Overview

overview

7

Static

static

7

Ambrosial.exe

windows10-2004-x64

7

Ambrosial.exe

windows11-ltsc_2024-x64

7

costura.dll

windows10-2004-x64

1

costura.dll

windows11-ltsc_2024-x64

1

costura.pdb

windows10-2004-x64

3

costura.pdb

windows11-ltsc_2024-x64

3

discordrpc.dll

windows10-2004-x64

1

discordrpc.dll

windows11-ltsc_2024-x64

1

guna.ui2.dll

windows10-2004-x64

1

guna.ui2.dll

windows11-ltsc_2024-x64

1

microsoft....es.dll

windows10-2004-x64

1

microsoft....es.dll

windows11-ltsc_2024-x64

1

newtonsoft.json.dll

windows10-2004-x64

1

newtonsoft.json.dll

windows11-ltsc_2024-x64

1

system.buffers.dll

windows10-2004-x64

1

system.buffers.dll

windows11-ltsc_2024-x64

1

system.dia...ce.dll

windows10-2004-x64

1

system.dia...ce.dll

windows11-ltsc_2024-x64

1

system.memory.dll

windows10-2004-x64

1

system.memory.dll

windows11-ltsc_2024-x64

1

system.num...rs.dll

windows10-2004-x64

1

system.num...rs.dll

windows11-ltsc_2024-x64

1

system.run...fe.dll

windows10-2004-x64

1

system.run...fe.dll

windows11-ltsc_2024-x64

1

system.tex...eb.dll

windows10-2004-x64

1

system.tex...eb.dll

windows11-ltsc_2024-x64

1

system.text.json.dll

windows10-2004-x64

1

system.text.json.dll

windows11-ltsc_2024-x64

1

system.thr...ns.dll

windows10-2004-x64

1

system.thr...ns.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Ambrosial.exe
  • Size 15.9MB
  • Sample260728-asdenagq2y
  • SHA256 6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
agilenetexecution

Malware Config

Targets

    • Target
      Ambrosial.exe
    • Size 15.9MB
    • SHA256 6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    agilenet

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2
    • Target
      costura.dll
    • Size 4KB
    • SHA256 ad9a110c8dad457c6f8fca566e88bc12b5eec24debee15d856920b569cf61700
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      costura.pdb
    • Size 2KB
    • SHA256 e8887cf55207455c2873a5aa4ceb40be0d5c5e6308e9137067c4a9659facbf2f
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      discordrpc.dll
    • Size 84KB
    • SHA256 ef994aaf5979ee29ad073972f93fe2c0b6564b1df144edd030515feebfb9b736
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      guna.ui2.dll
    • Size 1.9MB
    • SHA256 25ab13005a5b8020f86e59dae31728937cf93de879baee7a12c1b32a9530e564
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      microsoft.bcl.asyncinterfaces.dll
    • Size 20KB
    • SHA256 ed5bc605f7f9fcc382183abef06c354dad946abb42a07631712077b2157d6bc9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      newtonsoft.json.dll
    • Size 685KB
    • SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      system.buffers.dll
    • Size 27KB
    • SHA256 72b10a7d404778fed460f3ff0204cf7e81a8a5a79c99132821928b63f6ae99cb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      system.diagnostics.diagnosticsource.dll
    • Size 34KB
    • SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      system.memory.dll
    • Size 145KB
    • SHA256 41b5e1a4c59abdb1ce1467f58c3d9fd06d39dff4fc61d500a2410fece8037f4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      system.numerics.vectors.dll
    • Size 113KB
    • SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      system.runtime.compilerservices.unsafe.dll
    • Size 16KB
    • SHA256 92d535dd1653250da662c3a5b92943c8030651176c81a509cd74e2b4bec26cff
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      system.text.encodings.web.dll
    • Size 56KB
    • SHA256 a0ca4a931340c9bb6fb5d0c94d5cdfbb09129dd0658f035ea5ca17c1b56ccc0d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      system.text.json.dll
    • Size 285KB
    • SHA256 c363ffd829feb879158a3118df583955ad43b1f64ef417328292f5153e47119d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      system.threading.tasks.extensions.dll
    • Size 32KB
    • SHA256 2c9cad6410e37e44fa73cccb576f418184f1ae5a0a257e165a136bdaa941a0c6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30

MITRE ATT&CK Enterprise v16

Tasks