993661e8042eb21918eb1dab76acae28b6d9351957a9529facbde38bad764d48

Sharing

Copy URL Twitter E-mail

General

Target
Balance Client Extension.zip
Size 36KB
Sample260728-211npsycph
SHA256 993661e8042eb21918eb1dab76acae28b6d9351957a9529facbde38bad764d48
MD5 de16ceeedc6242ecf344ccb52d9b6996
SHA1 48a217150f4049ea26679d16d66b405772fbceaf
SHA512 a4b562da97592328898387b66eb0d3daab93cfd6285b2d44fb94ea5c5491be17216c4558409f06da5296a60461faef5f2552b5d6461f7cbea7e9b31ae2534cf9
SSDEEP 768:1QkEMXN4EPBkhdW75ic137yWALhddTI9r/UDMMrvC3f2gq:vHNRPShdoocUWccdAMGvCv5q
TLSH
T10BF2F1BF5B8F34B4DD07AE7544D8A00B634D0050BA07BA27C0D9728EEA965589FDE293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Balance Client Extension.zip
- Size 36KB
- SHA256 993661e8042eb21918eb1dab76acae28b6d9351957a9529facbde38bad764d48
- MD5 de16ceeedc6242ecf344ccb52d9b6996
- SHA1 48a217150f4049ea26679d16d66b405772fbceaf
- SHA512 a4b562da97592328898387b66eb0d3daab93cfd6285b2d44fb94ea5c5491be17216c4558409f06da5296a60461faef5f2552b5d6461f7cbea7e9b31ae2534cf9
- SSDEEP 768:1QkEMXN4EPBkhdW75ic137yWALhddTI9r/UDMMrvC3f2gq:vHNRPShdoocUWccdAMGvCv5q
- TLSH
  T10BF2F1BF5B8F34B4DD07AE7544D8A00B634D0050BA07BA27C0D9728EEA965589FDE293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Balance Client Extension/icon128.png
- Size 502B
- SHA256 5d5960937c4f565751568d9e6feba6cbdc259ca4e00862420187ef9346080050
- MD5 dbb89cce4b9fb36c1e2fd0bcc9f1debb
- SHA1 aa0595af97ec5e6a1ebca3531ef39964bccd1c8e
- SHA512 57d2fd6cccf3cfbcc0c7d6d29345cc346a7c623a609a8f11254a5aa86db6bd9ca3632e797300893affd31010828c757e1de13eb69810001a566fd9ccf22ba4f1
- TLSH
  T106F012D0E10D65BF9D05273175D3B230DCE356078E7145087CE6DD08C9D8E473263609
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Balance Client Extension/icon16.png
- Size 891B
- SHA256 699e2c0b55fe433c27df71d6aa0300ffc6b500b63b8eea2b6296bd0ccf5f44b4
- MD5 fb3c1bb9db6b8faa9aba5cba315cb2d7
- SHA1 bb697ea46012b6580d5c7684660c5247ca0c4c0e
- SHA512 1d931ec3de05a2bec283ee7b52e3136d351ad254f312015a9a861e28b02d3054dbf3273bdb302dbdb30e20184e1c1b4f0abfd1229a0affd5b3ee0be1534274e7
- TLSH
  T1E111522E9B170E60EDF399F75111C3A2D3EE76893097230B54B58174B5508C59A1451C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Balance Client Extension/icon48.png
- Size 2KB
- SHA256 71a7b4eae6c5a0c4b299084b1f915aa9ec1f790d330ea9bf042287ceb2a22858
- MD5 272a882682591495cdf4c13a848e97e9
- SHA1 720bd4ca43f548d7cc130c9d13e5d9e4294a1092
- SHA512 3f8a087428b964b01bf6190a728ced466f14c9e77d3c1ae35914a0cf58bdc37865b97ef15a4afe3a11f654e7568c549d43f384ee9749c485db717b823ebd12d9
- TLSH
  T1A2412BA72E923F92AEC5D4799153D066EE54A101B58361B815E052C8F500D8F8A0EB98
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Balance Client Extension/manifest.json
- Size 593B
- SHA256 86c6fcac89f842181da6ffaa8552c070543f8584ca268503ee76497c0cfaec5b
- MD5 9c3c398e7e9b2d913e007231da88f836
- SHA1 eb2594ad8769be1c796429053b7f5c557af2dd26
- SHA512 1326b3c477f36347b24e1e0ef68a9eb836711575c1f2aa63552db2b99b0dc5b5678778ea9893acd54cf18827bf8f69cf932078a289709eb3de84cadc0e0309ee
- TLSH
  T14FF0FC63D604DC7B03BCC76465B18A01F2591F1F65904C67747A515C8FB09BB059AB98
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Balance Client Extension/popup.html
- Size 2KB
- SHA256 7fa8d62fcc852ce86d86bef957c56745c2aa257c199e4e47e4dff069766fa7b4
- MD5 80dd7e9b075f37fbae64d86910734bb9
- SHA1 eb89ce26a953100e0205e9cb90aa348382078f88
- SHA512 dac7f13819181b55e699fa7dfc18680fd96543efb0699a5d80a01cce03c5b0dab022fad8faf771a0c39c5b3fb535fe05acbd001dd5a193fe794d4b4b205d3cdd
- TLSH
  T149512E19DA84040B70776338FBB38251F7175563C2068F697EAC32B18FB49485CAAECE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Balance Client Extension/popup.js
- Size 82KB
- SHA256 9084200c5d3b27d8d63aee0f6a1a4188eefd6803031e0f5f45116d828a412fcd
- MD5 388a904ca8d499cb1c18e6704c5a13d8
- SHA1 2526662448c2564a7b913cd178d98da094f0c24e
- SHA512 a6f31fc77d84872c3477e96122b1eec1dfe80b6d996eda419d49409bf48a234dd1ea5840d4315862f6da69d80172f37f9b2198703536bbd821d7a9fbe146f939
- SSDEEP 1536:bdUkUnrQsBBlvs4fctCWwm059sFq8XvrNAI6yG/tqhSu:bdxOtdisJ59L876dOSu
- TLSH
  T1E7835181B7C1FC8213475B36732BB6E9E92A4DD97488088FF104BCA4F4AD912FAD5971
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14