ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d

Sharing

Copy URL Twitter E-mail

General

Target
Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
Size 19.1MB
Sample260723-eczeeadn3x
SHA256 ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d
MD5 28b8819ead3327b94733ec78063830e8
SHA1 4e552fd72fa6786a3d208a2c7695a5ede5f11486
SHA512 5f8aea7cda208681437ece898ec1784ab222895660e0366f9ec7fba39fbc2060350282a520302d89953f74bcf07600c1b80cc6633dcc7b5f85b72e9e050fe631
SSDEEP 393216:WSEo+vjoPBYoTenfL5cwijy6k3Vq8z20lcx9UiMhsRylarwDfE:dAjeYoTenTBijrk31z2ScARWYSaE
TLSH
T16217332C8EA832B19CB42BB5D68BFA51344FFCE7857445D12E01A8D4C248DDA745CEAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Targets

- Target
  Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
- Size 19.1MB
- SHA256 ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d
- MD5 28b8819ead3327b94733ec78063830e8
- SHA1 4e552fd72fa6786a3d208a2c7695a5ede5f11486
- SHA512 5f8aea7cda208681437ece898ec1784ab222895660e0366f9ec7fba39fbc2060350282a520302d89953f74bcf07600c1b80cc6633dcc7b5f85b72e9e050fe631
- SSDEEP 393216:WSEo+vjoPBYoTenfL5cwijy6k3Vq8z20lcx9UiMhsRylarwDfE:dAjeYoTenTBijrk31z2ScARWYSaE
- TLSH
  T16217332C8EA832B19CB42BB5D68BFA51344FFCE7857445D12E01A8D4C248DDA745CEAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Oracle_VirtualBox_Extension_Pack-7.2.14.vbox-extpack
- Size 82.5MB
- SHA256 c7cf0a77f303eb725d6d8f8abce059f5cd6a33bf253513350e0ad7fb4a34d21d
- MD5 04286348bd32c733ddbca146ba22c353
- SHA1 3d7d182e7865665abf70b7c839f4124c919f15ef
- SHA512 2ef303a895ffba0f67476b397d2e489c94bb658cfd3354a312667d6ca87e8a0c1695c6b301081f67ff13d5e06360c4640386950228c5421483a0d5246210e83c
- SSDEEP 786432:+TMZjGAGG2ncnA0DymGYK/URNcic3cEahX/7r:6tD/UR3c3cEah
- TLSH
  T1AC188E3BEF2C8C1EC589867E77AB8B712B30F8510572573706D9E2359C962874F0DA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ExtPack-license.html
- Size 10KB
- SHA256 d323942ce5115ec94f0c400818935883865212a7885696d010d00ca51eca5d41
- MD5 e5c315881ceb72a6188cdbda4517ec1e
- SHA1 ff3a623e1dcfad6f03e4af51718a2af3e29aa4ad
- SHA512 6fc81ee5121db08d0ba4950009bab91a8426d022fdf2e390a13d9332f2d5781e3bc52ece47338e538a709cf8843fd1826f9b6540180bbfae3074fc1a3f6c3ace
- SSDEEP 192:qLayy8KgvxJI3XThbH+cDlprVjcgd3404ErXC6xoe0yDGpRpP7ixYU:Caz8KgMHTbprVj40rk0DGBGH
- TLSH
  T17D22D9E7B34827A11787037A36478FD5F369883D76BF451020A5C11A2762D7883BF6AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ExtPack-license.rtf
- Size 19KB
- SHA256 00e1e8ef63cdd94af6a8971961131a59287e1feddc9a9fb251ac1d06940a49cb
- MD5 307cd6f1206ca2a3ef0b053a67e460a9
- SHA1 d58658149451b56f0b79068d387b776b5405ae8d
- SHA512 0a6e1211ecf915c219a4efdc53558c812573d713c4fa1e81d917d3bdcf5278bd288c46b2ead30c1df115ff7bbbb6f16f15b333979487d35b21180c3566b2210c
- SSDEEP 192:wJrjv1M0L/yjpKWDJIT0TyPH7cDcpr5wcgd3+EoXG6xoB0yDGpRpP7irYV:whh/wpK3ITspr5qOoDDGBG4
- TLSH
  T1CA92E9B758434AE425C50BDA0E92CCC8AF7AC82C353ED1AE576580C8366FE7847366D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ExtPack-license.txt
- Size 9KB
- SHA256 eb31505e56e9b4d0fbca139104da41ac6f6b98f8e78968bdf01b1f3da3c4f9ae
- MD5 2f91f68e2bda53fd0f9e90728e5700c9
- SHA1 83e240950d4eb5334d3115ee99b95cf10d3583f3
- SHA512 31dbc102ca678dfa2b30051834fb648dfa1c2653a2aa40d2141f5df8313a367eb689129fa92549695683f66f9e9d3f4701727f79c76b7b6826f38d4945b1f0d3
- SSDEEP 192:gsZusp9d+8a7asayKLceuzCHQszVAr3vfgc3NdiV+HXz5l/mH7pOpP7kNm0:vUs/d+8a6YeuOAr3ZaQVoH7QYb
- TLSH
  T18922A5A7F34813A21A86067726469FD5F339443D7B7B515130A9C11C2727D3883BF6AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  ExtPack.manifest
- Size 8KB
- SHA256 f73f0c57ffcddf4660cfe0cc6bb617978ab5229875deae6241dd10837fa56924
- MD5 c7df3eb640eb555aecad5100bc69d6df
- SHA1 e9aa56f1a82b7833a5c0601480a6f0cd5c9f6f71
- SHA512 6c5606f104a81204b62c465ab644d8dcb75ab4f4ef4c1ebabd239d4a883387bc8629c5cfd7915ac3c8fe5ec7f863f18ef165f3f20758ccd085419e1e93e37de9
- SSDEEP 192:yO8bT5yvAmBv5TKGeGMFbfE+zbVo0OWrjcx:kblyvtv5TKrnCyu
- TLSH
  T1930296271A6057FEE228098D81C39DD8EE8D57091CB571BE5DA6C2854C92E0E9B3CCDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  ExtPack.signature
- Size 6B
- SHA256 08cebd0aa1eda87c3fc301d5d838a80528614ca823ec7e78e6ac1aee9a7f0021
- MD5 6179fbb96e8c98bf4682ee248314537e
- SHA1 2ea2960dc1a941af743ab2f1e44a450cd08cd13f
- SHA512 3cdb71fefe89b4530018e97ee0fdec07c8de1d8a053b87dfdd883c570f126cd2066f565d3b4c2bbf3efe248fa8c6371fde70aca094ce558e0ebce1764127f621
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral13 behavioral14
- Target
  ExtPack.xml
- Size 446B
- SHA256 5826660cf073ce733fb5716a4c4bd6af15d88662a0f51a80be6e14b1d6de1e00
- MD5 028b602800b16a06f60603bc0b158941
- SHA1 cabd7ff434865c717ae4d7a832debc59182484ef
- SHA512 845c75a63af48ceec0a16a903287e1bf7944f3100c917d8c42eb72366a98fcdad6cd5a26d4fcccfd386a90aa44548b3ed87ec0d9add8a30bae35da7de697805a
- TLSH
  T1CCF0270D98D2E82150364E0EDFA1D182DFBD030A98D60499B0EE80860F303DD4667CA6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  PXE-Intel.rom
- Size 48KB
- SHA256 7d0c3ea5eae5c1319e646340bd77ea116ee3790e0e27991132bf1bb6d1939127
- MD5 63b6f5259ac842040326c16c75af4525
- SHA1 47f1b957b11eaf72c5387ebaab3276260cf57ecd
- SHA512 bd486f107c9504dd74f3607d5f14efe22052399e27e26a906de48c1a4d82fa65a2ed8e5f0fbd60278c1a8f921df9ca9c127e13758d07d347ec2a81190fd5fd9f
- SSDEEP 768:p6smHh7iLTelqMlkU1vOQYjpHKnCmMF5aGa7sLZyi7UFRsTlkTmjYZxlK/:gPHViLTePOgvOQLCmM/Ra7sL77GepNwy
- TLSH
  T17323BF037205C37DC9C9D3B6725DBE7E7071FD01AA89002E5159BEE423FADA8E3A6125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  darwin.amd64/VBoxPuelMain.dylib
- Size 6.4MB
- SHA256 7e94ffa4bd6369a97df820b520eb1f2801344d9346fb360cc1c908cf61e27780
- MD5 350f75bd73f59a1275e096fd7e881b94
- SHA1 d5848cb113fe0edd7daa3f0ff426beb197ce0e18
- SHA512 9c7235baa654b744bc09645e1edb2fd5a63c669403f2559a217e6e14486a2cfbf1ddd06b73947e7475c574d9b6b98dedd5019a692a68534355dbfafc84d180fe
- SSDEEP 49152:ZLygAUY9BTyRyxC0yUPSdQK9L7zkLi+Qpk6iKdCoBOeuJlFEB0fkb81GUCsmOoe5:ZXY9RxJZS/jmTYMZ8CdXb
- TLSH
  T1B166A66F3A73D47CCD61D035961B83325A30F19A1932BB2A1DD8E2396E34C659F2981F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  darwin.amd64/VBoxPuelMainVM.dylib
- Size 30KB
- SHA256 e050ae49ab990516274b03629cc43e4e261edbd2118c2c56ea482666c8157a72
- MD5 10ccb9bf7da1ec1c8c6709324a2d549b
- SHA1 e9537b818f8e9f6044fab54a26ff32b7ccfb2db4
- SHA512 dc554a3490909dc669da1b86a16e7719543efbef7515cf64e4dcda9c2973c252a93cc4c0792a477f4e83ee551928ba35fddd88c29dfa73912b2726662ee9149c
- SSDEEP 192:k4z/jixiw3cxazr+RjG8P0GzrzjFJ9zr/JugFrgfprv75alZ8P09rY:k4PxOr+Q8frzZrBZrgxrNab8erY
- TLSH
  T1ACE22B971B4C2826ED48A67402CFF7E3AE33F3885F52001F7152C4E12F92B796A2991D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  darwin.arm64/VBoxPuelMain.dylib
- Size 6.1MB
- SHA256 f93a34c503c8a554c28694cd02e6e2a4669843b0493d12405412d44510c4ab73
- MD5 e72bf27d87127d25760ebbdf1a0d194c
- SHA1 8c05218f6e196d74be96b951f38d8166671d52dc
- SHA512 79476b2f7f833f1e54f132349fad810aaa70c260b376aeabef58bc3e034594d2e8c45b7a11568c949c776a3255a1bae0a6e82c6bccd7d75ef432cdbae4922191
- SSDEEP 24576:VdeDKstAOcKfk0wxqyW72q1Vmxqyqn4quhCgcSNu5F61B17Ya03Ets7U1deNcf15:VhPTKDVKwU1PGUHqyEEab+A12NPl
- TLSH
  T15F56A460E1AC5828F6C5E2BD7E8417E8760BF94448B4D1CF78FB028EED55AC9646C3B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  darwin.arm64/VBoxPuelMainVM.dylib
- Size 66KB
- SHA256 a09f59fdd4424fd965afb7c65a7827cab8ec71d39e52a5ea3acb045ca5f2b1c8
- MD5 75f3d8c46edb44fbf9ac6ab1b95bfe28
- SHA1 8bd9331c0411801dfd92529bf267a49c7d280b73
- SHA512 874a4512c1d4a08b7797f6c8b34205e31758ea9bd7c48e08fd4b0fe82569bac21471174ca226f997bd6dfd3000a0447b81b9144a36fb5bc6c7d12193315bfce9
- SSDEEP 384:xT+6t74wr+Q8frzprVErWDu1rNab8er0:xT+U718zwab8
- TLSH
  T119630A971B5C3C16EDC8997403CFB793EE37E2995F5200272062C0E52F92BB56A2985E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  linux.amd64/VBoxPuelMain.so
- Size 8.8MB
- SHA256 fc77ae2402400e4d3396245de0dfbe057d6bc0b9318557f60e8fb70a5094ac19
- MD5 e67f147670cb636b205e23f5fb10beac
- SHA1 a95d2146c3e12f55f03e28dda1c986520ebc5774
- SHA512 5decad2c96271fff539d60e741789a82f8e7af9c1f04c4be49b9437d142fc8d3fab9e8ec281c86212fac5cc89966e5b7a3ba477dce4d80c53e543c9ef8ff88b7
- SSDEEP 49152:GawyK28TzUDCcuyRDfhlbkMXynJ9bftvzsLgBrarh+qYsIcIqcO3Eq5+ku6cKic6:z8TzsxDfhlwMXesJGVMIC9J1Hd
- TLSH
  T17D962A1F2637A45CD6BDC0B8895FC2B0AEBCF4E0442534376B9BE37069519225F0DA7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  linux.amd64/VBoxPuelMainVM.so
- Size 13KB
- SHA256 28dc2f9439d52934c74a1cd9215c1066896b847013f7e404f3a4f0f4c008a037
- MD5 d50d97bf689cbb823b0e6f41e2cbde61
- SHA1 7d1be6ea23ab99aa8ae3b86331313e8b5721eb10
- SHA512 c97a7050258ef79edff612d196070a783cc7d4e2ad2bf48598a255888a85097484bdc4355b9c9f59cc4480bcfff0fe4c8195967665c7afe0cf8c49a6917f8252
- SSDEEP 96:Rr0t9MBWBwUjosXhiwfAJwTiW+HlfNebDScUT:Rp8OUjjs/JwuW+FfNw
- TLSH
  T1FA52941BE761CA3FCA7C06B4C8E707307279D800A3D24363A279B5311D87759A76699E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  solaris.amd64/VBoxPuelMain.so
- Size 57.8MB
- SHA256 4622894385a03b5a94f60b9a6bb0bf96b565f38b70da9112ceee46b229ba17c4
- MD5 942b5c0056efa9188c4599aa2a7a7ef3
- SHA1 235da35b555978bfcf0b6334e1afc101c0399370
- SHA512 f2e95eff403e801ad54ed7a20ee2ad7b8205a2845c2227ccf0b19b794ff5cb57ac6858a6eed060e5902974f681a5a6f3d76a52748388846a80e13beeff06f7dd
- SSDEEP 196608:NBKcnA0DymGcsBQK/5JKJR0Irci0c8I9xwUqL1E6CQJ3cEahX/76w:ucnA0DymGYK/UR0ccikWPa3cEahX/7r
- TLSH
  T129D75C3BDF6C8C1BC58A4E7B77BB8F112770A81112A3573706D8E6359CD62474F0AA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  solaris.amd64/VBoxPuelMainVM.so
- Size 183KB
- SHA256 63707b19e754a1d15bb1063d3fa2133dbe669e181559b71b1d3cde60ce5fae81
- MD5 98b3edc87c4749e12c865d11067bd9fd
- SHA1 8d74dae40b39eec2ce77bedcc416b445e932681a
- SHA512 c7d5bedb6d134d9eab0b98c2e1ab4fd5415257de87d3c47a83f3cb61cd58f5c6c9b7f127a30ec1b3e4c8409c34b79533d0dad7c85df8f75fd46dfd1b7a7e28a3
- SSDEEP 3072:urlat8OM4HFZIKE3QLSwevdwnixU/skZAlmI9Wj7YN61y7YodWjVSK3FifM1yGzN:wlatJAKE33V5xU/skZAlmI9Wj7YN61y2
- TLSH
  T12D045A192BD3B42AC3BB3A70EC566B7C0BBD75CBA7CC5A16897005608FC133D6C25696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  win.amd64/VBoxExtPackPuel.inf
- Size 1KB
- SHA256 f4704086ce832400e5fd468a9645b07a116c5bc89de32dedbf359ca69db85144
- MD5 d43f2143cd4aee466bf8926cb07b7882
- SHA1 10819b682753dd157e45b744b7283ada92a2693d
- SHA512 37e741b6f16e4f105ea3e158f47be7698d72d2cf60ac0e60744f1cb1845febb41cecf867a296981c5b3da74dd905f422e090fcbdd31e9d28b4212d3267fac9e7
- TLSH
  T1D34133494683E723163146B97707CFCFE35D4202A9DA0402F66AC97BCD0DC1D1179CB4
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral27 behavioral28
- Target
  win.amd64/VBoxPuelMain.dll
- Size 1.3MB
- SHA256 6aaf0960234bd3f9d4c8684f8aa67795b38ab4c71d1d3b2aa6956ea05350d0c4
- MD5 8e82884d5af94fe7750c766852b4322b
- SHA1 fc4d578d167d2856219b1867f4da10cd420367d5
- SHA512 91ae799da81553e56e2e1327041aefdd7af2135fa1ea8e8404b73bfbde824fb28c6f9d6244b5e69bd467c2b03e88a1c65a0e90c533943a42f56a3ee60cc26245
- SSDEEP 12288:7XAQTmEwFRZiLadFg6zqJKB2kopedVdtPn0Nc/XDKmC1X+Tpcp6jj1bAwDRvoTMm:bAK7n1JK5pv06/XDKmC1X+Ts695NYN6y
- TLSH
  T108554A4B23AC4065D47AE13DE2538B1BDBB3301147A2E3DF026587AE5F237D29A79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  win.amd64/VBoxPuelMainVM.dll
- Size 23KB
- SHA256 3a5db8aa2bc086abee32fb39d93647f2d2956005e42d54418f47751db1dd320b
- MD5 d9e89ca5a16f86a1f60a66968250d5c4
- SHA1 4968479dabf6b214f27c757e94c762d5ad6e7aee
- SHA512 1ff68589a111aa8be781e9b1a0a88bedcd741296c1cd3d3ce2813dea942f640def11f01568e6371c1822a2a2cdf9dccc685fde00806a53675ce5c13beca7087d
- SSDEEP 384:9XmPsg9EG0PyjAMwSg6GuIYiq1GVMc7SeMy8RbmL4nNyPYPl:BmyDyiSJGjYi1Vz5M5ALK9
- TLSH
  T1FFB27D57AA944C54DC674970E8A15B17E976BA101FA2D3CF2324C01D0FA13873BBE6EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32