903339cf410ed447199d7c6e8f726557f4b08e6225b6aab0ed324ec8f834e60d

Sharing

Copy URL Twitter E-mail

General

Target
903339cf410ed447199d7c6e8f726557f4b08e6225b6aab0ed324ec8f834e60d
Size 8.1MB
Sample260719-p14n5sdz9v
SHA256 903339cf410ed447199d7c6e8f726557f4b08e6225b6aab0ed324ec8f834e60d
MD5 bb02e81f85a4ab2e2844148752d8b4e9
SHA1 cf0f38b48d44a93fffabcfb303d4187c45c71423
SHA512 abbb101aae6ffe57652467f44d92d3f479ae88975495fec63ce95e6ea2e069a3a813753c0db69879fcdcc72f9699de4ee52a032664895eecf91f7e303af3d3e5
SSDEEP 196608:xQsTIVQu1cLTIKcGzjI1/NKMplAJkU7GKLOVpJRmk8NKyhBOtLMUFEX:SkuyIKcGzSP+LDOhwWyKLMjX
TLSH
T1BB863382E0B388DCFDBD8C34527E94B3EA9E66A0B6579090C2BD45C50697114FDE7B88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ColorfulLedKeyboard.Core.dll
- Size 47KB
- SHA256 9dbd39d4dcadf77d075dfd7500630ea0b717f5f2ea4b4a769dc10f400c13e57e
- MD5 5aa2912b53391030c9cc9c78634d58af
- SHA1 4048351bb1321b7843e3935e171173f46564a967
- SHA512 141fc33e2791ce2e346f1a96363cf57a6dce1b4fbe4be67876fd008226e3b2b1dfab9b2b44b3a90a1459169951057322ed4c4331fee82daa6ee3c942631ece11
- SSDEEP 768:Jvi1+yNOuvRX/DAzA1GtcLf+QF87ohKd0F35/+M4JmUz/81kNBivoqiSBCVc:Ja+ykeRrBj+Qm3Q35/+H0UP18BC6
- TLSH
  T10223FA24736C87E6CF4E8E3AB0A0416105F292FB3613FA95DEA2B5D62E127C75115CE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ColorfulLedKeyboard.Service.dll
- Size 169KB
- SHA256 feb784e6f664232e8635752e875b95b7a9f0920f4b3993322e87e2fb1c316bd2
- MD5 591dc5f9824ec4949005851b915f82ca
- SHA1 9e224794c6a763beaa77d8154a0cbed57bc3d404
- SHA512 45a79ee107e10b24a387374aeb53e9cde5c9a16c46c242afa3843f63955251d4bfb84678e21060abc5dda0b3db471a120ab91d0e199a9b36c9ed98eedeb99dbc
- SSDEEP 3072:XGYbVDGMktSn4ITG1VVWSguEQbt1Eq8Tzs3uSiT9AD0SvJQ187xwn8jGjVdXD:WIDJapIKVVWSgHQ+X5SiT96JPx1GjV9
- TLSH
  T1BA040209D7EA8E92DDAF897A90300112527382357206F7DC8EEC51F52ED73A05E937A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ColorfulLedKeyboard.Service.exe
- Size 284KB
- SHA256 b3ce6399a5103439cec08da84813a6ff3edc046a633703d244958f22192ba449
- MD5 aafb4ed86c2a54d5fc96f71c7318e463
- SHA1 2c82cb9696f8784ec69972942f49f4f7b71525f4
- SHA512 9696c3e83de201932ca8a70e9674a7967f966f9b70eec287ca76cf7eb369bb5db7c134c89bd42cbbf1dac1a69eba365ea431dcf1cf28a12887d286cd7c199fd1
- SSDEEP 6144:c64k83TlEvh6IgQU1WSgHQnX5SiT96JPx1GjV9:c/TloI1WSgHgXQwgyjL
- TLSH
  T1EB54BF07E6A850BDE1B6C679C9A24841FB7378594B71A2CF47504EB61F73BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  Microsoft.Extensions.Configuration.Abstractions.dll
- Size 27KB
- SHA256 fefcdb267a73099cb90e5af56b5ef2bca59bed974339b3a6810352bde23537a6
- MD5 e1f852e450395bd9cad83625ca41afab
- SHA1 8a5c6332c4208e319e648c8850ab709c82efe48d
- SHA512 54fd5acaa24c426b42aee7b855b6614c9c1e2676d0f54683d4a2b059db7c9bda70988c6ceb43f488abc34759f575cbdb75c3f0649cf932cf5fa2f53a66cf2881
- SSDEEP 384:Hxrv7hVmaET50kv96TG/FwzzRjz6qMvckxGMCWsfNWCx5kHRN78DuNNPR9zbKrQV:97hUaETSkXZp32No8D69zQGF
- TLSH
  T1C1C26C6953AC9327CCAB1F71F5F1D4412E36E7E27811DA2E589EF1090867B805B32729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Microsoft.Extensions.Configuration.Binder.dll
- Size 41KB
- SHA256 5a47750f5c8eb91a203a743abbdc27c7feceeb2218d39445df6560629477eec9
- MD5 3dd49127f7bee55b58b72c3a48609489
- SHA1 30eaca07c671c3514ab96cd9b5b130b542a34d76
- SHA512 50442e766402163d2423e44ea7ba0658727d9797d7930294579eea0d8a98284e4fab98c0423a9fdb386d3c5e53f99c5172f7563af2fd2c9e62e062d38135f48d
- SSDEEP 768:vrGlacqr6kPubIQGxeVdrxiUP/iYLHji9zCxTj:vrf36kEIQGx8xiUHiA+zCR
- TLSH
  T12D133B1657E8C326F9FF0BB064B1E4554F76BAA23826E61C5C4E601D0D777808B623BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Microsoft.Extensions.Configuration.CommandLine.dll
- Size 24KB
- SHA256 688ef791d4bb2e84839cfb28ec83772d561d958f6d0b20ca28be1c6efc9ea5f7
- MD5 2ebdc0b72eafb372036911dbf7ea1a9e
- SHA1 b4ce3f14ddbb8c0188c2f0b2f735512f3789df8d
- SHA512 82ae8f62c6ea58eeb54e116e8258db90db55f6c376ef572f52b580194d5974ad66cf1c62b329a322d681a937a4214b67f9b4e273335a90db662f3d7c55bd0517
- SSDEEP 384:4+6wnFbhCxwXaHsRJ0eDKfW9/nWCTb2HRN7jSR9zrZV:z6+FN04IcCSJ/i69zFV
- TLSH
  T10FB25B5697FC4217FDB70EB0A5B0E5452E39AB93AC21E62A185EB10C09B37804F7173E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Microsoft.Extensions.Configuration.EnvironmentVariables.dll
- Size 20KB
- SHA256 797b3034fd173caff0850cd580428a5f4aeb7da27bf03369ad7f2b0996019399
- MD5 5636d243d19d4d7506cb8844458c3bdf
- SHA1 4575623dc6fc5c43718657e9c775cc2b48830155
- SHA512 b2176fa42bb1f20477102a1119adcf7b11c7e85dab1b5e6c937c5dd94d9e3068d8bbed7326d5c7c78a81f4705d3916a9d807e2522db75ea8114c05d52e55fd09
- SSDEEP 384:gSz0UpsW+K0ihWQS9WUPeWVC5kHRN7/NNPR9zbKmhBP:gc0ULPUrVD99zbhBP
- TLSH
  T14AA23B8593BC8202F8BB2B70D6F9D5622C39FBD26811892E155DF10E1C67B94CB61B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Microsoft.Extensions.Configuration.FileExtensions.dll
- Size 27KB
- SHA256 d90fd867b38c134678d31c4354f4514b9f3efff494f7e9eecac8df6ef07a77c9
- MD5 f36d31e5e59f75b3eb9b17e2a28aad7e
- SHA1 00805eb75a624f544cf77f8cc8e883e3d4a9ac4e
- SHA512 4421625c14285d339391d2ef2cfdc5f7f6f0ea7fa9539a84721adbcd07389e9970e6a280cadae78a0ca2b7ecb83b9ea78dab15a8dfc94fa1032c5c5ed75be89a
- SSDEEP 384:/MczpIwUCdKetxyFCLJNsLghXABAqWqf6Wx65kHRN7fh2JNNPR9zbKXwH:Ect7lVtfMewAE1LJ2H9z2wH
- TLSH
  T1B9C24E6297BC4303CDBF0F31E8F0E841193AE7C77810DA6D599DE00819A37959E61BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Microsoft.Extensions.Configuration.Json.dll
- Size 26KB
- SHA256 96920caa680f7583888e3387e17950bb9f39f6df8e24fcb4d356454dd2b8e494
- MD5 59689c24292a786205cddcb16b267c39
- SHA1 cc347360c8abf385ceacb48249aa3cf0753bfcce
- SHA512 ce3f9dee2ca1aaf079724578e6e31dac94184a98e184a8c04eb2621c0c874825ceea48d4c7e0f6c3b33faed63b5d290082965882a7c678a3a5c5d604d39ad3fa
- SSDEEP 384:z+J1o5egFMvqo5e1l6vWkf2W8GTb2HRN7qI+R9zJKbn:Q1WFMbhNUG/iNi9zET
- TLSH
  T1E3C25C6593B88327D9BF1F3099F0EE452D39E7926911D62E199EE10908777C08F3272A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Microsoft.Extensions.Configuration.UserSecrets.dll
- Size 24KB
- SHA256 a415ecb7ebdf4f6598c19fbbdf54899ce488477e1c81972ba575910efb54a0c4
- MD5 a2d4648be3ffc29d4037cf7538c9f00e
- SHA1 d91e6678bc4612ef3c93d13db8fc1942807ac91d
- SHA512 6340ba6e8357402123d642699f7c41319ae5dac8d0f0d907f6ca981040eebfb9cc77c15e0439c7907eb027349cb3b9df78f9f7c85cadd3f4e739ef8fed8f2f17
- SSDEEP 384:a/sfDn/DN9gRxL1iF8gSE1LGDW9PCWiTb2HRN7rLpV5DNR9zqt9Pz:7bNmxcRGee/iPpL9zWz
- TLSH
  T1AEB24B86A7FC4312FDBB0E32F9B5E5812D79BB979812A52D086DA00D0477BC4CB31729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Microsoft.Extensions.Configuration.dll
- Size 42KB
- SHA256 b5cd9da2c3364a5b201cecb0c80e25227d27ba44d96343d2894ff8ef3fd81550
- MD5 ebf181ef6f8cbfdd9149d9d609059051
- SHA1 05cd721a76c1afb00df1b6417e6b8b1a7f344e67
- SHA512 fa2f59833721fb50500d89ae5a3c8c7474e247a684440c01bd30d46a8962cbcbe8f216d41bba9ebc075ac2e1ee19c37a46d0e1db922db23a3e261b5c68155877
- SSDEEP 768:MLJOZTEW1WTsTeVnrI/yqCtHUafO+ukucyOgn9zT8B:MLJOpEQzTp/AX2+uMyOg9zTc
- TLSH
  T1D8135D5A63AC8B2BC67E0B76F5F0A9451F39D2477912E71E4C9EB09609273C04B1273B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 62KB
- SHA256 a0106a638facae621f870eda720cb6c980c1d5d49c2f4351134e3fe043b9291b
- MD5 38236f9c2408bda46c13efef364326fe
- SHA1 03178026c200fd723bb75d08b9a4b70e93f6a45c
- SHA512 4abadae40a459be932359d6964c30e1e5fbef300736943bab42c1d66b5fa56c45ed10910acf6b36c302c8a40bc364df444220e2af8ff5854460c6a9542ff88b7
- SSDEEP 1536:KCYbKF0XEQqb72cfdGWQAE389HD6dDCN6rzf:MUbQAKuj6dGNAj
- TLSH
  T1C7534A54B3FC6727CBFF5A70327250219738BE4B2041F70A796BC0B509A27D855A1AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Microsoft.Extensions.DependencyInjection.dll
- Size 90KB
- SHA256 8d6e7b64cce554f0a0fbdb2ba80745895fa0b4e6cc378b9fedfe8ce86f0d8ae4
- MD5 7d40b6217fc409171015d905a22f8e85
- SHA1 27a31ec52498d9db2b09707ef603860a80fdb2cc
- SHA512 e998ab21e2a7f4df84f33c5d7bcb6d04c11481633362f4988f3a22820aa1f84744f51503947492217668b9db39e651d13cab0ef09d804b961aea2434314a3d66
- SSDEEP 1536:6sS1Tz5tF1bQWVsdJCKTvZEmwbyQMUiEVzz:3QH5tsWUvZEmNQMAVn
- TLSH
  T16C936B2467EC4B33EBEF19B8A87440044BB9E55B3102E74D5DD4A4B91AE7FC20B712B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Microsoft.Extensions.Diagnostics.Abstractions.dll
- Size 29KB
- SHA256 bea3cf225599b05a521902e12e23de6a2309937dfb3763ccd2cea62ad2c4fe37
- MD5 359e71422cf209c524c1fda14a400cfa
- SHA1 36d5e29fbd2a6f9e5728561b45eb0bd44f8c449b
- SHA512 a73cca5795940f21bb1ed91cd764f35d81faa350eaa31b08cd450b753f9c305a9b31525938f23d1dc4defe0f472b20a0e2e1a911ac4dcb1494ad88d03794f27a
- SSDEEP 384:iVZvGPhQTlrYouV5vE+YlOjqmfQ4vWOfRWWTb2HRN7UI+R9zJKimp:Y+5QqnV1Zb/H/i3i9zEp
- TLSH
  T166D25C90EBAC5326DEFB1E31A5F0C5411A37D3576800E72E4EC8D1091A73BE49972B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Microsoft.Extensions.Diagnostics.dll
- Size 34KB
- SHA256 5c83650f1c0a15c8e3831a4d48008b3baa338505a3be48780a3d86c2cd4662a0
- MD5 95394d501f27980f2a11c37eab609e7c
- SHA1 c4ad5ad3c15818709379b384053cbc34658a24a4
- SHA512 6e27db3770bad9766d397f4b9317c3b2aa76198ecf0a77fcb44970ef79b65e00ee51d84306d8a05de9a49c49d90f9ebcd7e11961627754d00979618da5afe7a3
- SSDEEP 768:gCuMWVBZb1alK3/uT6Bmagz9/igi9zEBk:gC6Ul0NJaFig+zEBk
- TLSH
  T130F25C5AB7A8431AC8FF2EF4E9F0C9426F3AC7936401E7591DDDA0890C677D48622379
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Microsoft.Extensions.FileProviders.Abstractions.dll
- Size 21KB
- SHA256 f08b1f597abb3647ab6e844282ded763e6078dbef6dd54b9d956ca419fac42fe
- MD5 504acfd4f683b6f4859d240c1f6cd749
- SHA1 ae54915150997136f132bf61bdd9e7859f56d9bb
- SHA512 a05f8507a8830ac33c45942bae06c49a23242f35b4c01b3d677f8fef0199c8cdbd956967bb73374bc52956d3bbfc82d422885800006c644d4c4aea4717287239
- SSDEEP 384:ggH8Tv2So+MVV1CMHWs/hWuTb2HRN7TI+R9zJKhJ:ggcTvlGFtr/iMi9zEhJ
- TLSH
  T178A25C66DFA88362CCFA0E7064A4CD473D3DD7E75801E92E0999E1091EF3B849631B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32