c42efad041d4c0bb4d4ac97ae7cbe89f153ec1fe078772392e749c7f5d5282d3

Sharing

Copy URL Twitter E-mail

General

Target
Everything-1.4.1.1032.x64-Setup.exe
Size 1.9MB
Sample260727-rdknvst1cs
SHA256 c42efad041d4c0bb4d4ac97ae7cbe89f153ec1fe078772392e749c7f5d5282d3
MD5 3fb552bbea367207655a6868622a6da9
SHA1 a454fa6f044b8dd3a338652fe53cea28500a0c04
SHA512 1e914dc40a12368d5e272ee78b092ef4f0786408af40b1eba78ffaef243220affdde000799853e5a056a33b6dade647339a15ddac859ce72c001e817c29337c1
SSDEEP 49152:z4ijEfHi9iisLxe0ciIxoFujij8vZ6HE9+0z5kmU:z49vi97sle/aFGuNkU0z5bU
TLSH
T116952364A380D26BD1061974C8E9A36262D6FD36551142EF73A0BF7EBD787C3BE42312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Targets

- Target
  Everything-1.4.1.1032.x64-Setup.exe
- Size 1.9MB
- SHA256 c42efad041d4c0bb4d4ac97ae7cbe89f153ec1fe078772392e749c7f5d5282d3
- MD5 3fb552bbea367207655a6868622a6da9
- SHA1 a454fa6f044b8dd3a338652fe53cea28500a0c04
- SHA512 1e914dc40a12368d5e272ee78b092ef4f0786408af40b1eba78ffaef243220affdde000799853e5a056a33b6dade647339a15ddac859ce72c001e817c29337c1
- SSDEEP 49152:z4ijEfHi9iisLxe0ciIxoFujij8vZ6HE9+0z5kmU:z49vi97sle/aFGuNkU0z5bU
- TLSH
  T116952364A380D26BD1061974C8E9A36262D6FD36551142EF73A0BF7EBD787C3BE42312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Everything/License.txt
- Size 2KB
- SHA256 50fea29fabe12533c4e43407e12f549b8c3a2d250fe13b961623147acb1c25b2
- MD5 5712d51214f8cf6915ed3d01b40a3555
- SHA1 b829999a6b61b916abd84472ce9c0a0a3c8e5f39
- SHA512 34281b8a580fd98eea0a22d12471f07c2e27f3144e715e018ebe4f877233c3d95105f7394762fe2cc2071ec4ffd2cd5e2f5a1333dfff12778a27966927395bb9
- TLSH
  T1A551985B33810BB318E21350656ABDC4B29DE02E3E676E04287DF348533B42DC9FB844
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/Everything/everything.exe
- Size 2.2MB
- SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
- MD5 464df9e59802fb4d6f4a0c743a5ded94
- SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
- SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
- SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
- TLSH
  T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
- MD5 ece25721125d55aa26cdfe019c871476
- SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
- SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
- SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
- TLSH
  T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/InstallOptions.ini
- Size 754B
- SHA256 b520532ce65105e5414423491084a05eec67add6ca5fef67b56bb9866c07bb95
- MD5 f4b7ea54a35fe41eb4abb5f9e53cd9dd
- SHA1 34f28f80c6c1d5d5656d42eaa5ad1fd7794eb939
- SHA512 5734c29dc499935171bfe45d7d7b667d11ae1dbda97dd8d72dfd65320e8194eb8daadd085c34749c01aa27dd3010102b0b7dbb3f0503e0279510683ec8f0668d
- TLSH
  T1BB01DDC8504193799870D446287F2DDEBB51643C39423CD4F2A154C3DFC9DE63DAC289
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/InstallOptions2.ini
- Size 1017B
- SHA256 6003368f4183b166539c96b734c01595a9d1b1494c11f16aedefe8ad68e9cfa8
- MD5 2d388f85f070760e18ec39c0df0980db
- SHA1 39428de0b440531f7544b4ea5e7e21df32317815
- SHA512 04b02c6954b87852471c0e5fe5ec32fe2b5a228390c0b03604250c60aa1e7dcfa0d92775ddf1bd45ca17c2ddd62788d151ebdd9af884dac64031a97ed4a4b3c1
- TLSH
  T1DF11B4959502913DBD30910139BF7AC16BA029242F011864F5E218C3DBD9CE76CBE1D9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH
  T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20