70E49014A0A3902A88813B50E0DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  CrossOver 26.2/.background/bg.png:com.apple.lastuseddate#PS
- Size 16B
- SHA256 fe3875b849855a5b29f469c6e9c73120942e369c6d91c4708e2efb39351fba49
- MD5 d8958234ceceefa7384b401e23f240aa
- SHA1 1e0326a42380ad1b8e493c360b38f947f376dc73
- SHA512 fab0e92069ed34b964c4b10609c78302a9b94b6d6a598050cf4441a21ffb0653883307088b6225fe6a2106a8b2e451c8762754942cfd6067ca516939f2bec13a
- MD5 SHA1 SHA512
Score

3^/10
behavioral14 behavioral15
- Target
  CrossOver 26.2/.background/bg.png:com.apple.macl
- Size 72B
- SHA256 b51d79f2cfffaf62a5cd2bc33ffecbb8c007d03b8e705222d283525e88eb77b5
- MD5 aff632836c1164c3992766c106b57f8d
- SHA1 304c76f5622207b015bd917088978bb010db73a5
- SHA512 d6e0c235a5a1fd4c7304dfc7fd0b3ce138b00a6731f9e71bfd046034ca32708a2a3e0621d0dd4c3c23702841abebc7403275deea01409a68a5265edf803bd93e
- TLSH
  T103A0044C34555577C335447C03C0544143C451C410C0C10F3D14D17011044D01D40100
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  CrossOver 26.2/.background/bg.png:com.apple.metadata__kMDItemUserTags
- Size 42B
- SHA256 aad02e1bbbb00b10402fb9abc3fb93c5eee7df168946b1f75bbdb510b6763a1f
- MD5 3d641df340a8a0121793c0a077da61b1
- SHA1 44668804d8d14412ba09d3625109dfacb70e5476
- SHA512 e67f6a03bd110b718bccd0519b71db6c9473e4cf4eca2254cd81ef703a768ef81300e173010ab184657efa3f67284d139f23afcd6e0071332240f6195a0fcf77
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  CrossOver 26.2/.background/bg.png:com.apple.quarantine
- Size 22B
- SHA256 028bbbaa4e930a80e219115e7d36233868f128d3fed2c5c8c3b8ffbbb408fbd2
- MD5 5ddf174686650e468949ffbd37da2375
- SHA1 f066f2210fa52581c6b3977096d0add2eac87614
- SHA512 71663216854a30de892a4f9150cbef9890c1e773b66dcdb91d5f0f69a3be2762d89d6da67bc84cd03c4e348dbad79da332330e008d532276bfd19634df87b854
- MD5 SHA1 SHA512
Score

3^/10
behavioral20 behavioral21
- Target
  CrossOver 26.2/Help.txt
- Size 1KB
- SHA256 785735620545afa1a8354b159c2cce0aad84534b2600b47015bd11918e4cfc7a
- MD5 e64906f0344c9c0776fc8331f2b6fffe
- SHA1 0553b68197e057b1ae4aabb0c499089e2edd4f48
- SHA512 82ef3a4cde7ff7e205a569ca5175805342fac1073e1a9fc8f45f12cbefe709f199ecf7a8560e9956d1499c825e2c4787c70679d5fe164d4d6b42c4f7d88a4c20
- TLSH
  T1E931C0589DA605DD0602756FEC09DE4C7EFA80BF3BF6632600E8A81F3693524C23685A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  CrossOver 26.2/Help.txt:com.apple.metadata_kMDLabel_dnftphl3a2xxyn2rmlkjb7ynxa
- Size 89B
- SHA256 2a341555048df0a37df3227d9f3190c57751114f605e8c0456f0aa4672bdb829
- MD5 91d7387467af8025b34179eaec85926d
- SHA1 c6cf933558aa7c77a79959cd7461d3d5c3d8ced6
- SHA512 4554e1ff477d0ff2b243b38e07476b87a31656a96d621245504e4b6e8a22d7935a5858e0f7f85ce65f9a9724b6fd2b1a21a9b42798e217f105db1db05355fd6e
- TLSH
  T10CB01231144B8CE841010429500C05B075498427F21BD191C49E73CA104006054000AD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral24 behavioral25
- Target
  CrossOver 26.2/Help.txt:rsrc
- Size 269KB
- SHA256 4de8692d088a30eecea856d70870dd475c30a462607c8f80bb9b41d6ffc70834
- MD5 2dfe4fc75468c97dfa2516288e6959c2
- SHA1 45b290ff6034d2fd299d5510f9c17bf962613bf1
- SHA512 794d897a2a05468c5244553a971bd0269bb08db58ffd2da3ee3ea99c52998677080b9f5991ac4535c10e892350eeed41c5f79c83d5f5f1982bfdffc873f2d85b
- SSDEEP 6144:dpN5TSLG3NVtQW6kkkaJRiI34CidYmnoqyDY:HHTh3azNJz34sZqyDY
- TLSH
  T11E441258060ED491E308B67F0A3901A06B26EF01AFB58F6F3698F131F4BEE574D4691E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26 behavioral27
- Target
  CrossOver 26.2/Manual install/CrossOver 26.2 [TNT].dmg
- Size 370.7MB
- SHA256 63f0179129c681a853be5ad957795e62c28982d33e2ef81af8acab3ebf183734
- MD5 33136d96bf4d6a3d7dba472828f5d7e9
- SHA1 d3792e15cd7b9686f4d1906291d1c9916ffc3ba8
- SHA512 26195b8e7340e3883263fd7fff565ada2db57caec2b891351289aefb00c6ce13aee78e5d01fa294c75dfa8f3e8c693b5d5f47983340ce59cab1a88905135b15a
- SSDEEP 6291456:PwxMVHOjjad64VGUbXC7wco7Id3AqVubBI8Z3vnbyPzHuy5cOdyJ8j696:Q6Hyj14wIXuwkVq//by7uy5cOljt
- TLSH
  T1F0093371E1B4585EED6FD8369720BC40CFA626A39583001F65BF039A41E7BD2839DAC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  temp.img
- Size 1023.1MB
- SHA256 eec5f459d88292a48db6263fccfa7df65de55e2fc7e1bad77a1812af841179fb
- MD5 607a1bd20a74a7c710c62077b078affd
- SHA1 424532e0537bf2eaec0145db3b88528f7f01abf9
- SHA512 5350871944d6ecdb49a72f0ff82a3e01480a23f5ad83198e880524d1952946e0be3c6654bb073666b724595f17970a45dd8c78241858786c822092b9c460d709
- SSDEEP 3145728:es6nkZyVI4VIB+UTmQWjSfAMDSkUGm5MZ6tC525yHv4No2FywD1nUy1tkBs7nK7:es6p+46aK6tSeo8ywBnUy1tckK7
- TLSH
  T157B9AE02B3D350A9D46B9230A57BA7329731FC149631DB6F7648FA381F72B909E27712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  CrossOver 26.2/Open Gatekeeper friendly
- Size 1KB
- SHA256 45f8b43453cb19232902844bfde4af6471f3762880f23e968bfca28a33c26817
- MD5 dc9fb0fdb63b80375e7fdd5f67022847
- SHA1 55437344bde13777a3e309599aa6c7930721d4d7
- SHA512 59f501c0b2843254f97e1c7492c295fd0cb41ca024b92cee617db471ee815aea823969381c95a7ab7a581957e2964673e3e0336ac02233d7dc0392cadae78fd7
- TLSH
  T1FB3111B2B259152C2502127F9F45FE2E7EA781FF1B956B2840801C7A22D2068A57E945
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32