5729c1c457c47b18c4032648cd16c039749c4f0b3117eb2f5654073df7d7cec0

Sharing

Copy URL Twitter E-mail

General

Target
tele.rar
Size 221.8MB
Sample260730-drkn5a1zhy
SHA256 5729c1c457c47b18c4032648cd16c039749c4f0b3117eb2f5654073df7d7cec0
MD5 fca09a0d299d613d4a26ce9e60aeded5
SHA1 e42e632cf97fe492b3434627d702fb7bbfcf067a
SHA512 2c308b4ad2d7f5d1ff81a623178dedc4c9a4909b7bb3d4f62f4245a6e2ce92b569ac74159b5b4a07d67f15433781d83bba6ef1a817e6852e219fc773943a3941
SSDEEP 3145728:2hdGZFEa+wxWIB6BVY0Br8g8dQ45UQyRhC7Fi7zEQAjG268sVT3aDmDtHE:AdazxCXzCXUhC7FEzEQFLfVTKDAtHE
TLSH
T132B8332778C76F47DC09970AE4A4054D876BC7822201F077F1B7BDE3B41EAA56AB94C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  tele.rar
- Size 221.8MB
- SHA256 5729c1c457c47b18c4032648cd16c039749c4f0b3117eb2f5654073df7d7cec0
- MD5 fca09a0d299d613d4a26ce9e60aeded5
- SHA1 e42e632cf97fe492b3434627d702fb7bbfcf067a
- SHA512 2c308b4ad2d7f5d1ff81a623178dedc4c9a4909b7bb3d4f62f4245a6e2ce92b569ac74159b5b4a07d67f15433781d83bba6ef1a817e6852e219fc773943a3941
- SSDEEP 3145728:2hdGZFEa+wxWIB6BVY0Br8g8dQ45UQyRhC7Fi7zEQAjG268sVT3aDmDtHE:AdazxCXzCXUhC7FEzEQFLfVTKDAtHE
- TLSH
  T132B8332778C76F47DC09970AE4A4054D876BC7822201F077F1B7BDE3B41EAA56AB94C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery spyware trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  tele/.vs/rose/CopilotIndices/17.14.1641.39856/CodeChunks.db
- Size 7.9MB
- SHA256 a8e3b3febe7da1659fe2c8e364ec8075ba88fb0d2c5bed087f4094cd8d099ef9
- MD5 106e7792feb623fb5f5fe1ca4e47d392
- SHA1 bf8bf52142dd4dc521a82bad704641d932eda094
- SHA512 d81ce38881d28fcaa81d0c9cae6006ad669d91952ef28fa9bab8f52bff5419fc3417daf8f781198dc6355541fe61fa2bce3189b536c01f2bf6b2defab135a1e5
- SSDEEP 49152:Xyds4mvmlWiKQR5EkjV9gUvyJIgu3uwNPu8Wk2n0OngLbpsA84WARh+7/EDPKDuO:IXfVVNrns8TOgtTJPCLF
- TLSH
  T1EB862A955306F33FFA90CFFD91156DAE0B5CA312F9E70C40D2C61A93FAEB1A42656062
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  tele/.vs/rose/CopilotIndices/17.14.1641.39856/SemanticSymbols.db
- Size 15.5MB
- SHA256 174cf8205b721edb721603cb72ccb8b9e72217354f2dc49dbbd9474a6cb491af
- MD5 dc0ecde370f2f83dfcef1845119665fa
- SHA1 16b0144c56ce3ab680e62e2a179426d30ccfa9dc
- SHA512 f002f0e6c3ce42f6b93089fe589daebffdf469aa820cdc83e64c90de6c388a9e55b91493945fae0dff34168f7c2642cfe6b87e37e2b91b0cb859aef4fbe6de6f
- SSDEEP 98304:oOU/qCHvXmXH2OFC9uRA6qHHm1GVL/JXvfv5f8P:oO3svH3uQ/Jffv5f8P
- TLSH
  T1CFF6095699C4B88AD5611539BAE07A45023BB74DF6420B0E725DDF8CEB730CB4AD238F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  tele/.vs/rose/FileContentIndex/38a4ac80-2a2e-447d-8590-ea59f6e70e58.vsidx
- Size 859KB
- SHA256 0deb6af5becce3b407f8d410eacae3b6348b195edad0117516fd612b0029592e
- MD5 32168b9241591e77f47e4e78b9836c58
- SHA1 2e2db0079cccc6f54fb30498da1f5b12d2ef0ee9
- SHA512 00bb09753bc485e42b66fe4c214c1fc5073cafe4985b06f92d45718bc948a16e05dc835b74181ba30b706b94bfd266308590aa4e47194344aabe1c0f9e3e1c8c
- SSDEEP 12288:LAeXxsNP+40qfLPjBpG7RTyGv7Q+Z9HcSrW44R5:HXxNwC7gM2
- TLSH
  T1FB15D71ABBE141D0D431B0BE4BE69F65B33DE3E143071B3B069609E64E07A561F6E4B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  tele/.vs/rose/v17/.suo
- Size 50KB
- SHA256 91df59189f1f0ec1231851084b6f2dd8a18896d787442eb0f91e318d5b77f130
- MD5 2b4adb79c0b242d443e01b877cdf42b4
- SHA1 27f0ee605be8e56bd660ce459884f5b65150a2e4
- SHA512 24a5f5ed1352dc735a0e0bda17d89a3ebc2420e0f188704a2888f1cf31051abd2e88ac99bc9f30dc82ce4a0bb7546c7e787f98677fc984f47fbb599c838a7ccc
- SSDEEP 1536:6QKQnLlyOZ5edy5iAgsZu1TuwYdB5DAodWsmuNwwTctMdy5iAgsZu1TuwYdB5D32:6QKQZyOZ5edy5iAgsZu1TuwYdB5DAodR
- TLSH
  T1C233204863F48165F3FB8F7218F6E124187A3C124CCAA62E2149734E0D3AE65D5B67B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  tele/.vs/rose/v17/Browse.VC.db
- Size 65.4MB
- SHA256 0243ca44474fd2d31dc4af38a777c5c9e004a0c19ba36f6043131c56210ba418
- MD5 2478be9e5f17331b3dfac411c7c05b6a
- SHA1 a27e04238cdabfa8134beae682c8fd760e3b4637
- SHA512 f8d40c511914ee9f2810cfc188c31fb40b687470d33c49c30c1b676cce62499567000cdf6cfcf1dbd6d6550de9774054c437929167ec7448ec072a7be8d61f6c
- SSDEEP 786432:+X5ziBikc3+rwG06Khnmiom318x8u5Uu8/Wm5c8D2nvPRs+bwL5jXNAemyPDsEZI:oYSYf8WwIxaXdgtd3
- TLSH
  T1AFE74A223F4E9177F9FCC8F2767F8AF42622D998A3D5599B6000036749EC7853A1294F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  tele/.vs/rose/v17/DocumentLayout.backup.json
- Size 8KB
- SHA256 4e20256de157f64138d1eddec7597abc338bdbfa6d73d1180aea60ed910b7a17
- MD5 847a59c0f520b8ea7ed955fa9fe538b0
- SHA1 9acd92f58464bc6d470d225837f7aafed043f7e7
- SHA512 e8452b9d15e4e4a0a87a0ea6492a4681c62109e3ce50c7cea55e9e8e5644063b7bebe68c11d9f47acd9ca7ff7c49320c08f9dfae2e2c46535c4ad16541cad81e
- SSDEEP 192:0FFPnihnlFwtFpAFopFIxFe8cHFeH7cHLCwaVlowdqPn3nmwPnCnnvm+wpkmw/mj:ghnihnlKt7AupWx/sw7w3n3n1nCn6EQ
- TLSH
  T1DB02DC3DD3C1DD6711B84AA25495C795BC24038701DE122A76BC814F2FBED7E09CAADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  tele/.vs/rose/v17/DocumentLayout.json
- Size 8KB
- SHA256 b98da13e838dc99a07e30bb58b2909637f4ce949d393588b769aafbecc8bfeb6
- MD5 540e4a62ed2b5ba75bdb91d84fd49524
- SHA1 0e6589ab1f8f2bf1a7f60665bf446e5edaacda33
- SHA512 ec83a6b17bc3b9519fccad7a02de4c2525ef22398ed6bf627c19348178a2f0dd2f96034e242291a2329bc3cd47e4066f25910dc55c491296f5264c3e57ad4186
- SSDEEP 192:0FFPnihnlFwtFpAFopFIxFe8cHFeH7cHLCwaVlowdqPn3nmwPnMngvm+wpkmw/mj:ghnihnlKt7AupWx/sw7w3n3n1nMnbEQ
- TLSH
  T19A02DC3DD3C1DD6711B84AA25495C795BC24038701DE122A76BC814F2FBED7E09CAADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  tele/.vs/rose/v17/HierarchyCache.v1.txt
- Size 81KB
- SHA256 e14db818c4d9869f596fdb384da6583150107b5f9cf17859c56a9bfe5928629b
- MD5 abc2c0a2102238b9600471ae1804ca4d
- SHA1 3c33b66a203ea13c726ba1692688f1b6ec95ea30
- SHA512 91d7df10d5ce29c2f8fe9d0e8e4543a4bd7e70cf742bd4e244f4b089bca2e0c2c7ceec1fd5cf4385122230fedf0ca27ac08ad27929e33d31a813632df91e851b
- SSDEEP 384:MD6v9spdAUYlQmOnxBzmkw4zljJFhp6dxfh7Me+L86yPHuMc7TupKlBVIyVxBhfD:MD0hvyKkw4zlFRkIL49QhIgB5
- TLSH
  T14483377AE6C26FED5BE0F489D5D6B133BC5C649355C2A0F4329A015B9B3202DC3C68B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  tele/.vs/rose/v17/fileList.bin
- Size 65KB
- SHA256 73fec31f56943fd4d35498897ae3b8071237a71073e087470b69a140c4b6fd16
- MD5 c82820d804987a4f64adfcf22170fbe0
- SHA1 2bdb691cc8694be45da0e6f76b773cb69708e2da
- SHA512 ecdac54daecd29aa2fe77a3c05db9ff9fa78d220a5fdd4d328fb596d0732c79ecd979236794a834929289a53e6560ab2af919b5ac5483b25c25cd5538a1f26e1
- SSDEEP 192:5BJAB7NMkt++sDVdBqV7SDiZ+OOD1B3SZhq8Z6WHWStbyEEhf:gBMk47BqaWTOP36qOHHWVEgf
- TLSH
  T118539847C61DC753D617EFF9934627082AD0EE0273C9236391A1C227D886EE86D5B4EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  tele/.vs/rose/v17/ipch/AutoPCH/86b80323165b2826/CACHE.ipch
- Size 142.6MB
- SHA256 47423ed7e5fbd3e5242574675e05dafe0cfef4a2219650fd2b4c42af8fb9bcbe
- MD5 cb30037d25f96224110d8a5ea7383bc0
- SHA1 e115445ba62d1395debe1ea5a01990edfba063c8
- SHA512 3db4a0b0de28072f72f142486d6f4ee72357266729caabbe32440a3207eac8ef506fdc55d35522f8497d412f5d5501bffe20117512ba28630ff1c6fcc373de34
- SSDEEP 393216:hLgoGre4GWT0zytbd/i2zxSHdOvmkPsAgOrPVZO6bO3wcDi+3c3+azpbboBYyazU:9g1em0QbddzxSHkuCsAguVZS/ipvz7n
- TLSH
  T19168F701BFA35D76C6A4433058E757943738F49E8B42AB6B318C92BD7E932846CB716C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  tele/.vs/rose/v17/ipch/AutoPCH/8dd626be4f9abd48/FREEZEPLAYER.ipch
- Size 186.3MB
- SHA256 5e346ceca720d5b68d067e05c83d72b37289642101110c7e858af73c20fa4a05
- MD5 7e41d1263b97aa4ed5324f44aaae404f
- SHA1 998e51184204b2a158b562c311b78153d0eb2927
- SHA512 0c2b4d6036fe41b70fd522b567c1953ce81b31587ea010f832ae61847848401d924ead6675fc6d341e0166a0c74b16e4441edd1ccd9ee8ebe8abdc240def4644
- SSDEEP 393216:oIzbj3+cji33DizoZj7l9seFYZYBZghwrGCOL03mHhf47KJSm4DECkibPJR/0sRF:EGsRlB/yn1XUenhB6
- TLSH
  T15898E611EB935A66C6B5433018F757953B38F59E8742A73F348CF2BD6E433882DA2168
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  tele/.vs/rose/v17/ipch/AutoPCH/94b35a1978825104/RENDER.ipch
- Size 231.6MB
- SHA256 194354758e3dabcb4f3375cc4424bbfb2e703be0358af3e1e332f245f8ccfa5e
- MD5 3244918d97235ba87096f04d0551e18b
- SHA1 69c05d9b114ecb67fc721861eef4ae94657e6b76
- SHA512 c853b2cd7d60a57acfe1942916a98b31163308669eea83e92aeb54ab71c7c68cf2623842ede173514575fd693065500512d79dd09ea566d46819f9282162d551
- SSDEEP 786432:mqyf10N7C7JRW1y7sL5mX27F4PbC9u13kyxdxa1P2:mr+Nz1FQM
- TLSH
  T150C80805AB635B67CA74433068E353943738F49D8B469B2B359CF27D6F433886DB21A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  tele/.vs/rose/v17/ipch/AutoPCH/b44940724cbde971/ESP.ipch
- Size 180.6MB
- SHA256 09ce56aa1cb298a3061612f9c3d281ea23333f723ea49949194aae2aadd2b479
- MD5 a787a2435e0776d03d7b917d2f8904d8
- SHA1 4b64b380d75b8859f6874b700ddbc6f15557cdc8
- SHA512 24eb7814f23b1bdf55e2355b63c513732a34000476ff473e9beaa675fe6df9923c0ea00e0ea09c0a060dc6ebcfc39e44606c00d1999dbd857a08deb81c2c1e8c
- SSDEEP 393216:Px65hDlymvD+cm4MTJtOHOudhQzug5DL4sbq3cc9ix3eYqQYaulmNYzYheewdH3b:PCvD+cHOYQzuKDU6uB7p9
- TLSH
  T12198E602AF635966C6B5433058E793543B34F48D8742AB3B358CF2BE7E933846DB6168
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  tele/.vs/rose/v17/ipch/AutoPCH/d53ec2275c8baece/RENDER.ipch
- Size 192.0MB
- SHA256 cbc9d4ac32ca742e399792dd1c2fe56532454b67e6e359a8f6f32ac62e2029a1
- MD5 bc582459b49362a24eac21f76ca56186
- SHA1 8312980665f026be5e546b69cbff5abce7b6167c
- SHA512 7063f486879d759ac88b1d5b0eccbb73dcd5d5411e88743793a0122cf7d12091203e55ed65133a0a4982e87fe7d97d6dd5f8d52f6b8a52a2efa515c03287092d
- SSDEEP 393216:4mj+kD5DW6S/oraJlyUzfqw/bX37csiR3BYi59wSC0r1010McxRVU2EEYXjrRnHO:NlDgyURht7dLXm6231jGSvP
- TLSH
  T1F0A8E702AB635B66C6B1473058E397503738F49E8A429B2B319CF27D7E533846DF35A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30