fcd0001889f2b7d1355f4d09031d4d52875b28ed2a72519d2eabb879991f29b9

Sharing

Copy URL Twitter E-mail

General

Target
DiorSyntax.zip
Size 131.9MB
Sample260716-rm127sft4k
SHA256 fcd0001889f2b7d1355f4d09031d4d52875b28ed2a72519d2eabb879991f29b9
MD5 7d171ecd9f8901b09da748381be4317d
SHA1 88c4c1e178c4984eb0611bf03769f3b2bf565910
SHA512 a3b1b26fcd5271be61cb38706fce8c544a8dc822b75ea3cc93653918dcb729ebb24dd547e1787518cb6e421984810ca6eaddf3f2988de58cf835de64d4bbf61a
SSDEEP 3145728:iqACfHJi5mCkdq3fcmdgDlDxAu+pQeeZ9bVhfGJuNz:iqACfHpdd1CucQzZ9Deyz
TLSH
T14E6833D150117885B819F472ACF1AB406374797CB0192CA7DF76E29E38E3A76CFA3909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DiorSyntax.zip
- Size 131.9MB
- SHA256 fcd0001889f2b7d1355f4d09031d4d52875b28ed2a72519d2eabb879991f29b9
- MD5 7d171ecd9f8901b09da748381be4317d
- SHA1 88c4c1e178c4984eb0611bf03769f3b2bf565910
- SHA512 a3b1b26fcd5271be61cb38706fce8c544a8dc822b75ea3cc93653918dcb729ebb24dd547e1787518cb6e421984810ca6eaddf3f2988de58cf835de64d4bbf61a
- SSDEEP 3145728:iqACfHJi5mCkdq3fcmdgDlDxAu+pQeeZ9bVhfGJuNz:iqACfHpdd1CucQzZ9Deyz
- TLSH
  T14E6833D150117885B819F472ACF1AB406374797CB0192CA7DF76E29E38E3A76CFA3909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DiorSyntax/DIORSYNTAX.exe
- Size 9.5MB
- SHA256 8d1d20dd4271f8f5ad47b5480e2431dbe2a299bf33433175e939bc9b2c8b1579
- MD5 0e80522dac9623aa20e2f2e18843dc63
- SHA1 0a494dbef743eea61693e78a1422c5f391448166
- SHA512 904386fd64e7a5c0c71904b75458b51e70002b973e5d70cbfc87394dede5c390820195844783dc70d4062464d54d8c295de4643a801efd21c3f6876304393d03
- SSDEEP 49152:eNkuRBrlu4O5JoIN2IxuyxEBc48dHAV2gvZ2MAOG3GQlcjpYwJZ1fFmzcGf9uHAO:52sZCHJZnmzpVlG32wK
- TLSH
  T1BFA6B55976EA0091D2B9C039E503972BED713099433C95FB93818DC9AF707E8AE7CB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DiorSyntax/OffsetsUpdater/DiorOffsetUpdater.exe
- Size 11.8MB
- SHA256 6925df0e49811cf6c638cd68f2ab34392b2fc5535d8f72ecd67b5c78b1cb7529
- MD5 b5d7cb65ba66896d0f8f45c1cbe4017d
- SHA1 01747bbef7221bd84efca1a339b8983ba599adbe
- SHA512 cf984c1000944f2c9d7640896f30d1c095c25a98d3e15acc63679c636e8af4b3afc992f7bc863fc1eb23a5ec30180ec6cbcca6cbf3f511b93f85920c51922977
- SSDEEP 196608:uAAE6PkSTYtbW897G6x7eovq5XMP6PzFc4euky97WPHsoq1bRjMFQG:xFu9U1bdq1B7ZeXygPHsoq1bpiZ
- TLSH
  T122C6338523960991F89FB33D65C14A9BC2E1B4201771CADB1BF08EB82D672E5EE31F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5 behavioral6
- Target
  updater.pyc
- Size 24KB
- SHA256 a240bbc5fb12ab9f1164e1e9cabd8a44a9d8201cd878649a28be0648132c57e6
- MD5 dddfa35c4372d957db779623e88749de
- SHA1 054826694d8f3737c790fd561d85498b65a788a8
- SHA512 5d8297f55e99c8cfc0cb103cf1b00c35100872d9bf2a607cd47331f5c1774edc2846107264dc078df02d53e9b6d15114b91e89c247f474bc993a7a67c74f83a4
- SSDEEP 384:nuXN6jklv16uqZ4GJDRFa4W5ADK1L+WQBar+ZSJDYMWt1QZSMXVUjc6:u96YDq+sq/5A2zrpJDYMWg1Vsc6
- TLSH
  T140B22AB89910E473FEAAFB3E32E392516B720146B540C743E2785CBD1CE6265451E31E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  DiorSyntax/OffsetsUpdater/IMPORTANTE!.txt
- Size 248B
- SHA256 d0bf33aca7af7d216dd6d15b2de9c64adcb5bc2960a12838a4e18a2bf938b62e
- MD5 9d5f5a530907aaf65784324ffeeed868
- SHA1 b66be6a63fe887e79122510eed9783363372d7ab
- SHA512 a8218a4c67bd401b3666261a86a8168ba8132436984a93eb09d5970f00fafeca314cc8389e1d4b09443685372068fb5506d17e0b5495cdf00e4b05d8504160e0
- TLSH
  T1BBD0977FAC00AD042259C64CA832F4A2DB065CE63800C0B31A8FC22D0525F388F8F1E8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  DiorSyntax/OffsetsUpdater/offsets.json
- Size 9KB
- SHA256 7c90e9a42b9534bc9f5fa9dfdb9b6a9215101364504826afc586d5b0baf9606c
- MD5 7e48476b4816d24d962db05462b9839c
- SHA1 7e84a5aac47c216d5e8c61404b35717c19311c1b
- SHA512 291b6f7cc7d7a5abb2fe00f0315f6d4c74e2b4b6a7d3e7c0b8bf16fd790bd7ce669b6faeb92d74dd54db4102514b2147869624d6b6a03cc359c85d88e8c8655d
- SSDEEP 192:mI8lyeVzYmwxL9CsU2vqZr2bAE32E96fnuAIC5dvj1+UsD+W/1zvoE:mh9zUxLf4OQuh4v/sD//1zwE
- TLSH
  T12612782CDA608DA939BE63A4287C0707E620337751498A9B797C498C5F77E37018AF5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  DiorSyntax/VMProtectSDK64.dll
- Size 116KB
- SHA256 cd2cdc90f423c9d23ee55a242d68a1731c12cc69877de45e913646356f25b597
- MD5 5cb50b816388efa581dc9cbf17c50f15
- SHA1 7f7299786f35c9658795f5739bbc14bd50f4bfe9
- SHA512 513ec1464a2b4222115f2590579349263487ba2d83382658b17123f7688deea915e30c29b863dca75194b7f0e0c82715c590dccd919fad4dc8f0438fac22ab03
- SSDEEP 3072:dmcqYHq7Aiytzg2ScpvgJcG5sqYX6UyHdlBS:40Hq7AiyegZgJZSXq9H
- TLSH
  T14EC36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  DiorSyntax/ffmpeg.exe
- Size 193.1MB
- SHA256 6a059f42b85f54d9a413185d05ec16b7b5e85304af0bddd381d64a91be00adec
- MD5 4059aca3ffcd4e1c2cc3d3641f21484e
- SHA1 7339ed58c2ca9b0fb24310f57871ad1c7f2c5b65
- SHA512 813e6a4649615f834f02c6d3eef8775a04675251fa909bf9c2e5d6c8bbddfcd1f1196e56a6d76f2a205f88bb810e08aa8b96db2f2c3ef062a19dd7933c3fb097
- SSDEEP 1572864:Yo740alpY/dYuI/N4RZtB6JJu6R0vz0EUwdcYS/aEHBt6w5Hnflkg+rkVRJsZRws:mAgiKY6un
- TLSH
  T1C0A85C4AF5F34F6AD82B857C42BBB731B528F45C53119B272388F6343A12B605B5BB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DiorSyntax/imgui.ini
- Size 1KB
- SHA256 d5b2b147abd736977b3774163e80f573fd30eda7003bb99d50d822df50bed149
- MD5 84a4a72f3191c1411fb5e1d295bd47ac
- SHA1 bc1266b2105cc52a5755c09d33842c0611cdab4d
- SHA512 edf761ce4a07c8cd34ea3a3e76fe5b355bd2df689d477dfab1c4beafed60e4eabdf8b880a2e1108f938fd8e7a4a938b3d698e57630ed5f2ad8929762081634ff
- TLSH
  T13B115952733A052E91F2A498B73223D83B8EB741A447B0C0A1416866FF5B8B3101F2C9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  DiorSyntax/music/flow.m4a
- Size 3.5MB
- SHA256 eaa5cecbcaf2cb497e4e601b198f54e09bc9a608805b7b444b3c2171ffe744ed
- MD5 9f7e5ea5332d912c6f5b5087fec16cc0
- SHA1 db0271abcb4f1b81c50f2f51e4e3ff53873a3adc
- SHA512 f3eeec500689fa1992a0120634cae890a3190abd8b00b03b50e1ca84a0309ada0963996bab813a4d5ae84bb56bc42a5ac6c7383a248a27b8dd4b946d83f0efa4
- SSDEEP 98304:syQDl8Yrgk/r6SzORjPwsfu0PS617EWJMJHn:sym6eNJZ
- TLSH
  T1860633F493083885F543697368D0ABA4EDB9F07B108CD5D64820AB4744B4BF9EFA64F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  DiorSyntax/music/rumba.m4a
- Size 2.2MB
- SHA256 a9d050711b9e3212a7ddb0870ea5e2c2a8f164d73da1948abf061737579b768e
- MD5 8fb8e34af935fa8b614d92f2dba0b929
- SHA1 59d07ef5e3ee60febaed18a12f3345905ba8214d
- SHA512 237e1f2de52c1273326aa1430b141d248e1d6795901e6e25790b4eee65f78638518bfd969d89deacfd88cb0e76dabaf363981aad1fd37b142ef118e140c7b1df
- SSDEEP 49152:Pc0JwEzgpIQn8yfkqnd720OErUvxu3LuJmSHsN121DaM:Pt9QnRfdAXEgvxudNN12FaM
- TLSH
  T1BFB533BDAF105087F7576232F0D26B387860B0625399D5538003692E64B13FADFBADE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  DiorSyntax/music/stream.m4a
- Size 2.4MB
- SHA256 bd07940a8f6977afc08b4da5cc90130ebc0b1529f0e49e7016beb5cd381bb8d4
- MD5 3d803791df960794e72161c4c6abe7e4
- SHA1 5e09b4d85ff007f30e968140feed0472857653b8
- SHA512 2c70060330c9a2e498a4e4e5d1c070fc2524881a0c4da6604e3738e6dbca293aaa15fe08d2d8eb56bdbf854bacca365edcdf02b5b53ff2b21a5646927e15b306
- SSDEEP 49152:WA8kWpjQiQrV3Q59KI42MKXCSQbFy0i3WvrYB+PkjRvUBSYGUcWSUV2DO:W3rBwxKXIxy2skPEYSYGhUeO
- TLSH
  T196C533F63329B19FD3470172F4DC9F51E8A995EAA409B993201393AA00749E5CFD18FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  DiorSyntax/music/stream.wav
- Size 26.6MB
- SHA256 f1413c825198846d5e85ba0f5cf1bf860bb72027bd4c48ee00f7ed2479aca588
- MD5 abb6dddf7da6e4b8afc49625fdfa9c5d
- SHA1 dab3eac9f50ca712860f9c524318ea58e9a455e3
- SHA512 824276c3a8ce9966cd46b9e85b371f1e98289490f740c6b73a15d0d52d551546ae49d78572639071c1ada0f8b68ac3a4aa04ebdde6e625dd6220104e27160483
- SSDEEP 393216:xInxX93S0Y9cqvI26CP91jDzJLhIzB9JbaqETY4wr8qJQ500dzIkRXCQskJNYI/z:iaHWx/Cl5RLhubHJUAQS0dzujDI
- TLSH
  T1B6573346D4C079C1EC3D877149928EB803377A576D034A09327CFE87B962AAB7B0D65E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  DiorSyntax/offsets.json
- Size 9KB
- SHA256 7c90e9a42b9534bc9f5fa9dfdb9b6a9215101364504826afc586d5b0baf9606c
- MD5 7e48476b4816d24d962db05462b9839c
- SHA1 7e84a5aac47c216d5e8c61404b35717c19311c1b
- SHA512 291b6f7cc7d7a5abb2fe00f0315f6d4c74e2b4b6a7d3e7c0b8bf16fd790bd7ce669b6faeb92d74dd54db4102514b2147869624d6b6a03cc359c85d88e8c8655d
- SSDEEP 192:mI8lyeVzYmwxL9CsU2vqZr2bAE32E96fnuAIC5dvj1+UsD+W/1zvoE:mh9zUxLf4OQuh4v/sD//1zwE
- TLSH
  T12612782CDA608DA939BE63A4287C0707E620337751498A9B797C498C5F77E37018AF5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  DiorSyntax/yt-dlp.exe
- Size 17.6MB
- SHA256 3db811b366b2da47337d2fcfdfe5bbd9a258dad3f350c54974f005df115a1545
- MD5 b20877630fd113c96d579e2488e2f3a5
- SHA1 957fadcae18597e09d981fbd49e5ac9debe69178
- SHA512 2ba9017431052ff5396598ce5e6c8b3984df816c5d858fd3aa8cd59a814f3b791c145cb4420153911ccb8ff40e8f0ad6a82aba08b7979d5fde22629aaaa07ad0
- SSDEEP 393216:EpwtSd5gzULMYTzDtDfDgrc6paxi4JV1qsXxcjtjRvoivsG:Ep4S3Y4Dtb0IWaxJ1qsXxijhoK
- TLSH
  T10807334EBAC1A895C8FAD972146BCA30A172FC519309EE4ECF6C77872F875946137E10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral29 behavioral30
- Target
  __main__.pyc
- Size 371B
- SHA256 ac232904a85558cbffadc3514d65fd19728ea013b489ec8352285a53d3daafec
- MD5 b7094c47f6abd2b68c259c0caaeb1355
- SHA1 ba14749e2cf0d23ad5356228022730c9dd4654e0
- SHA512 594dab5ee13795e0b5ec81f26040852032a8b02087c479c8fc58b339384879c00243dca7dd11e2c8d4a9640876c91938d85b5d62aa57534f02ef806fa23da0d3
- TLSH
  T1E5E02015553675CDF0F8A7F97430651044F6BDEA976510031709D553B4443202F5D70D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32