bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec

Sharing

Copy URL Twitter E-mail

General

Target
python-manager-26.3.msix
Size 44.9MB
Sample260730-lpkkcayxbs
SHA256 bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec
MD5 481108867e8640739f8202c83698cf3d
SHA1 c69fdf0ae2375c6ee091a9d3b356f726193ed2a2
SHA512 c4cae5cdb83185463a202144032490bd72d5e75023ce978060f69f49489ec2acac12d93ddef6f9aa844e63cfa9cb35ce14f74903f2c85efd9a8e3a056df29bb4
SSDEEP 786432:g8wSX9ok1R1mf6r95KmXI/IQn8t0YbdD73Fv6VT6awNrxOrp6IFoQ7Ef/c7lbPOP:1tD71mke/lng0kdgGawNsrp6IL1POP
TLSH
T156A73321FA0D1EF7E1537E3D51418F268F2D9093224EF48E2EB846E415536CDAB9A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  python-manager-26.3.msix
- Size 44.9MB
- SHA256 bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec
- MD5 481108867e8640739f8202c83698cf3d
- SHA1 c69fdf0ae2375c6ee091a9d3b356f726193ed2a2
- SHA512 c4cae5cdb83185463a202144032490bd72d5e75023ce978060f69f49489ec2acac12d93ddef6f9aa844e63cfa9cb35ce14f74903f2c85efd9a8e3a056df29bb4
- SSDEEP 786432:g8wSX9ok1R1mf6r95KmXI/IQn8t0YbdD73Fv6VT6awNrxOrp6IFoQ7Ef/c7lbPOP:1tD71mke/lng0kdgGawNsrp6IL1POP
- TLSH
  T156A73321FA0D1EF7E1537E3D51418F268F2D9093224EF48E2EB846E415536CDAB9A70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  python.exe
- Size 103KB
- SHA256 03168c01b7b7491423350e82c26fee71f35b43694d1319d3c668bda6903a0c38
- MD5 5af6d8dfe0f5b64c65eda60d23c2c199
- SHA1 fdb0927e16b5539a6124cc0202462eb366589a82
- SHA512 396eeea4783a6f6e146e3a9d92973654287aa78028630d53253769884737a7dc6acb1c3be6d069d6d0e3eee419484e36cf41b3ec0d7c45184c17ddb0274a9f39
- SSDEEP 1536:vPuRbuEYE+9z2wp+FavGmhMn+IhzZtzY//QRXy1Ni9KfIkFT:vPuRbuAs0FNmhMn+IhNq//QRD0
- TLSH
  T1C3A3F48A6A1E8191D5749070437B87F26B2C2F62A9C3C68D67C17F16E97D2C1F60A733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  python3.dll
- Size 72KB
- SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
- MD5 a5495a547b4218148914469f1ee65d47
- SHA1 91632b2965ae22db25edce6971cf59c0a3a00bba
- SHA512 ab1fe6ec0b21fdac78b17afc0fd3a7573b89647a3e4af846448e285a7989342f4a8eaf191a4e90e81a990f10ff1364dd941a0c7f80c108224d8f6c7cf6bb49d1
- SSDEEP 768:xHQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKp:0bTrnXngXMu8IGG0ly1Ni94fIk0h4
- TLSH
  T168735D4E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22735D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  python314.dll
- Size 6.5MB
- SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
- MD5 006b0746b5abaf438d1bc753261c6d2c
- SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
- SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
- SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
- TLSH
  T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  tcl/dde1.4/tcldde14.dll
- Size 36KB
- SHA256 95454d21be84b4bef1f90b7aff56484b0111b30384d7c6d1a05463871c8036d3
- MD5 13676a6524dde69d0a45a87470a6b30a
- SHA1 b10a804ea662dcc55746bf531ebc4a48ebc29fca
- SHA512 7c3a6aa340cb8afa7e752ab85fa2638bbd4d401fb9daf6c0ab82b74e032202cc908e50d340dc992ab7b55a56af237951e579c74743fc00976c8ab2ff18a18d2c
- SSDEEP 768:BdRLiwEKbvg+Zk0K98PB7wbYpZd7/v5YiSyvDHAMxkE:BtLgGk0y8JFjTB7Sybnx
- TLSH
  T1D0036B27A3950489DC27D870E86A8A27EEF27550271096DF4364C6782F32BD3BB3D625
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  tcl/nmake/rules.vc
- Size 61KB
- SHA256 5ca108465a7c0a6632f117d96bf59cf60aa53b2e5766b3a65e6f8c8946c7f280
- MD5 f354b35e52b4d3f607d25ef5d8cac821
- SHA1 9141116169bef563a6a9933cbae728ffba0522b2
- SHA512 88b9f289690d7a63ce8270d6f6c57e2262b3f9c08e7b9dbb9f50d4f0275d4b18dc1a78873721962b7925e17e76aeea8e28d5b60ebe7a04eb44cb10a080e42faa
- SSDEEP 768:xyF+oYeZRyT+8Ch77407aW6myoORlK9UTZ0knAL7K0g/9ftl4clFqcdVz:oyNTJw7WFRlKyt0knAL7K0g/Fb4mFVz
- TLSH
  T15A53C7BA4D4F5EE95331C582F71CA04BF31950256F772938B06C5898B36A894837FFA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  tcl/nmake/x86_64-w64-mingw32-nmakehlp.exe
- Size 25KB
- SHA256 5f411c0bd9ed9a42b0f07ed568c7d0cf358a83063b225a1f8f7da3296dde90f1
- MD5 abbd49c180a2f8703f6306d6fa731fdc
- SHA1 d63f4bfe7f74936b2fbace803e3da6103fbf6586
- SHA512 290dd984acc451b778f3db8c510bae7aec1d9547c3ad0a1829df731c136e4ecc9a37dc6a786cf8f1ecc4d14339aed1288af25055f450f6f953138c8d4d5c36e9
- SSDEEP 384:OSZ/JKNZKZCGRHJPth4VKAvDgDJgoku8:OSQQTRJPzkKAEN
- TLSH
  T1A8B2291FF21694E9C14AC2B4D5EF5B33A5B3BD311AB12B2D8368F3606F51690693EA40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  tcl/reg1.3/tclreg13.dll
- Size 33KB
- SHA256 0250f59bf28cb7b65ed46a3befab5cff58785628502c5bd982e4c890580b85ad
- MD5 adeccc5d9e19da06a7336b136cb501c4
- SHA1 316a043c97e37279ed6b6eb964f8263cd82788b0
- SHA512 a822603ab96ddb0fde1cf38dacc4f9bb30c4a19a7afb0fde20e0ebd62ca9487c27e73d79a4354b18748e3d80ed3e00ddfa469f956e3ebe930dd1f535dd7fbf87
- SSDEEP 768:BFazZ3f/bphepLS3q+xRW5YiSyv6AMxkEDE:2J9wpKq+xRs7SyAx0
- TLSH
  T165F27C63A7650485DD27C978D8DA9A27EEF2B1941B4082CF4315C66A1F323C3BB7D329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  tcl/tcl8.6/auto.tcl
- Size 21KB
- SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
- MD5 97efa9ebe840ea051f9706504c8bd783
- SHA1 287dea14d47977dcd8edc525fe750c836264db5c
- SHA512 ab9fc210f3bfd181cc2b93dd348415f67f763b2c7961179a88eba3f7f87e44b21a66ea4ea53715fb88784288c75b8270640f3bc6beafb0e8cc21966068a79bf2
- SSDEEP 384:UqT9XC9VZvWQjCTzsCTV7672ORgS0myvxFRTX7Xvt3wBTnbXhCUquyvz:LT9XC9VZvhjCPsCp7JlmyvTxvt3gTnbW
- TLSH
  T1EFA2B7635F9542A630B1C22B553DB9A4EF2F81B70675801D38F8912C37F1815C6BEAEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  tcl/tcl8.6/init.tcl
- Size 25KB
- SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
- MD5 ffe4e47b5f4f96ec33fb31d52ef0b636
- SHA1 3a625e493f8778277f65ffef1e0879fbec0e4d0d
- SHA512 dbbfd92ab6d95672f7882f3affb75f31749281c7450c29fcef58b5bdfd4f42b6d1d9f3a50ae0d3aa27e95d48918ed55cde5149751f892538bdd2dc39c618927e
- SSDEEP 768:+XrgPHudKlE7BG6Xg3tMo846ofRRECL9QDjr5v7hzx/i:igGdKlK4Ao846offLmNhNi
- TLSH
  T104C2A8112388917932B3533686B5E598EE7EC1F706A941BCBCCC825C777150A4AFDBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  py-manager.exe
- Size 306KB
- SHA256 b9f4ab19f635829a06b77c40c5fe7f445406e15770514cd022b0e539c56c6f16
- MD5 0b3167a680f1a9e6cb0179c936db823d
- SHA1 9fda95db49cb68b7d129def73ad7be231c7d5bea
- SHA512 0fb3039249b273d964451bba49037e0e137936e651122f54580b88b4950089a3e6f0ef41a74e8c549cc11e7686cd1b2edc9d8c94ce748e9d077dfc9259a31058
- SSDEEP 6144:kdxBQr1oqMZHuAx92JAFb2G3dkWQGMpSn2mOoAg6CU330gu3EEttdptOItbOO27x:MIJ2n2mO/
- TLSH
  T1FD64381862A65A59EB3682784B7B07E16F3D3D05A781C5CF1390399D092FED8F634B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  py.exe
- Size 306KB
- SHA256 d2e3f5fa8f1feb5443b70062663e1e4555dfeec4155c2cf0ad432eb8b861d469
- MD5 e9e0cba19c4abdc84b1d8ae9306efe61
- SHA1 011a11ab6f7399b4d248d500f4bfff1bdc20c847
- SHA512 c3230d7648953afd10afb0ee56726d7ddae7dad0546d70c08d1b82cd0feadef0014afd04e18aad06639e855d9034bc89e38889cb995970d0afe3f169fc867837
- SSDEEP 6144:EdxB4y1oqMZHuAx9b/SF72m3dkWQmspjrZybLkAJB330gu3EEttdptOItbgO27MB:sc/drZybx2
- TLSH
  T15064381862A65A59EB3682784B7B07E16F3D3D05A781C5CF1390399D092FED8F634B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral23 behavioral24
- Target
  pymanager.exe
- Size 306KB
- SHA256 ebcf68dcb3c615ea37219d69b907204e1c55f9eb54199ec24f74a778ce200951
- MD5 c6613eafafeac8216b6e36b49e8bb863
- SHA1 42cd409dca18888b87fc7b114a8f5b644e7d1ae5
- SHA512 6dd4fd9e6c9ab9f1f6ddd03fddda5f834b808eda2041c2860d31390c320c6e21003884e1d634b87bee325cc9faa72b515433ab2495d152b60e9c3abd0e9b6640
- SSDEEP 6144:6dxBQr1oqMZHuAx92JAFb2G3dkWQGMpSn2mOoAg6CU330gu3EEttdptOItbrO27r:mIJ2n2mO/
- TLSH
  T1C464381862A65A59EB3682784B7B07E16F3D3D05A781C5CF1390399D092FED8F634B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  pyshellext.exe
- Size 1002KB
- SHA256 701bc674a6899fb335e6bc3080eb25541a769385b52a181a9276ac6fe7ffb46f
- MD5 55081b849c436747546416ecc54d7ef2
- SHA1 3ffb0e91b54a0b8f0c653fb1d41e8c83603c4ce0
- SHA512 209e8400e005c4019afec01be6a14e6251c8a99f469a8fd79d16d1960714b42bda56a2bc45af67d53417669638fe75e0a7d9d1ef8d2085ae48aeb134d559a65b
- SSDEEP 12288:BbT6V1l5XQf30AVSHvE+6FFOwOTJQyIcrdGwM+W4t68Xn0du:BbTW1l5XQcAVSH0FO/TJhRM+W4t9
- TLSH
  T1B1257C11665D3DE8E07780368B7686E2AB75FC140750D6CB13E07B652E3B2D27A3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  python.exe
- Size 306KB
- SHA256 5da5ad3f515a97310adaa03019a110de8cab9f275767a6571c7b2a722c89eae9
- MD5 fc4081c273943d406622271c654c7bca
- SHA1 e9e514f5c373ff8206964f267381a4135cd80d10
- SHA512 d8d55361d488477a969d38a753a5d4a9b0cbad840ba56954311a2cb3b64b87a5c61ebeaf0bcb3fc639bf32c67982cede4b21757b0caf93341cfc54711a55eadc
- SSDEEP 6144:4dxBQK1oqMZHuAx92JAFb2G3dkWQGMpSn2mOoAg6CU330gu3EEttdptOItb9O27:QxJ2n2mO/
- TLSH
  T1AE64381862A65A59EB3682784B7B07E16F3D3D05A781C5CF1390399D092FED8F634B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral29 behavioral30
- Target
  python3.exe
- Size 306KB
- SHA256 9ae0b98f4b26d0955690c7afe57959376dca88f13fcd65d0bb1cb90abbeb1b29
- MD5 a54ae7d8febc9ab9c5fb49e5c9c30cf6
- SHA1 45bb03f5839316082e4eeea9379a907079fd70fc
- SHA512 d9e9de5604e0673d353dcf15d204934a7133c0c16ba065368ab6bab4b2da8bc86e87a27542a02c2f653680c54b6455f1c015326fa2bda66430281de9f23d5d97
- SSDEEP 6144:7dxBQK1oqMZHuAx92JAFb2G3dkWQGMpSn2mOoAg6CU330gu3EEttdptOItbuO27b:LxJ2n2mO/
- TLSH
  T15B64381862A65A59EB3682784B7B07E16F3D3D05A781C5CF1390399D092FED8F634B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Badlisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Obfuscated Files or Information: Command Obfuscation

Badlisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Obfuscated Files or Information: Command Obfuscation

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32