693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c

Sharing

Copy URL Twitter E-mail

General

Target
spoofer.7z
Size 716KB
Sample260729-eafjhsv1bv
SHA256 693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c
MD5 11f3fe1a16d72c441965f836db3be5e9
SHA1 c778f88c5ebf777d30efcaad6686afd95a7f1d48
SHA512 30178ece8805df527117820e74c0f42e99dc70c44253656de854e77bbdd0d71f9a0426807d67881228f3637a4df8dfbf5e26b980aa7b2855e7f361dd7de6062b
SSDEEP 12288:LDzMbHGPnKlMirOwpA5X1hEb264ZPG0H8PnK3MJrOgpz5X1hEjZ:fEHnrOwpi1eVM/KrOgpl1ejZ
TLSH
T143F423974E138FCDA79D043583A97A61E60EF73EF64F3F41F0152A81190C0A99991FB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  spoofer.7z
- Size 716KB
- SHA256 693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c
- MD5 11f3fe1a16d72c441965f836db3be5e9
- SHA1 c778f88c5ebf777d30efcaad6686afd95a7f1d48
- SHA512 30178ece8805df527117820e74c0f42e99dc70c44253656de854e77bbdd0d71f9a0426807d67881228f3637a4df8dfbf5e26b980aa7b2855e7f361dd7de6062b
- SSDEEP 12288:LDzMbHGPnKlMirOwpA5X1hEb264ZPG0H8PnK3MJrOgpz5X1hEjZ:fEHnrOwpi1eVM/KrOgpl1ejZ
- TLSH
  T143F423974E138FCDA79D043583A97A61E60EF73EF64F3F41F0152A81190C0A99991FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bin/Debug/net10.0-windows/AMIDEWIN.EXE
- Size 148KB
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH
  T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  bin/Debug/net10.0-windows/net10.0-windows_2.7z
- Size 676KB
- SHA256 f751063f3f89ec7838d268fb9c8a1cf5d1a53e53692f64bab9e628dc1ebe6e49
- MD5 03815f9eb8bebfc7354853df33370da4
- SHA1 cd9f5e32f1adfa4b340acbde13f0d6d613af06a4
- SHA512 e692c7e2114f6c85ddfe3d1b6399538eb22ca1c7099fd1690cb7bc951ff8b02f3617853a18f6e3e6c4c429e07550e339f0ff6174756e70d91d190bab063d5e2b
- SSDEEP 12288:AG5HmPnK6MJrOkpV5X1hEAXG0H8PnK3MJrOgpg5X1hEMf:B5cIrOkpH1eVM/KrOgpC1eg
- TLSH
  T16AE423CB5E074B8DD61E1D7483AA39A5EA0EFB3DDA6F3E41F4152AC1191C0B69801BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  bin/Debug/net10.0-windows/runtimes/win/lib/net10.0/System.Management.dll
- Size 306KB
- SHA256 6a266b7a856baced0e757caf7c2e71649999f1321e7e6ff5df5bdee477d32a2e
- MD5 6d7348721c70a6121bd9361f8e794b9e
- SHA1 13353b674eb95006dc57034bef7167c6a521ea38
- SHA512 ab6b7d4aee822c0e79a41aeddbad8f4ced132c6fceb800c9278a4ec211ab769901bc86a56135e30098087fe6053eb23b58e1f02084d2e9926e7730170ebecc99
- SSDEEP 6144:WSZQ2/bmbrBsj0G2OkLYOgHynXjmxZtwFs:WSq2/bmbrB8RkLYOgcKxZj
- TLSH
  T13464061133F84645E5BF1FBAA4B060A5CFB2B7672D2ED75C0C9168ED18B2780A61335B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  bin/Debug/net10.0-windows/spoofer.deps.json
- Size 1KB
- SHA256 2ea9c54b4dbedc2de2b418d0706323559556271dd2680a886faf0af2985a1f79
- MD5 9218656cca300421727f1f9f9a0970d4
- SHA1 83e2d2c5c3e75107fb775c2f58b2b56926eecda6
- SHA512 52f66411264b310e661ee96c960ce3523eb9a604129373c4a0c1724178425945f11ae1c6980e32bdd81e740c039a2c3a914ccfbf819e81f9b602a665b770831d
- TLSH
  T1C9212726E6884C6705B52777347543A2FA32632BB0441C4A78FCA86CCF77E5B1120F75
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  bin/Debug/net10.0-windows/spoofer.dll
- Size 36KB
- SHA256 815ae5c45d45f5817bb8b5d6e593c5186b4dabc07063745be370d43b12175e3e
- MD5 f080e8b923d33efcaf4fa4d2e24d1e3a
- SHA1 78b972031129170254f5d30207fad49160490778
- SHA512 224c4a59623a51338eb991258f180b635221f7fab5e6b46ba3eaa29bb3e74b9f2b0a35c3df69c81af8378cf558597ad85e68b03e13d5481218c5492ede946c29
- SSDEEP 768:0MMOLM7vsP/ft1+W4NtcND1ahhS6kB+J:7t1N4oRAhS6m+J
- TLSH
  T17EF2F80432F98732E4F88BF5CAB190110BFA792A5D62D70D2DDA30EE1A62F544991F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  bin/Debug/net10.0-windows/spoofer.exe
- Size 159KB
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH
  T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral13 behavioral14
- Target
  bin/Debug/net10.0-windows/spoofer.pdb
- Size 21KB
- SHA256 c47bd1c6642e1b8db92004d3a32f4adbefd59d6de0c12e213409dd9927f59bad
- MD5 45bea5b0b9b269fc0d43be286edf1e37
- SHA1 7fdfda32ce8d7ab0a54ad7a4748b6ea0b64193b9
- SHA512 39e42b8cc49d49e3d8849382e71335ba8b88b7384d5b94e7c58a72c4de4f07ee549790d58f65822dc296300c2e850a57aafc9dc2847b41f9986b6658432b1846
- SSDEEP 384:DklYPEbgk8xk5Y1piszFDkas1io12i/sXGTUY7gmv9yV/RU8PmiHIfWl7H5weYIw:AlgEd8xkanJYTrLsRU63rJS1
- TLSH
  T180A27033E3D5E550C25166725833C34C77B8C7142241DF7AF2C8AA1AED9F7A88BB6260
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  bin/Debug/net10.0-windows/spoofer.runtimeconfig.json
- Size 447B
- SHA256 039a0defb81019310fa2e8a17ef8d2ad086b1a37656149aa598f1f75893f2a22
- MD5 b451096fec6028f9acbd24badac69055
- SHA1 d7d2be96751913015927effb0d58b0ac1d3fd839
- SHA512 cb3e5230de93c3fed5cf8165107de145c613655fbda729e604419a80e3a51431ceaf4e30c92a71fb73a8ffe2c713bd95f8f34abad7e12d0f1bc692fc9886d490
- TLSH
  T141F0222ACA100DA308B973BAD62AC182FF30432B20141956B5FC081C2FB3A611100F99
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral17 behavioral18
- Target
  make_icon.ps1
- Size 780B
- SHA256 6d03af647b1d6038e56ad2e26bf3e3fac47082d5f169065a25c4f157eac42ec4
- MD5 908628e9278444944057cfd1f89a8e7a
- SHA1 1e493ca8525fdd5e57e204124ffb3996c1ec1039
- SHA512 4ab1001bc459962aadc5d54a0d3b1f14cc36945657a000642377dae0eec890f0315f187cc3e3fe16e74bca1f482a500cbdfb300b58d31fa70a9a9c3ff6f2ab4b
- TLSH
  T13201BD60A31BC0D94BA6689933BCDD01C7356211210BFC09BA8FC71BE32F0590A380FA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  obj/Debug/net10.0-windows/.NETCoreApp,Version=v10.0.AssemblyAttributes.cs
- Size 200B
- SHA256 93d67476196ebfc80d1d7d8844b91146cfd678d105f5ce635eb900ca40610c9b
- MD5 8479efdf06e2d26e053d27ffa6964185
- SHA1 5b5f335f3a4f6a9e63fcf9dd2259865be88e19b9
- SHA512 2f51a6612a17528390d0b4a8ce21bfddf3968be2205ca64c8da05cd796ecb3cef47bcbbf0c562a790298c24cbb2ee6c610f810c7f97743bd7b3dab57f973a9e9
- TLSH
  T1EFD0223CB345973A0A3011C7C801E0C817BD73507A66A8A434FCE00BEE9EA364130AA7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  obj/Debug/net10.0-windows/apphost.exe
- Size 159KB
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH
  T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  obj/Debug/net10.0-windows/ref/spoofer.dll
- Size 8KB
- SHA256 aedb2a645ecb6ef8c4a1a9395bfd2bd76c410ca842ac121cfad6f8ad6c1b8d7c
- MD5 008f1f1929580ab6fc7b7405fe1e4301
- SHA1 817f8b706c8659d3e05438265adad6b5b081cf04
- SHA512 2e4aa6f77eca2e727954a325904ca7a8b58d44e188e2bc821a930f5822a2a6776c2462ac28edddc49d1d88695c53ada1d62944cab49182dd92c40b85ba6a917a
- SSDEEP 96:+j0iOERjjjjjUSbZzOgJXGbG/osFH8WU/8xvb32HLlYR:NFYjjjjjPNOCyoH8sToY
- TLSH
  T101020FB3F3684226DC650635F962C3512336B9384C461B9B7AC87F0B7E7D3544E62B25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  obj/Debug/net10.0-windows/refint/spoofer.dll
- Size 8KB
- SHA256 aedb2a645ecb6ef8c4a1a9395bfd2bd76c410ca842ac121cfad6f8ad6c1b8d7c
- MD5 008f1f1929580ab6fc7b7405fe1e4301
- SHA1 817f8b706c8659d3e05438265adad6b5b081cf04
- SHA512 2e4aa6f77eca2e727954a325904ca7a8b58d44e188e2bc821a930f5822a2a6776c2462ac28edddc49d1d88695c53ada1d62944cab49182dd92c40b85ba6a917a
- SSDEEP 96:+j0iOERjjjjjUSbZzOgJXGbG/osFH8WU/8xvb32HLlYR:NFYjjjjjPNOCyoH8sToY
- TLSH
  T101020FB3F3684226DC650635F962C3512336B9384C461B9B7AC87F0B7E7D3544E62B25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  obj/Debug/net10.0-windows/spoofer.AssemblyInfo.cs
- Size 1KB
- SHA256 b9ec3dc45b838c103413f325d62959f7e1d1ce4707244cbb63e0372eb477fb46
- MD5 61e470419ddd30f2797a56c98f380d1d
- SHA1 f747d6afea52259432bc3c2a1c05ffd9872d4fa7
- SHA512 27913c9feac356aa91e9a7d72bc7ba92969e3d74bbdd47c10f044b909a2de82225c383604b354712ec7e31c18659c7715c1c2af8bf5164433509d5b1bc5ac3f6
- TLSH
  T1012103786E90873ADF01C4C3AC87B1D9C53E3310429D9C1430EC9D07EA2E834416E5A7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  obj/Debug/net10.0-windows/spoofer.AssemblyInfoInputs.cache
- Size 66B
- SHA256 7e546cea9fde1175b922f41098ff0a43dd950b05dabbd8175a9b134abd448b10
- MD5 3e3e38fe481373751408322c7fe21e83
- SHA1 dfcfb6f0cfa072f43074107cac708b9ea5d8f8cc
- SHA512 751874b4595ecb9b2c7dfd28519d6db8c5194c2605f7d273c22697f55a15bc2ce8c5ee809671733430842ebbc8f4ec28286e0eec3e8b5681a3c11051282968b0
- TLSH
  T103A022F8C03308208303B2EFC802200E0A0232CCE83A80003020203C08E088C00080C3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32