34486a54e8bc755ce2028a8b2f307d961cd09098cbaa842676b3d9fd8cda638c

Sharing

Copy URL Twitter E-mail

General

Target
boot_images.zip
Size 80.6MB
Sample260729-nzgmjsfl7v
SHA256 34486a54e8bc755ce2028a8b2f307d961cd09098cbaa842676b3d9fd8cda638c
MD5 e60a319d081bbd59f6bad3e01150ae1d
SHA1 51b2b1ba246c52d063e3c990b4c28fa50d078d3a
SHA512 f905af739028c5116d3f887aa7e1bb3e86520f9cfd77ead5606335ee5f1e62c4032f65b4bf0ccf5d01f09fcca35b1dffe45093941104fcb589ead44140b4bfa5
SSDEEP 1572864:mrkhIs7uS8OitAw07pxApultWIO6IA3Jmn9xyEG+JWUbwXyEF7GXtG7:mAhn7iOL6puaIHI4mn9ERGWUEFv7
TLSH
T11C0833A3CB71CD16C8A3D2767461F704DDFD8861A69FA1093E5A1090CD86FCE0B63B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  boot_images.zip
- Size 80.6MB
- SHA256 34486a54e8bc755ce2028a8b2f307d961cd09098cbaa842676b3d9fd8cda638c
- MD5 e60a319d081bbd59f6bad3e01150ae1d
- SHA1 51b2b1ba246c52d063e3c990b4c28fa50d078d3a
- SHA512 f905af739028c5116d3f887aa7e1bb3e86520f9cfd77ead5606335ee5f1e62c4032f65b4bf0ccf5d01f09fcca35b1dffe45093941104fcb589ead44140b4bfa5
- SSDEEP 1572864:mrkhIs7uS8OitAw07pxApultWIO6IA3Jmn9xyEG+JWUbwXyEF7GXtG7:mAhn7iOL6puaIHI4mn9ERGWUEFv7
- TLSH
  T11C0833A3CB71CD16C8A3D2767461F704DDFD8861A69FA1093E5A1090CD86FCE0B63B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  core/storage/hotplug/build/sbl1/a53/HAAAANAZ/fs_blockdev.o
- Size 117KB
- SHA256 70ce64e8b8b70e04b19dd0d24330033cc7c352cb954ca0e404548af9a58b24a3
- MD5 89599277af5cca6ef2f051e6935d1978
- SHA1 b18dd7211624c23225bacf5555d242b564ed6a7a
- SHA512 70efc820ce94044e77d60c2dd986833d419b7bfe78a61266d940c81eee1ea680eb0d5b98fc196252da1a52a2de5b82ed448be0a7f70dd4aa1e76f70f32ada7ed
- SSDEEP 1536:fVJrevhf+aa4EUYwWs0HvaQmihb1Qg0Q:fih2aaiYwWs0SQmihb1Qg0
- TLSH
  T1E7C37525375668D3D7F089785DEB0BB33763A2CFD5C947C59319A128AE84B0E3DAE006
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  core/storage/hotplug/build/sbl1/a53/HAAAANAZ/fs_blockdev_devnull.o
- Size 85KB
- SHA256 6475ead86e7d0c585e7c6e96f8644f827fc7ad3ced809b1eba11c6a80bd45ed7
- MD5 3937741b3f82863e9017d6f59b0c8e36
- SHA1 ada2c753b90b1df3ea049f06e574c73155798b30
- SHA512 c9b8215eaed684121a84a01e55064eb65d46a3e2b4b1037bf1b7899ae9ae866d0c1961932817c9391d5574e4d397cb6bee066c515aa79c1654d39d033b7101ff
- SSDEEP 768:uVkreLe6hJmhF3dgMpPI6HPTbEXeSZh4Kvsu+miitdJarEV:uVkre8hY+nHP/EOYh4mDdJaEV
- TLSH
  T1E683A865360538D3D7A08DB81DFB0FB33B53A2CFC5C55785B324B528A984B0E26AF05A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  core/storage/hotplug/build/sbl1/a53/HAAAANAZ/fs_blockdev_devnull_driver.o
- Size 68KB
- SHA256 4a8157639709dec1286e3500ae9d77ef1387eb345658e349cd761f34c98020f8
- MD5 e93e11649fd2fe377fa574619d973c7c
- SHA1 7f4f5e29737fcb6279f1fe0adb28b962cfa0d118
- SHA512 e8725eb74d0e579525e66d0e318e132aac5521efc02f54443213c56bee3d34b4b9947055b8d48eeaad276492477038b76a2eee3965318097695bc9bb59f6cf3b
- SSDEEP 768:GVzreL46hJV5WhF3dgMpPIOfMsEXGSZh4KvsquEtXUl9CtG:GVzreyhY+xFEWYhRtXG9eG
- TLSH
  T12A63B7623B053CA3E7A098B41DFB0EB32F6763CFD1D542C562647564DAD4B0D26BE019
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  core/storage/hotplug/build/sbl1/a53/HAAAANAZ/fs_blockdev_driver.o
- Size 71KB
- SHA256 82f83bd1b5c5c8f32678517123e2150b1979ba98844f6fc92bfe76168fa2a97b
- MD5 cad918c277fb72b4b6715aa592ca07d6
- SHA1 cfb6c6586e671ac5dc5b33fa7f3a7fcd07457498
- SHA512 d84718c55ba5d940148de8cddcb239bee9d9790909ee8253e615cdf4f8a68f4f3f362ab0b5d6d7da013960733f743e03f07e155a26e7c06719426c66ca0a7ff9
- SSDEEP 768:yVoreLo6hJusF3dgMpPIzny/EXWSZA4KvsxkXlYi:yVoreasY+2nkEmYADVY
- TLSH
  T19D73A6A13A093CA3E7B49C781DBF0EB21F5763CFD0D542C963716568EA94B0D256F016
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  core/storage/hotplug/build/sbl1/a53/HAAAANAZ/fs_blockdev_ftl.o
- Size 41KB
- SHA256 daed766dacdb490512fcffc380d8ac9b55766f88284ddbfb7947e9c01047d5bd
- MD5 2df71f4e6952554418f2c686752f0671
- SHA1 e0d0f3d5e85b76d60a536d6ad75d6be67545bb4f
- SHA512 6c7e6c85a57b431ac696e64b83e898a4819741bed4c030393bf9686445621feb0503232f57bef12587b706d460fbf34639fdd8bcd927e20a0a6d6aaf024f6b68
- SSDEEP 384:3JkIEPDeLhgu06hJxOhId/vv9vHEX+CpTpSZCPWNd4wCZ2Kvs3nnVyUY:3JVEreLe6hJxOh8vHEXDSZe4Kvsl
- TLSH
  T13213E7A636093CA3F6A0ACB81DBE0EB61F5777CFD0D142C862702564D6D4B0D1A7F46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  core/systemdrivers/pmic/drivers/gpio/build/sbl1/a53/HAAAANAZ/src/pm_gpio_alg.o
- Size 162KB
- SHA256 6e49dbba6cebbf99db6d9b4f1023d9a835b13bf65783aa0afd5735c119b48fd2
- MD5 d8e144936d68b2e456961425826d7205
- SHA1 7f627af0c1f7feb8240451af1b122ea90200cce0
- SHA512 ae981b572894bea034e2001a9dd5f187accb78b3a10e581e751f31877346e2c4983b3f36e7fcbf3848429eee00172529a832e3e49408941b326eaef9517cd0bc
- SSDEEP 1536:MgQlrUPiR8f43MNAWmMpzERH0j/AS2RaVjBJjjV:xHg4+W8H0jISG2jBZ
- TLSH
  T137F3942227152C47C7A9DA7455FF0F313FA6E3CE86F2479B12B82439DEC4B0D29AA445
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  core/systemdrivers/pmic/drivers/gpio/build/sbl1/a53/HAAAANAZ/src/pm_gpio_driver.o
- Size 136KB
- SHA256 e525e092a8dd7c22cc88c73533219f77479c110845ae72e1ac9533459313d420
- MD5 de961d10f69dbb57cde99564f1aedecd
- SHA1 4a723b3bc851ba58d77dd53b9d5aa0419c443fc9
- SHA512 a842284322fbdfc246fcf218b52e9546c046afd005b08e46d07c6e2b50beb794dd7f64a2524c1c73e96f94034136b0665fac9a4a9fecf49e0e63187bbb583451
- SSDEEP 1536:qQ3rLPiyx443+N5tWDMpY6E9SyFxCzcOn:q+70/tWB1bxC
- TLSH
  T15CD3D7223B146C97D7E9DA7059FF0F362F66A3CEC5E1438A12B42178DDC0B0C29B955A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  core/systemdrivers/pmic/drivers/lbc/build/sbl1/a53/HAAAANAZ/src/pm_lbc.o
- Size 161KB
- SHA256 ab124be138dbf78c7852bb734b49e2b91f3deede34501aa5888ecc2c8612678f
- MD5 fcbef8284bd8d14808adfc96f8167edb
- SHA1 5ce092777e17fae902926ca9b48375e2a5639629
- SHA512 b3b05282903dcc80ff51d599d33feabbe96dd83ee4e6f50b65535d9e56f0dd69545143888eca542cfbdf8a2cccdedbc6734e925d2e8ff5f27919432416d738df
- SSDEEP 1536:WQSraPiR8C43HNiZWBMpQEzdoX//GdY+p:WugKAZWKM/OdY+p
- TLSH
  T10BF392217B146C83D2E9D6B055FF0F713F66A3CE9AF2439A12B82438DDD0B0D29E9645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  core/systemdrivers/pmic/drivers/lbc/build/sbl1/a53/HAAAANAZ/src/pm_lbc_alg.o
- Size 165KB
- SHA256 e368187f01d2a76067b2324c0e79dbda08985973261ffc2335213b97f9c5ec27
- MD5 86065fcdce150a9f5e5feba660fb9647
- SHA1 a6bd3f11a3d839203086b872a565960c64a56aaf
- SHA512 518ae5ec14769482976f305f189ecf609ae1b878ce784913594b0f017f7966fb4f9233f283eebe9982980661d833e4d70a883acf361af58552eef97efa6426b3
- SSDEEP 1536:ynUCQDQnr1PiR8G43DN5YWxMpbEhIcyNXC0K1zdz5Yg:fmgG/YWAcyd6Rdz5Z
- TLSH
  T11CF3822127146C47D2E9D6B059FF0F313F66E3CE9AB2438A52B82439DDC4F0C29EA655
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral10
- Target
  core/systemdrivers/pmic/drivers/lbc/build/sbl1/a53/HAAAANAZ/src/pm_lbc_driver.o
- Size 134KB
- SHA256 b7b90523c29c8b772ad67d33e92d7f740509814e12227e66dc0ab08574cb1efd
- MD5 465095be291c3fdd6505b7623e0cc463
- SHA1 ee430fc9f1dd2074aadfd0a418a11914d101f734
- SHA512 7fd1ba3e5929187d1d92c74556fc78936270164a1bfa4849ac94672258a7fc21741aa439c2b7da74f625dcd85e53bb0ddb32e3e9cb6fd0924c69a7c8448d9783
- SSDEEP 1536:iQFrVPiyxr43HNiuWjMpYoE7eak9okWG2vZkH:iI7CAuWh5eyG2
- TLSH
  T175D3B7213B14AC93E7E9D67059FF0F362F6AA3CEC5E1434A12B42578DDC0B0C29B955A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  core/systemdrivers/pmic/drivers/ldo/build/sbl1/a53/HAAAANAZ/src/pm_ldo.o
- Size 128KB
- SHA256 a23637b29f6f28eeb5e6b5809f620a60b37acd149c982e41b89798ab979bdc41
- MD5 c725134791910c76313eb2a139aa52de
- SHA1 a7548831efa745b9cff25d551e7e82344a15efa2
- SHA512 0b4dfaee82b96f388aa5f338a85c65633c73698a8b28e8a1a5d3f523c1bedcdbdbeddfe3d644d9e6177a492596103bb870feaf32e07c8743add236d35dcfac10
- SSDEEP 1536:rQkrwPiR8M43SsNiUWpMpUE2PTO1cDBjtjKFy:rigFsAUWHRjK
- TLSH
  T125D395223B146C93D7E9D77069FF1F313FA6A3CE96E2478A12B42178DDC0B0C29A9455
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  core/systemdrivers/pmic/drivers/ldo/build/sbl1/a53/HAAAANAZ/src/pm_ldo_driver.o
- Size 136KB
- SHA256 017bf107885eaa1b35e51f5385a7dcef1bf2e813318b827636e58e5cc220ddd8
- MD5 5a458de0aa9275234861b4708381ac60
- SHA1 3ad97d380953081f30405ccad351839e18431499
- SHA512 ab0c7dd50d625e420ca1bdcc8fcfe1c502d49dad378205f8df52754b53ed9183aea4bb615f9f885730dbc41f76dc32baa3f583380f23763f80e53500baabd465
- SSDEEP 1536:BOQzruPiyx9436GNi8W1MpYREnMSMoVlz8wTaO:BOl79GA8Wjkflz88
- TLSH
  T16FD3A7213B246C97D6E8DA7059FF0F352F7A63CED5E1438A12B82178DDC0B0D29BA516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  core/systemdrivers/pmic/drivers/lpg/build/sbl1/a53/HAAAANAZ/src/pm_lpg.o
- Size 156KB
- SHA256 774262d5deee127dfc179f48f14cd6f344ff2f9daebe3653ae20e9a9b5977930
- MD5 d8f8d0c03f8e1bdae221c081f996f751
- SHA1 6ed048f07687b4348991ed89ab7afb90e7ff434b
- SHA512 fedeaf9b21dafefa28a5668b988c1446dd5da9745bc0fb7be26e55dd1b3807ba5edb47da4f6990cacdb0eb08f6e6c8809b71197de04bb9dda7d1d50354dcb67c
- SSDEEP 1536:QQIrnPiR8Gh/mp43qNrWtMpBE2aLmGCrOjs2vBA:Qtg3ty5W4OjsGB
- TLSH
  T1EDF3832227146C97D7E8CB7055FF4F323B66B3CF96A6439A12B87138EDC0B0D29A9445
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  core/systemdrivers/pmic/drivers/lpg/build/sbl1/a53/HAAAANAZ/src/pm_lpg_alg.o
- Size 162KB
- SHA256 09763c1c35d0da273a35594dd96e90a517d931fed9d331f4b7f3d4f0e275c652
- MD5 fff0b7c9646f72bf6a142c9bbc23c0c6
- SHA1 27e46b2870694eb9a9bd1b78408da212936d0e4c
- SHA512 db41913fde93d5583ba6137482536d6162feabd61373e2bc446fd754debaa2ad4a57fddb0b63cb96d103fa31aace7871bad8b0fa30e5984a83000805ecf04374
- SSDEEP 1536:XQdrSPiR8uMrE434NKWFMpjEKB7rlMtWcYnZM:Xbg1M4gWwJEWcY
- TLSH
  T1D9F3942227146C97D7A9CB7055FF4F323F65F2CFA5E6878A12B86138EDC0B0C29A9415
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  core/systemdrivers/pmic/drivers/lpg/build/sbl1/a53/HAAAANAZ/src/pm_lpg_driver.o
- Size 136KB
- SHA256 b0a118dc0f682a718c521a75ff5e00c1a7a847a5dde58a3d374259c485032a4e
- MD5 1b0428812616f09c3fce8cd75ff75636
- SHA1 fc1fffddd54ee977d77403e64aee5316ebd4dbb4
- SHA512 9315ee583c1eaa21841e274767e066c432e806a1f144e2c493d1b468505d829ebe74bc52205ba0fc0b68ef49d60e7cbf92187f3d84b5650944e957a8f754aa4d
- SSDEEP 1536:fQ/rFPiyxh438N5DW/MpY1ENHykWplEf:fu7n/DWVmXWplC
- TLSH
  T1F9D3A6223B146C93E7E9DA7059FF0F362F6A63CEC5E1438A12B42178DDC0B0D29B9556
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  core/systemdrivers/pmic/drivers/mpp/build/sbl1/a53/HAAAANAZ/src/pm_mpp.o
- Size 150KB
- SHA256 a767491789daa6d5e26b877fcad5b15449f37d627e2aca4698e656481a1484aa
- MD5 6a897fa1523b514858d939b4d3aa0137
- SHA1 54065dcb796e8aabdb5ed3ed4750298d9313574a
- SHA512 092c22ca77420cd80496ea342d4c61146249a4d47418ddce79d0705477461616555643a6be1bda22e4eef3c9ab0926f07bd81b261e18d90bd3bb4d71a4318b9d
- SSDEEP 1536:5QSrwPiR8Lh43fNVkqWeMpwE8aAfF89B74B7O4TQr2atEuf9Z8:5cgt3W9993H
- TLSH
  T13FE3A42237146C93D6E9DB7059FF0F353FA6A3CA85E6479A12B86038DDD0B0D29ED409
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  core/systemdrivers/pmic/drivers/mpp/build/sbl1/a53/HAAAANAZ/src/pm_mpp_alg.o
- Size 160KB
- SHA256 8b4da8b702237b58a076de6c1209a5ad709d171ea0e04100a16857bcb99fc91f
- MD5 66c5b18bdf8b080a2e9e79360f6faa24
- SHA1 46436536e3a7728927138d09d0e66db8d3e6e137
- SHA512 6bf5ba14b1bbdd38d0e495575302b765c0dd1429e1b4f25b724ecba587105529042edc6c6783bb28fbb44ca1e93ce0828effb9c52885555fa4397fb1fde22928
- SSDEEP 1536:vQnrPPiR8dsL43qN8k32YA6WWIMpCEIChj0SoJ2sG9/3jZb4/oekGDpDE:vYgDpA6WWi0j0pNzz
- TLSH
  T14BF3B62237046D53D7EACA7055FF1F313FA6E7CA96E5439A12B86039DEC0B0C29AD419
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  core/systemdrivers/pmic/drivers/mpp/build/sbl1/a53/HAAAANAZ/src/pm_mpp_driver.o
- Size 135KB
- SHA256 84252d9f6b20c50781d6751464c2cdab11922bea9148210a8a49cf86f8521b75
- MD5 e8a914663890f97b9e34bfc73e0b18e6
- SHA1 e3bb209ea57a345e966bae89185dde9ef2c55f58
- SHA512 0f76be39d96f4a2f43d6093febabfd8d615abd502a6acf70da0b51782683dd1a0861c549ca62ff4b9ac9c100a7bddcd31d0dae87636a885cc16c85331ed93c87
- SSDEEP 1536:3FQFrePiyxN43oN2kUgWEMpY7EUFtox85BcJvTI:1v7f2gWG9Ayc
- TLSH
  T112D3C8223B146C93D7E9DA7059FF0F362F6AA3CEC5E1434612B42578DDC0B0D29BA51A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  core/systemdrivers/pmic/drivers/pon/build/emmcbld/a53/HAAAANAZ/src/pm_pon.o
- Size 187KB
- SHA256 2916b0f291c69a5e685b922ebdeb8d60a4a5b9ca97591a5d50c0c044e9abae15
- MD5 e699a056e1a62932336b287bfd3d4fb5
- SHA1 cedfc948787d3b9a8c2c8f7e1d9b4e695a571bf8
- SHA512 40688f14cd7f6564bb0be901eb27d40e24d5de4b897a7e9b4b91b2243bc0e8908192f4246119998c96841ddbe488cad796fd7f8bdb97e3ab3261a43b29b632a1
- SSDEEP 1536:MEIq/bKz3FPiqfNOrI6MpwVFdTf+a5k1+ge+7WpAJSG:N7TqxzUsAdTf+a5u+HpA
- TLSH
  T1FC14EA566F142CCAF1A8C7307DAE2923DFBB268F95E2D10911B51514DA8073C3ABE4F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  core/systemdrivers/pmic/drivers/pon/build/emmcbld/a53/HAAAANAZ/src/pm_pon_wdog.o
- Size 168KB
- SHA256 8115a9b02d6499d32ad2ef2c22fdba8385b94a74ee985d044c7f2d114d31c088
- MD5 253c1c9ffaadc219d75c73f7abace659
- SHA1 bc3a9d421d90f8e448ffc61dc6bb276b30613c16
- SHA512 b77cf0cf1f2271794fab7e96d8a80e757272f2e0f7428a9111cc6f8cf39e8ad1be492875b9c66476931c0af344ffec48d5a2f853196595f3f3020ba9fe22eb84
- SSDEEP 1536:zq/cRyPiqfNfoDMpByFdTf+a5k1+gjz62SD:WEKzNkdTf+a5u+oz62SD
- TLSH
  T127F3B7526F143CCAF2A887307D6E2963DFBB268F95E2900D15B11515DA8073C3ABE4F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  core/systemdrivers/pmic/drivers/pon/build/prog_emmc_firehose_8916/a53/HAAAANAZ/src/pm_pon.o
- Size 183KB
- SHA256 52eabda0ddd80f8793e1820aaf9626a0e029c5fede47ec738cb032a3a2cdec2d
- MD5 b277e44d8bc08f352a7b3fbe117898f9
- SHA1 da10e96fb9dd8a7d3978cfc584139fd9da1ad90a
- SHA512 ce900c07c1176145608afb6adefaaabfe1cfcf801ac609e2a72f701ef1237a6941243ae518f5844cad22ed0fa205ef8c534c74a03e513b73efda57c8c93c5b97
- SSDEEP 1536:REzQkUm3FPiqfNOrI6MptWFdTf+a5k1+ge+7WpAarBPb:Ozn3xzUskdTf+a5u+HpAa
- TLSH
  T18204EA566F142CCAF1A8C3303DAE3A23DFBB664F56E6D40911B515149A8073C3ABE4F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  core/systemdrivers/pmic/drivers/pon/build/prog_emmc_firehose_8916/a53/HAAAANAZ/src/pm_pon_wdog.o
- Size 164KB
- SHA256 e9f1da17c2fed5ada4627d95ee7fe94d47ba252984eb772ad83401a2ad2f7fd0
- MD5 6a1f9ab531ec4786dc9a6243bca75fd5
- SHA1 ffa6385483cc55e84f867f8174753ad5a7448ef6
- SHA512 5a20bc639c5aca0e409fe2bed6049934a9e556e0c4df9c40987b4388366b42f99aa3fa13254411998f61cf57cd5ef73285fe82bbc68011429c0c40de4e555f0d
- SSDEEP 1536:1QdOyPiqfNfoDMpeLFdTf+a5k1+g7z62SIs:1nKzNOdTf+a5u+oz62SIs
- TLSH
  T1EDF3B8566F1428CAF2A8C3307D6E2963DFBF268F95E2D00D15B115159A8073C39BE4FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  core/systemdrivers/pmic/drivers/pon/build/sbl1/a53/HAAAANAZ/src/pm_pon.o
- Size 210KB
- SHA256 8c63c7effd31f89b1bc529bccf82340cf4034d1930b9cc2d04ff6c2483c9cf48
- MD5 a9c32e528129b311a41e2669e3dc12d2
- SHA1 c116b01f6adb804bad5bda9625a22484224b2a5f
- SHA512 90ccf1bebe672f02bfd600d2a2b61cb3d70f7ce4222b3d1e352c16ab321788ddf7cb011e38c9359560da682366aed17793490622456243a3c3029e8387680010
- SSDEEP 1536:Up3QkJr4PiqfLtNv6Mp8ElFdTf+a5k1+gyL93NQn7W/LD:UhnqFphdTf+a5u+lzyWT
- TLSH
  T1F824CB512F142CCBF1A8C3347DAE2E77AFB7664F46E2950D51B514248E8073C3AAE4E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  core/systemdrivers/pmic/drivers/pon/build/sbl1/a53/HAAAANAZ/src/pm_pon_wdog.o
- Size 171KB
- SHA256 28ad481b01a2e9f7a026d1f5a4db5d464c1a5ff9ef35f6d3689c24d5ffaa0e0e
- MD5 fe13e92ba2de0ada8363daba833e8ff0
- SHA1 076a8466811bfdf3882c7c4e0f3b13d81f69a70b
- SHA512 b67483800442776344aa205f41ff0ad6eacc014eb2153fa3ea0e22a18e63f35db565edbd0a1629034eaf2f91c315c96348767a69d06cd9c80fcd258884b77277
- SSDEEP 1536:enQYrdPiq8dNVeMpzECFdTf+a5k1+gPO14ugzUsBX:en14D7dTf+a5u+NUUs
- TLSH
  T19A04D8522F142CCBF2A883307D6E2963DFBB268F95E2D04D55B115259A8073C39BE4F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  core/systemdrivers/pmic/drivers/pon/build/validated_emmc_firehose_8916/a53/HAAAANAZ/src/pm_pon.o
- Size 183KB
- SHA256 893a748c021a46f8a3881a879355e9d946d1d41ce11bf8bb811fb539961e3b56
- MD5 b7b8666dc6de59e244ab01253786405e
- SHA1 7a547c7d2598f6c0ddd484619cac3eaf26e4a3f0
- SHA512 377733fe47809bc214a9243ac8d91826f0f9e730fb4b8d86f94bd5cc4814bedaac5df3b637f6ef3473ef6d755f2e16b06ef20d2ce6b9cf13239c182e0177919e
- SSDEEP 1536:BEJQkUr3FPiqfNOrI6MpecFdTf+a5k1+ge+7WpA/UDdugo+:eJnUxzUspdTf+a5u+HpA8hS
- TLSH
  T1C504EB566F142CCAF1A8C2303DAE3A23DFBB664F56E6D40D11B515149A8073C3ABE4F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  core/systemdrivers/pmic/drivers/pon/build/validated_emmc_firehose_8916/a53/HAAAANAZ/src/pm_pon_wdog.o
- Size 164KB
- SHA256 b2427ad5329bad2f4f02808fb949bd7677008e4ff4e7781dcb7e9999ac239261
- MD5 a7cb6d234bb338eee980bbb178072b6e
- SHA1 917af7888f5434cf62e31461bcf12e28f5d88ef7
- SHA512 c22b941318badae84d698f847da77db55cc077de16b96b6e7c04e26ce7d48d98ce3eb3229a3af4ba07c11eaff5ec26e768dd127a62c61306ada5c7dd08dd76e4
- SSDEEP 1536:kQd5yPiqfNfoDMprVFdTf+a5k1+g7z62SDs:kuKzN/dTf+a5u+oz62S
- TLSH
  T1D9F3C8566F1428CAF2A8C3307D6E2963DFBF268F95E2D00D15B115159A8073C39BE4FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  core/systemdrivers/pmic/drivers/pwr/build/sbl1/a53/HAAAANAZ/src/pm_pwr_alg.o
- Size 135KB
- SHA256 cf339661776e3066680120c3025afbf56ca9e74eddcac47844aa85426a1a5f98
- MD5 53df8d338391941aed837928641f298a
- SHA1 595c26fdc4ca7d9381322edb4e42f562dd20babd
- SHA512 1b3aac9e7e1e15628917388ce5bc55ff48da3749be8f79e10f49bf0026d163c78c57b8f5dbaab63af60d1fd62f814666405fc061ef743604cc8a995189c2b565
- SSDEEP 1536:0JQprrPiR8N43qNAMJIIMp1Ev+/cvhcDERGG:0JygomMJh+/cvrG
- TLSH
  T1AAD3A4263B246C57D6EDCAB059FF0F313FA6A3CE96E1439612B86128DDC0B0C29F9445
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  core/systemdrivers/pmic/drivers/rgb/build/sbl1/a53/HAAAANAZ/src/pm_rgb.o
- Size 121KB
- SHA256 19cda69383ea2466f52061451441a88cff63fd0e7c4987086e66be745a1ec37c
- MD5 be93e3869a9c9cbe37839d87e1a90719
- SHA1 c59472de44c91294c0d981e0373c1c1013f5dc32
- SHA512 c4a1276c3ccf163f0ed1784e614fc541f42c32bd7c6dc1f3545b03ffb8a8dffe7225f76670a8507c76cf869c84fbdda98a712110d5fc3bcaa7fa86ff4fe304ac
- SSDEEP 768:LQOra6hJ2/cPJSQsLd8Qmeeqv3Alyim/5WyYzzM+HNn1zJp1uWxER1CMpoggoVA3:LQOrhPiR8543qNyWjMpFE/yR7M
- TLSH
  T1E0C396223714BC93D7E9D67059FF1F312FA6A3CE95E1479A12B42128EDC0B0C29BD51A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  core/systemdrivers/pmic/drivers/rgb/build/sbl1/a53/HAAAANAZ/src/pm_rgb_alg.o
- Size 118KB
- SHA256 9f75bab4853a6ce8be9aecaada283bb53c9b21a6d3c76292df0897acdc4cadb1
- MD5 18b637e84f2f399e7ef8f10e8c29af3f
- SHA1 23563670fb67667355d1e6797515a38bce7eb343
- SHA512 c9729c1fe791174ef0785232ec56697c05c09bf2625b9ca690b61d215172a25162106e8f60dc6fe6308fd7a96b8aef65ff67995d004735b0083a6f3ed3bf8144
- SSDEEP 768:pQbrx6hJq/cPJSQsLd8Qmeeqv3Alyim/5WyYzzM+HNn4zJp1RWVQNrMpoggoVAaC:pQbrMPiR8543qN6W4MpXE2YNDi
- TLSH
  T196C3B6223B146C93D7E9D67059FF1F322FA6A3CE95E1439A13B42129EDC0B1C29BD509
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30
- Target
  core/systemdrivers/pmic/drivers/rgb/build/sbl1/a53/HAAAANAZ/src/pm_rgb_driver.o
- Size 132KB
- SHA256 fb471ed9e78cd151d32f63e4cd47acceb347bc54966681df386e913aa7fce835
- MD5 6f399eb4629c446a9d8700acecc038af
- SHA1 951abc5b0e072a8f41dd41a16a305fa467fea75c
- SHA512 ed36a98137e5baca8daff679941e6f2327e4e212b5ddd9647116214faa597f9091826e395cd26e8dca848e1b6873bace2881badf68c27c7c803afb60773f576f
- SSDEEP 768:jQpr76hJZ/cPJSQsLWxHmeeqv3Alyim/5WyYzzM+9NnLaHIjQzR1p1xW7Mpoggog:jQprnPiyxG43oN5MW7MpY/EgQyd1riL
- TLSH
  T16DD3A6223B146C93E7A9D67059FF0F362F66A3CEC5E1438A12B42178DDC0B0D29BD51A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  core/systemdrivers/pmic/drivers/rtc/build/sbl1/a53/HAAAANAZ/src/pm_rtc.o
- Size 133KB
- SHA256 c0592ed899e5b2099c836a907532f54e4392b687010b1a6a3b6d5b3bc112e304
- MD5 9f7d86c5c37582350d3229b36de4095e
- SHA1 efc8973ca24f0ff42d903f797d96598b9e65ce4a
- SHA512 f5ed848069698527f30ea50d3c1f921793b16a500d59aedaf632c81d326832f7db09c8a55252f6338a76f6ee726133af679ecfc5d0e4cd794243788ef8be85ed
- SSDEEP 1536:08qrcPiyxZU43oN2RWMMpYBExq+0uCdNFww:087jU6WeMH0uCFt
- TLSH
  T1C5D3B6253B246C97D7E8DA7059FF1F312FAAB3CEC5E1438612B42568DEC0B0D28BA515
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32