fda839f35d9f8f18a11670e17d0332ce9d05a3556c5a20e91b0b56c57774f611

Sharing

Copy URL Twitter E-mail

General

Target
nmap-7.99-setup.exe
Size 35.2MB
Sample260727-deacmavcqd
SHA256 fda839f35d9f8f18a11670e17d0332ce9d05a3556c5a20e91b0b56c57774f611
MD5 ab2854d90d342bc22ceb1d88b38736cd
SHA1 88a591b2d1b7019d6f85686db82201ab07a38ae3
SHA512 af07f61306ba6c4b41a553b03f7626b2566ad9ec3fee66d478aa7ae3d7634be3ef33913594725dd8242db252644747fcc757eb8aea95b07d45fe8879697ff647
SSDEEP 786432:awhBLkfvX3EE713WeJXJC+fvHEFTAE729OJFE7AI:awhBC3Z79xXcmclAw2BJ
TLSH
T13B87334B301D6665D35437BEAAE3BC723627EB563146E30235CD234D0B7B21DD39AA22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nmap-7.99-setup.exe
- Size 35.2MB
- SHA256 fda839f35d9f8f18a11670e17d0332ce9d05a3556c5a20e91b0b56c57774f611
- MD5 ab2854d90d342bc22ceb1d88b38736cd
- SHA1 88a591b2d1b7019d6f85686db82201ab07a38ae3
- SHA512 af07f61306ba6c4b41a553b03f7626b2566ad9ec3fee66d478aa7ae3d7634be3ef33913594725dd8242db252644747fcc757eb8aea95b07d45fe8879697ff647
- SSDEEP 786432:awhBLkfvX3EE713WeJXJC+fvHEFTAE729OJFE7AI:awhBC3Z79xXcmclAw2BJ
- TLSH
  T13B87334B301D6665D35437BEAAE3BC723627EB563146E30235CD234D0B7B21DD39AA22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  zenmap/lib/python3.14/__future__.pyc
- Size 4KB
- SHA256 79f27ebdc9ba2e9d995211ee08af9aaa59200262a3bd15a64cef0129f156c421
- MD5 85176f9c376fb1b4f447e067f067792d
- SHA1 b64397f8d46b02e62ac3aec9bde828e73f84ee56
- SHA512 127ecf34e843ca306c1786b6fe2f69b0c3293e3c18d9cb9f05e5efdad8c99eb2e01304ecb067ede3f4c8dff29a420cdcde4625e589fd36a3719a83932b4e4589
- SSDEEP 96:yhdINzUuGd+P2scvNDdsBWxczgHAleC5hlR4Xa2iuryoVVo:yM4BpifWehlyXa2iuFPo
- TLSH
  T1CFA1C61A2184467BF983F0F2E6895281EF19C5BE9B61113B705C02493FC7DB08F3789A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  zenmap/lib/python3.14/_aix_support.pyc
- Size 4KB
- SHA256 d254a5a6f0ce804ee175b441d69dde3168892255a5fc27b0cdadf3f42ac73717
- MD5 197248b77941094684eaba13d4cb18cb
- SHA1 2db2d01a7b5d1531cd682915634efec838734a2a
- SHA512 bfbbaa22706669f1e9a7736d361588ac5b912031c20308a25d9d37c55e8cc799ca7ce32b06afbe7e34abb82cba5d9ba84384632e8a255e3193e4d1f6b9a00173
- SSDEEP 96:0/tDAdBEkTR2B+wqRzNV6X/tfVwt2G+VN52123:0FUVTR2YBNs9Vw4G0Y1k
- TLSH
  T1F1A1D5590A881A73EDE18134309F69CADF32C4BA1A44C783D0A50E1D6CAB735A8AB65C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  zenmap/lib/python3.14/_ast_unparse.pyc
- Size 72KB
- SHA256 65ba1feb27423850173b72a44e6fe80ce7e7c392143f1d1ad49ff08b0998aebb
- MD5 02cdba3ba67ac3e5a672cd4b655a02d0
- SHA1 e42d7929e61bd48de4b25158f4c6ca63e77b3ae9
- SHA512 ea6014f5f8c3517880111170b90e70aa71bef80179f1b7e91d14e4c1e5dcb35c0e68dc696209eeace8c03ab8402bc1bfa569cac252dbf94e6f430c59642b8e5e
- SSDEEP 768:uwSp6K7zIw1/3KIf5fyf93Pvfpf2NoeA8qHZnoJ46IKNWIwSYo:uu6xfxfWBPXpoop8yxoJ46ttn
- TLSH
  T1F67360BAA868640BF9DEB57835D7A990E721E005B340C793D13044FEBDEC360D9A974E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  zenmap/lib/python3.14/_collections_abc.pyc
- Size 46KB
- SHA256 9aea0540523f2ab5e079df92b7d4e5941e64f65188901f9bb99b0a82623bbc24
- MD5 b0b24ae1639a4014b96593c6659b1492
- SHA1 19d01c1da6e11d2cb3f5b9de0f6e96bbaa7163bb
- SHA512 b0fcca5f352ec540b8563fc4570935fc313bf5177a027cf991c9dceeb953d9b2bb25cf122d0f54c3c90d48fb802053a0be9e9e6e017198b98547bea4ee4e62bd
- SSDEEP 768:qThCX9uxRpq+zexmF6xyiECG9FYQIBqAwL1q4MbKe9ymes1jI:qThCX9uxRpqdqmECGnYQIBqzL1q4Mbh8
- TLSH
  T16F23A49576E15927FDAAF43920639905E727C052F300C353A97E58AFFC3A6808E7798C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  zenmap/lib/python3.14/_colorize.pyc
- Size 18KB
- SHA256 0e4535d36e8e32007399f1b5e0dcad0320f4f1c8cffdf589b8b955c6b049c360
- MD5 61b702616bfe41702dc6dfef6fa318b0
- SHA1 7faa9e8b1bec6902adbbf821ed30382045a7c4ab
- SHA512 5f908a6c4d412928fd59c294ab98820ec80dd903300a94adb6abd6c752b5a4f478326c4ae5a2abadb129a768a363efce93f76825d799e4a3337ae6bd461572b0
- SSDEEP 384:Tx0UyaYMQBHpiwL9KiMKTZC5L9Tu6Ugayw1rO:OGYMQuuIdKTc5A6U/C
- TLSH
  T1D982A7D9B3C8DA17FC69F9B92287C705BB359241E9009363E2304C794C696A19FBF51C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  zenmap/lib/python3.14/_compat_pickle.pyc
- Size 7KB
- SHA256 ccc8dfc2952fd754318138426d5a89c7df7a46434e5789464b24be412151ce25
- MD5 05847ff8636dd780ed0d26eb384546d1
- SHA1 17277b78c0da25cab87a242f72b3531bfb034a2d
- SHA512 5bb50b1eabca9dcd86af9ac381a6bde7b1481d38a10e20a000d0535d48dcd6f80900c50bbec6282245d8db0a29779b366e7d79db89d264134c7ee089f2de44ed
- SSDEEP 192:tuMaDWhQraaKEoGa3UNWReGtnwNDy5cQz8:t9yOEv/N25JY
- TLSH
  T189E1A6463F0860D7FFE8B7B727A0C769535C05946290F17299F49E1A4E9CA01DD2126E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  zenmap/lib/python3.14/_ios_support.pyc
- Size 2KB
- SHA256 e9e5096e110d3eb1ff9dd088a38989f4aee46450c6a484264038d6007484faaf
- MD5 c8fe8cf5da6269eff14e08aa259f077e
- SHA1 ee0ef0a661b46a59e474a5a6c7c0c1225a7c2624
- SHA512 29657acea887a590fc098f7cc40c7a28acb7023b09ee7363a49bfaa4c3221e42e5a93a501e6ef24f23d17da9f53e86c53de01d48323448691805d3e33e6ef172
- TLSH
  T1235151F604204A63DAC9E1712CF207E86F77C5C69C65E2A6F5C80C366E9D199013233C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  zenmap/lib/python3.14/_opcode_metadata.pyc
- Size 10KB
- SHA256 7dcf2b852e6bf630f44a23d7c7c63ac3670ae836bf34922c79b1dd2e743c519c
- MD5 c4910d0c2bcb0d6f4549d8a4b8f6f1d8
- SHA1 4416b4c0b6257b20bc2fde75b2097725e1f82fd3
- SHA512 a9d25ea7d98643007c219b845d74c671ad02186dc938e4271d74373946455449d0ffe46cb0bac2752a3b9cdc647985306437624cfc9ff660e5dfec285ecaa65a
- SSDEEP 192:vVI1ZQ1DGAS+BD2RW9n00BPnkGsg5i57O6uB3uoDmIXhO3S/7MuG9MeF:NI1CDARu00Bc+5i57OZB+oDmhizMrRF
- TLSH
  T13C2271B8FD8A27E16E81F47C2F50A663F5AAD558FEB006B1C4D3940D2087A47FC0AC85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  zenmap/lib/python3.14/_osx_support.pyc
- Size 18KB
- SHA256 0bdc0380115871b15a3ce15c0c0b4003bfba2ebe9ace69edd9da360a5a98f534
- MD5 8f22666b58d648925a478fc880945656
- SHA1 4a7e1a4c64338c435b0a728311ba5b4009b0e795
- SHA512 d227daedae147fbd1c94a46664b98f55df9757bb336162743f30b11f55de670db3d669bf4ca45631c57b61c5bdd0bd9329501ad64e0be4001cfeb099094819f6
- SSDEEP 384:QNxA7FICfQunKqSlV/IEMNk2vKO9g+QCT2LFiv:GZNqSYb6+AFs
- TLSH
  T1EE8207BCD6806537FCD9A178A2EB1985DB22C1929208F743E0189D75ECCE64CE67735C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  zenmap/lib/python3.14/_py_abc.pyc
- Size 7KB
- SHA256 4bab71b3f29f9b69940b570aacc05297b24fe485ed994f601ac05e9100d9ea53
- MD5 31aaefd6a3b6335bba9b5a062f4ae1d8
- SHA1 8f94c4ac3f947097a2ba6af88afa8229e7038aba
- SHA512 2ae6c4f830c167a5e72e38b4bcf8841134d9b6a2c25ed72a60149c9170c9f802dbbcc56b8eb4b3886e0190ddd9ad4eee2f7b919af5c74393216258f8dd6a9d3d
- SSDEEP 192:Rm4ezIhXMf329es1j/BM3N0QBqCqiCmy7ZIHb820:Rm4gIHXlQhCmYZIV0
- TLSH
  T130E1E7289A81B97FFDCFF07A7473A995A3138447A310C743C9B548ACAC0A656D0E256C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  zenmap/lib/python3.14/_py_warnings.pyc
- Size 36KB
- SHA256 d1b7f7d0e9101beefc7ce09743532abab3b225980d9a7b219eaaf502a7cd8db3
- MD5 0aff2a65f017cdef7f97230ac759ac7e
- SHA1 98254caa1b40701b0a6435da999319331b7bf7eb
- SHA512 3185f343e925d3c144f7b7c787e8ffc649c772e6d002c7047aeedd0403f77fd3a93c3008d8e835875fc8e746d20a5019ad264dad5be7267acb2029d312458d5e
- SSDEEP 768:uEz123BJmtuN3KQaTIqKQujPrtlRP9Dkhfx/P6xPca:3I3mtuN3KQaTIqLujztVg3/PY
- TLSH
  T1D9F2F8B4A5806627FE89F5F931E3988AD322C047A302D303D13C99BE7DDE6948A7571D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  zenmap/lib/python3.14/_pydatetime.pyc
- Size 99KB
- SHA256 d0dcbca8d523717c89a1807c6e1592b0d09d07bae8d38e23378f7c01bdd3abd4
- MD5 02ceed3a530c8893ce73c40ca6bbeca9
- SHA1 285bfa8c2030e7beeff2b883fa32e0795bfca9c9
- SHA512 4e3642d5901fb5fe47eac04db9857134969bafafb46e298b1d6985330dd6661b27d6c5af54adbf922fdcae830c8c771016845806daf1a3f57a45684f6a9951af
- SSDEEP 1536:ZGdKIPagbNs9w+AiH1IUgS811WlcUaGzCChy3ez30EaxhbxQq:QcIGwAVIE810i6hseaF
- TLSH
  T18FA3D7A4B9B4182BFCAAB03576F73981F732E05A4304DB43D53D4EA67CA5B24DC2568C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  zenmap/lib/python3.14/_pydecimal.pyc
- Size 221KB
- SHA256 41ceaa4915b58843aea03031c5b682665871e5a13dedbced4a48335178bbf720
- MD5 1b9de1474e5ecf79d3085eee2b595d0c
- SHA1 e2e82ca8e0d1f19b1ccc692f80753090e606a07f
- SHA512 1606d6a1ba5132da403bff30ed97868927a2ea32c109ade6fd0838444909c71703a96cb964f7c43f773e287a591f4b2cff196dd424fbb99746dce4bd2a26c831
- SSDEEP 6144:+EGAOaQ4BDWKlVjzwm8RHRaAnLwayUcj2w:OtzKl65RaUc2w
- TLSH
  T19024B87897D65523F87EB43833AF34C1F722A0394288C653D46C8C68BEC6E69D5259BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  zenmap/lib/python3.14/_pyrepl/__init__.pyc
- Size 136B
- SHA256 bab5acb95ee4330c27c30210bbea219dca06965f54fecd07d7d01ffecf9e965a
- MD5 b5aef5c56b06e4cd96af938ad9754e08
- SHA1 7a48395e1f9be54f4a61405b1e7f141420749f9e
- SHA512 8060892528a5bd425f9997c78a63ee4c0ab56997e386033cdaaa3084ee4d436cd90c6816cf5ab96969b176cbc1c251524ac7b3b79d88539d230079086244d8cc
- TLSH
  T10BC092026562D99BE969A074A87B931E77A289DD81B881CF2A2AB4AE0DED5400CD2604
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  zenmap/lib/python3.14/_pyrepl/pager.pyc
- Size 11KB
- SHA256 b553154f6972551dbf860bafff96c1814fe5bb758517315bd98277f36ca2148e
- MD5 9a706a03ebea88d8473cb2e5c3ac063a
- SHA1 a0fc5fb3a168e10dd635fd01064ad6020abf8a18
- SHA512 0d5e1ea240b1838452d286a57c7ab5a15a0f9ac8c349510a1c317d9fb61f13cdd8481f8a564e3c53525d5ab07dd803441fd757f31ccc638d4081f6c00c2d8392
- SSDEEP 192:Lg4c0L41EYtnq5glcPqDUqX2qZHAPM9zrtSAwRqDn5q98/6qLOSbVB:E4xYJqelSqIqGqZganMhq9qXqLj
- TLSH
  T13932B7ECDA408627F9E9F9B820D3D914B732C14625059323F234ACBE2CDD3556AE162E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32