e67cfc2b4462cce93aecb67972d5079e85b8fe575fb18858f9260b6ec7b37258

Sharing

Copy URL Twitter E-mail

General

Target
Wireshark-4.6.7-x64.exe
Size 93.1MB
Sample260724-dgwzeaec53
SHA256 e67cfc2b4462cce93aecb67972d5079e85b8fe575fb18858f9260b6ec7b37258
MD5 8920573666fccc698bdb3ea57485f0b1
SHA1 781673340fe1f81d648a731d1855cd643021a92c
SHA512 fa1dc0df6694eaec18b9e6af32cbe04188f35173700a8b34da3fef4b96d0425ce28b7c2c15b7b9b591f32550f1484919114fd7f0f92e8b5a25b492dd33ef618e
SSDEEP 1572864:Wwtatg+dKM1sGgGMut3vWv27BKGwRGMBNBNpPGarwp7oL5/OCHUkeasm:Wdg+sMsTQ3v02NXwGMBdrwuACH7gm
TLSH
T15728339475C6D1E5E9BA92BD5000F7321C25DF3FB9605C18FB0CAB8324989D87DE62A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Wireshark-4.6.7-x64.exe
- Size 93.1MB
- SHA256 e67cfc2b4462cce93aecb67972d5079e85b8fe575fb18858f9260b6ec7b37258
- MD5 8920573666fccc698bdb3ea57485f0b1
- SHA1 781673340fe1f81d648a731d1855cd643021a92c
- SHA512 fa1dc0df6694eaec18b9e6af32cbe04188f35173700a8b34da3fef4b96d0425ce28b7c2c15b7b9b591f32550f1484919114fd7f0f92e8b5a25b492dd33ef618e
- SSDEEP 1572864:Wwtatg+dKM1sGgGMut3vWv27BKGwRGMBNBNpPGarwp7oL5/OCHUkeasm:Wdg+sMsTQ3v02NXwGMBdrwuACH7gm
- TLSH
  T15728339475C6D1E5E9BA92BD5000F7321C25DF3FB9605C18FB0CAB8324989D87DE62A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Qt6Core.dll
- Size 9.8MB
- SHA256 3a396a699c1d0ae0c9b7ebe269e9d18d875cdccb8abc6eb0a142471f2d763cc5
- MD5 3d6d2e96bfa6aae55e2b641acf07747f
- SHA1 bbe3aa74603947c356ec73ce75a0c043ca01f8a5
- SHA512 09738b2e6202cb48e475401094dbd96c28d71206388e120466dad87e983477984df27abda5215ac7925ec991efe977c0137cc03d472638272b770096b1db2061
- SSDEEP 98304:O7ULMekqCZDPAlKFdu9CwJsv6tMYdJMS2r/38k:OxoKFdu9CwJsv6tMeSSa/35
- TLSH
  T1CAA639036AFA0102FAFBDA34DAB71252DBB27C46673596DF025461185D337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Qt6Core5Compat.dll
- Size 857KB
- SHA256 7c412bbcdbb096e269b65bbd0adb4d27f5839a273cedb9dbf21701ba39d409e0
- MD5 dd7d7e85f0a1e4dfb2b2b9b8917097d8
- SHA1 253d7bce68ede7793b75e14703d9cd2d462f0c38
- SHA512 f9522962d49712ec0ad186b75b9029133ebc76e454d6d062201f4610ef6058e0503d0fc4ccff563fe5d5f0b08cd5abbe084ae02d32d4cb12fd2486e8397e92ca
- SSDEEP 12288:5jAnM4mR8zu/r5hBdXvPGE/4717VKIxBDPzHkSrGGEfvrfLO6:34Aj/r5hjG7VRDPTwXfLr
- TLSH
  T19415BE7772A80956F16BC03DCBA3A913D7B73016536286EFA66087077E63BF1297C211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Qt6Gui.dll
- Size 9.1MB
- SHA256 9b2f0574530e0bfb1409a1bad1c296defaf052290dfa02b403e3cbfd874f5fd5
- MD5 c337cbef258d4479e305d540e0b58817
- SHA1 c4eb69ae77f0845a8bfdd0410e3752190836723d
- SHA512 9f41e49a3d9d6d9cd2fc49d1f6f82cb5e628e15d6f8271d0fbedb09fc48d8a369f5530e1c40be76af6b3ca9de402ec000545ea0803ac8a4e90310e33e9ee1214
- SSDEEP 98304:bLWJ76kJHgTZg+ZC/PVqGJ6Q/Sx5kPthKMG5bpZa5M2EXUx:0FHg9g+0YQ/Sx5kPXK38zx
- TLSH
  T148A68D57B2A911D8D57BD13C8B9B9507EBB2700503629BDB01A4CA562F33BF12ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Qt6Multimedia.dll
- Size 1.2MB
- SHA256 ea65ffdaeb1653023ac3b86dbf89021f14d64a731ef65696570683449ea79fcb
- MD5 703a898444b4e0e76151f6d818a7c5c5
- SHA1 578f5893ef4b3dccb878faf332feeee448f9d61e
- SHA512 d7df54c361981eea7425124976d3c782c73e1e95acff754687f60fdb3acb3c7a1bd869f54f42b1a017078df6f94952116e8ee5b102eaebd6c0e1fc13a3bc005a
- SSDEEP 12288:iO8y5eo5K9Kqtc0SU1Y7qZzQpl0BZ8+Wb6+8wC97lg6WETG:ihyeo5K8Ev1Y2ZspU7w47l56
- TLSH
  T134459D5BF79441CAC46BD13DDAA78A16E7B2B0141302DBCB12628A0A2F77BD11F7D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Qt6Network.dll
- Size 1.7MB
- SHA256 23fe6c1e49276429fa790da0d44e5f9eca4731f84f0ef5b5a65c38a2d71a9054
- MD5 313fa50846249e049eb85dd8e4a4f3c1
- SHA1 2a4e98619517ca57d3e900919064016180701e9a
- SHA512 fd74e08e26ffee7cb00bd6f5f1c6274c345577ea9f871ec98e095dfb6304ccaf113d6e53ea418658b0d5964988fd34a21954188ac1b7f2afb7af9df1c9e9eaee
- SSDEEP 24576:ZaNBuUZQb0e9m8EPrcoEuyRhOaUVhYpflc9r:Zan5Qb0e9REP4fu+UYQ9r
- TLSH
  T164857C57A3A442D5D96EC27DCB4B8A0BE772700543669BDF02648E152F73BE21B3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Qt6PrintSupport.dll
- Size 399KB
- SHA256 c40450db6a6a581ac2fef5bb1570a0f266791186f722e57e2ccb95c25e20503e
- MD5 32dc9ab43951c788d3d24d1f44fa1141
- SHA1 2ccfda50b6f8ef8dbf61e76d674d21639cb49932
- SHA512 42fb3a5748429309b2a852c7550bfd7fc91feecf118c7f6ee2a8bfd603eaa5d01de19e02e1a29ebdfd9dc51ef347bdca477a252076b74f6bf400dec929dc2673
- SSDEEP 6144:VX3Mtg6igp6Uq1rYzOGhyDa11KnW+3A2Bqa5sGc4rZHYGpxgiWbMEbN3PBH5AYlu:VX3N6icBqkOGhyDe0WFW
- TLSH
  T1E4942887FE660181DD5AD23C8A7B8506D173B0D90363C7CF022E9A09AE6B7E1797D394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Qt6Svg.dll
- Size 620KB
- SHA256 1b2312b6422cff420865f3cf4086d225e5a4668fb9d1aeb8d81c4a384da6f938
- MD5 13e0938f9b9792ce2193cbe82c8c7cd7
- SHA1 79cb26610e7fe6b00cf577a67c2e0a2222395319
- SHA512 926e2333e3b0d99deeb9c0f1d8dbcb39f987fc97e377cda993ec208ec89d878c80165385d5c0aaf010efa6da80977f5a165757404bf203cff3e3ba078bd1de6d
- SSDEEP 6144:m6HNycivcATzSTN7xMeheA74qaBaj7TfAAgutn2ru0Gf+crP8Sx5Yj7yEA3+ITI7:m6HNbibzqfq4j7TtNQuR+cvB5/W3
- TLSH
  T131D45C57B3A60786D86AD13CCB5B8423EBB370440362D7EF41A58A552F23BE16B7D360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Qt6Widgets.dll
- Size 6.3MB
- SHA256 a809340ab228ce1723a8b2ddf3185cda82445e4c962b45c41cf8bc2807f5963b
- MD5 ad7f874e90255b0b759265dd81423086
- SHA1 20e719553f8e7bca12f45e5d8eaa2a35317d4b56
- SHA512 17c28c47e2e746d5c08eec71fec21371812b85886f1b693c7af5ffc875fec77fc27d4c355dd09fe41bd17acfdc4f302134d9f425f7fba445142db8e613b4fa33
- SSDEEP 49152:K/jhOtxRzXn31a0R+oiSl8U7jtRtzX1s3e8fCTjjvDsXjnq7TADWVb/G5ImjNyzK:jRNj5zX9jrNkwqZjSayK6gckA7/HTHax
- TLSH
  T1A9666B57A3EA0195C4ABD17DCB0B8A17E7B2700443229BCB11698E592F737F12E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  USBPcapSetup-1.5.4.0.exe
- Size 190KB
- SHA256 87a7edf9bbbcf07b5f4373d9a192a6770d2ff3add7aa1e276e82e38582ccb622
- MD5 93c9b5098b1d42c53c7bdd68fe9cd6cf
- SHA1 ccfb1497abed432844ad972dea65853dd0e7cba1
- SHA512 dc6b84d0784ae36941615565ff21e8634bf36e3efdaff598d470035157a2f148cd1f10031504476f821cd0ce0180c61ee9fe6a7bd0beb3721c4b1c738f61fef1
- SSDEEP 3072:PQZmPYFFiorvcQNpDjrc5nMDi93g6HC+0vaiFxMv6mwSARrwPKVvbygEXoHApLG6:PQLFhJXrcVMDcgoCtswShkTAoRA9
- TLSH
  T14D14025A23E1C0A3D797063098F66637BEF5E2100152691F63B0A6673E872568F5B1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
behavioral13
- Target
  WinSparkle.dll
- Size 2.4MB
- SHA256 c1c712adedf3bc8cf0b2752979f75cfcda69f4be9e6983df98748324286d44a5
- MD5 b1141e77577826215d5bfba26b71b13e
- SHA1 eaa2025150fa6817b510b8f7bc27afcf23b6c753
- SHA512 9c712ee1c2659398568052f32ed9a89cd1b092d5ed2b7aa3121207a7224e54f803d7b9cf9fd3eaa07b8ef8ec9aaae595faf46cc1f9f6f04e00c32730ec7457cc
- SSDEEP 49152:TXfRcalA7wchHjSjSrb3cAAutEWWP6QzylkwA5:dcaPS/ZltEf45C
- TLSH
  T1E9B58E0BF6A441BEE4ABD27CC917AA06E7B2B8570270E34F11D049AE5F533654EDE321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Wireshark Release Notes.html
- Size 48KB
- SHA256 790917fe31b5e739cbab29e9230e6addcb11c0e4f71ca235a8fc503015f6738a
- MD5 fdc6a0f54f3fba9cb728adce34dc26f2
- SHA1 01b3d6b31c62bdb5eb1f97a1ce2b3ba885575b26
- SHA512 a64506a674f05582cc6de31454da097b60665af60ebc1340ee735af482596051f6ec220e0d9b7b15f031fbfa7336209230919fe71edf0a4d47dd26351da060e4
- SSDEEP 384:Ar8D70aZ253+YTROO4EbLdcfCLFNI16Yl7T6tiYs6qN+IWGImpHo4:x70aY6uL2QNI8OZ5lppI4
- TLSH
  T15223F0ABA4C071690B878A73BF3BBD7C5A1301EBCCD1362D51F38625F9406B24D81A79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  Wireshark.exe
- Size 17.8MB
- SHA256 e6d31f54036c28a9a81d0f641ceb79ae108d7d201159c83966af2ca9fe044ec0
- MD5 ea8742276ac18b03ffa7ca9ddccb0494
- SHA1 460d7c204218ef4be2aea7d9a0a6ee2f87d9f847
- SHA512 890a43155cb5f670d48e84972a6215af48030e413b71c5cab666c9926f6371c09383b0d9eb226835d3d370bb3e5adf1c94f0fffe7cf07e5b205fde9174ca0d6f
- SSDEEP 196608:kn7l8SRuSnBD4u1bzefrzbqH3zafWPNC2QBBtqQrYf1NDBBNitnoMcy3RaXQvImF:y5CSj/wiOYCjjCkuns+LPz2/m13Lt
- TLSH
  T10F17CF5F62A442D0F136C0BDCBCB8E16E6B2341A53115ADB0555D66E1F3BFE80C7EA22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  avcodec-61.dll
- Size 13.3MB
- SHA256 38f437ef866541398515af815a9c40136c70ee089559d8d84323d5ee356a90d8
- MD5 43eaa7050b2e1bbcb1458b1598784bb6
- SHA1 421afabeb676122600482c5f6ddbdd30964cd3e4
- SHA512 722beacbf410804e1a51b6413d0eabfe1beef45827be08e6e56b67276f76e75e77ca6cdf1ce99c35ed79da82245fde1117d07cf5ebe6ac8587badf98348cf5b5
- SSDEEP 196608:YKOZyR5ZDyMOAAmMxFNUNTlC+77/2f42f7pdS:4Zi5DORmlB7/2f42Fs
- TLSH
  T1D3E6BF46F2A211D8D57BC034C667AB0BFB6534BD03506AF75691AAB43F73BE05A3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  avformat-61.dll
- Size 2.5MB
- SHA256 528a4f1314fdd16af2138e317e5d3aa62759a81ae3c65c9b430050d9a7ab9e2b
- MD5 a9fa308a96ef6bbd42f08f3b6fdc92ac
- SHA1 e0b55309bce69750fbe7380a0137f050298d715b
- SHA512 2d28177f5fdea6b9576420f48409f2b3e732fd452069e6b157a56a33dcaebd5895245060f508b113a94ff9ec00221957a1c33676af5a0a13ffbc398be104d8ac
- SSDEEP 49152:Ov1oUBbg0IaUcUXF8DbnCjHDNIOAZbG3zs3FO0IJL98p05hd:mdPUcUUbndOia9
- TLSH
  T1C5C59D87A3B510A9C5BBC178C6575707EBF1B4151320ABEB06A08A792F63FF1663B311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  avutil-59.dll
- Size 1.1MB
- SHA256 e1e7654a0a5162467c662c3e8feabe024742cd34b82a1ae49d0d763473a65630
- MD5 6204bb9f538c8c8fe48e0d43901600f5
- SHA1 f8953d2e52ed0a0e7cbf647a517e3662b055d5ba
- SHA512 db6a6ff031d89158203e10d189636ab63b9c0cc843bcf1f7e90657c07ba66144073ff35cf255b43e095d4d55c416c55d22f6567de5390fc4f392aac4f2df089a
- SSDEEP 24576:FDwuT+iLgt4qEuoZMyJYnGgILOK8POpeq:FUOVLgt4qIZMyJUInd
- TLSH
  T173457E4596E104B6C86A4534D267954AF2723412C760BAFF23E14A683F23FD21DBFB36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  brotlicommon.dll
- Size 148KB
- SHA256 f6569b5665ba22f3dc2bb8c2ee88f7313a2bd2c2b138dbf1f25a6a7401b89d4e
- MD5 084a288a44f725815192f35b0530bf64
- SHA1 d6137c124710213c9bc09937b4c3a0ccdf7a246b
- SHA512 afae2355422f3b882f497a75c9e9781963fcaabac25f0ed0c602633358dab3bb3310f11ee321860f4ac01a1bf306af4fb4b809fa5f388b6a82166279a0ac4c53
- SSDEEP 3072:ujk4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBSe:ujk4AhdNorGvHdbi09GJI
- TLSH
  T1F7E38DA1B3150337C25B227AD499ABB9F33582B593630561B4A9026D20C3DE4973F7FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  brotlidec.dll
- Size 64KB
- SHA256 dc67799ac2d2911d22e4b695b78c2756bbb93867a69b1f5c0af1eaa84b5417dc
- MD5 74382ae126a990eb06f3ef24882cd6fe
- SHA1 7d08d181392fac99f57eeb867111e491c6975038
- SHA512 50cf882037593564e0bed198c87637aad6603d6ba7b486c6e79b7e206b9b3754ade05042131d13dfc7f9f8327615776de7c4ac737ec8d2952cf7c5eda9ef87a1
- SSDEEP 768:gi22J2umqzaNLlJNYpyh6ADc23V8YylazQxARbYs3Mg36f+MWPuBL2Ip4qFiTxfV:gyReNEyh6oz3V8YyGjeZi9qF6fILQl
- TLSH
  T1A2537D82A6A54A4EEE13C234C3BBE25BE3BAB49A6344E3F761A0F5311F137D06375154
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  bz2.dll
- Size 88KB
- SHA256 5e91a5196e4d064bd4e5775a23665de435f0e1ceeaa4dfb9dd645fba929687fe
- MD5 06280d5f0c750598f6d1be393d880751
- SHA1 d0e72c29c925037e0fbb36f06e5bcbdb80767da4
- SHA512 828e96bc8087319b6c551a978cdb326c896c56c6ce8ecbb2cc282ed4cb8666d34325307833295470a529fdb27defc92af512ec83a6314b60337de84a8b525f60
- SSDEEP 1536:P1uS1dcv95FBSQhLHNUgViZ/273Dd96lrD0XO7vE8nZi9GfIbHDX5:BkhHNJ8p2r8r2O7vXaTl
- TLSH
  T160937C4576A7AB7DC99B853846A30A4BEF35FE740B5017FF20A0927A1B13BD10FB8215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  cares.dll
- Size 209KB
- SHA256 25ea29afb0ae68ebe17406d2a6e3c8790970aedb6bbcf7efb1c81c52e08335bf
- MD5 7b44948d51f47e93e584256ea393c213
- SHA1 68863e30073f9b97f3f9f3200cb480161427923e
- SHA512 418920f310466e4578676ade4794529a96242bee368156d24a7478f6428a8ad8ef0aac69fb98875c6faf9afb68dab85995b31fee5cdc804aa1ebb030ef4f092d
- SSDEEP 6144:Pk6R5/ZMP4VBVP+R+Us9vqkt1e+z7HBKG9Pnvet:PkuZMPu2+UmvfK
- TLSH
  T119244C5772E40079E567D13CC996A617E2B2B05137209BDF17A08BFA2B13EE7663E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  charset-1.dll
- Size 25KB
- SHA256 107faf09c20858211b2854d88a0d698f77c74dee6993fe393935dcaf5227db6e
- MD5 a4474d07828fd79e5a9703525d270bf7
- SHA1 bb57ff09ce2b90d2fd7cfd5547756e65de8a02c1
- SHA512 49e6cf7762c2ac0de22c6c5bcf10febebe08810f5057475225f057d2dd5b136f06c3cf6f699495b1b59e679dc8f0bb63310eead8bf9f3932dea6b7fdce014c4e
- SSDEEP 768:z7A5L7nxvf+MWPuBL2Ip44Txf1ml6Z+7EXNgtQ8:z4TxnZi9EfILE87
- TLSH
  T14AC28EDA992844A7EE139A70C5F6ED87B17CF7D32951DAAB0171E2500C533D1B32E25C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  comerr64.dll
- Size 34KB
- SHA256 518979b1b664d5e4949d9bd8182c694dc42fb508e847ea6f65905dbe3a252f72
- MD5 ba3a4f8000a174ca8f0bb7000ee3f780
- SHA1 8c66a7190df85e586ca3c93b5985b611d84d0d37
- SHA512 224af1149a89353f4f88ca664eed2a4d0937521e7ea8e33f69044ed0e4831b1a6fe4fac81d288b9205c01fdb147bd139a18379c7575cbac99b1727d43251fd75
- SSDEEP 768:a2hzcePwoExG4/nMSf+MWPuBL2Ip40Txf1mlIJNp4:a2hzVPYl/M2Zi9ofIkNO
- TLSH
  T1CAF25BCE679411D6EAB6AA34C2F1EA27F03177939B32938F1A5055550E327C1EB2CF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 462cf06a08b3a61a6f5480f63514c17ea60efb4e6013777051e88b0ad8aae91e
- MD5 fc6238295e7f6e6f1a9aa460759aa073
- SHA1 a519804ea592d6be8e105451512bbcaf91530000
- SHA512 429ab729eef1cc63e92937f9cf279079227c980b661e1714f58f096e155cdcf68f237916327607c524afd96b6de54a2644abe4aa37a586fe98bd6c557dec25a1
- SSDEEP 49152:CgIUeJ6SHrsy88FyhwEwI9NM21cUpnQYmpFfUxWYA3B+EBasSeloY9+asXqG1FOo:gHrs/UHVIHpvgxFQnll/YKD
- TLSH
  T1A6269D56B7E850E9C5BBD138CA87861BE7B1B80503305BDF02508769AF73BD16A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  dumpcap.exe
- Size 553KB
- SHA256 05f530bd9d0ae4dccfcd37f3effd90b3151ed17c25fb5a54f83e5bece34f67fa
- MD5 cb7e8384205d603808599c153dc716cd
- SHA1 73fb17df4b01cdc594ace6ebb115c2db24ccdd4c
- SHA512 8094f97ea061f25fbd06afe7611b4c62e736f24d09da68056bcec1292b1c316574da9f9c21bb3b535b02b7a7a03e9f08f5748c9c43a1bb3a33129fc5fe81fe59
- SSDEEP 12288:p1tt5KiBErTqpFRdweORJ+OI4VZzW6jRXjNjFP9:JtYqErTTRJ+OI4VZq6jlVB
- TLSH
  T1A3C4299477C5D9E2DEA2113A8003B375A5732EEC57A0A1CFBB5CB70237339D865BA058
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  dumpcap.html
- Size 30KB
- SHA256 81c0a1953874b635bbdb82b68661489fe477efe897e42839c52cfc155ba7ab19
- MD5 1602559a56f263812362b02fec65c603
- SHA1 3410d8c166fcce27ceeecfaf0ddaf9250257d4f6
- SHA512 18c0ab9941fdf5afdc37b97661a039f28489a2edccbb4598c09e66b78b723da3a9d0ccde5a01dde0c02e6b895a6c04a306faa6a36e6fc824840318c09916a951
- SSDEEP 768:IyJVW4NALj3SBgYQTnu+Oz28wasYwVKoI:hW4NAPSBgYQru+Oz29asnI
- TLSH
  T16BE2441AA54153B70CE222D1B2382FAFF75595ACF5E725C821EFC3B42341CA2D5BAD90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  dxcompiler.dll
- Size 13.7MB
- SHA256 6bc08db66d2aa4b7e560887b8119d1fbe24b0bc67eec88b19b1965e3ddbcd7fd
- MD5 72ada0a4480713c474a2d56e314890fe
- SHA1 ed9853cc76285931611f572a03822a7ab3ba6559
- SHA512 b56b7d5551e3a202f82d924e6ea4a0a26643d1c2ecc58be5fa27becdf48f0381eeab209a04bff09ce04d214727a5072d8dbe52a719698e6b8be0342d14898368
- SSDEEP 196608:ZVuuN4XBv/n0v3IOEekXX7c89Pr9Uic0mMZj2eFGReU69aN2z:jX4XB3n0fI1ekXX7c89P/lTEeFAeU6z
- TLSH
  T118E69E2A21EC41E9C4BFD074CA178917FBF2745603B0A78F06B446A62F677B1663E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  dxil.dll
- Size 1.4MB
- SHA256 7ebd588bd4c05033842bf5c5de5f963adcf9f8c721ac41fe6ab5bd88c65b9112
- MD5 734e94320ee1fd38c636c715616d2afa
- SHA1 b545346012730e0f847943a3de568aa3eba487d7
- SHA512 a19be8249b31205b7e8501e820aea6ad64b1f19701192ecdaeda7048c661880b38a88d5bedc06cddf15b770dfb76de89ffc72945d70c9abcc6c4cdf974cdb71a
- SSDEEP 24576:lCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrY:lCfhbh3v3mtEAQrW41obCraeRhy9ou6C
- TLSH
  T1B5658D1B229801B5D4BBD178DE578E0BE6B2B41503709BCF12F006A62F2BBF55A7E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  extcap.html
- Size 10KB
- SHA256 060c11c999b510bac0fae491ea1e1e59f03985e23285e5383a5f508af2a8751c
- MD5 a3e3e86a1b918109391e712a233ca7f5
- SHA1 408c39c9ec18c325b7ff9336bf94333170f03469
- SHA512 bbeea3bdf3694cfa6c72e709f3fa064e7dff49fb612279498122bbaa8d2f952fed098f3d3258e2ef860157cae732d269bc1d7bc4d537190b41493f31226085a4
- SSDEEP 192:vUL8i2xjZgel9sNsDnx/6cqXpuxAX4ikKFa1a4An0kOhZiE:vUr2lZHl9H8X4j5qBVE
- TLSH
  T142227423A440137305C382C0BB7A2FABF6A5DA28F86724DC95F943984783DD7C5EA5A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  generic/qtuiotouchplugin.dll
- Size 102KB
- SHA256 e2a9f048b38cbf1940d2789fe8ae1900052218731703fe597bbed33a159ef971
- MD5 879a8e733a5a9b70fd0c69bbc2386c8f
- SHA1 648613f89de748acc5c4ae692d3712022e3100b4
- SHA512 470c803677775ef6449e63358d66a00d8350826555021f8d3976bc55455db72eb68542ffc70c2bce79abbc2fc921f3a52291dc6cb7223ef5d28d6490d77aa46e
- SSDEEP 3072:MQE90V6rxM8EX8F84Df5qdd95lQoiaobaHf:MnmyM8dyiaog
- TLSH
  T107A36BBB52A042D6D96AD279C79A8507F372B15517319FDF02A496490F33BE22F3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks for common network interception software

Drops file in Drivers directory

Adds Run key to start application

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32